Source: https://epic.org/privacy/gmail/faq.html
Timestamp: 2019-04-24 06:11:16+00:00

Document:
While Google has not released technical details of how the Gmail e-mail "content extraction" and analysis works, the patent(#20040059712) filed with the US Patent and Trademark Officeprovides some clues. Gmail examines the entire content of the e-mail message including the header and addressing information (see 2.2for more details) in order to derive the the "concepts" contained in the e-mail. Relevant ads are then placed to the subscriber when the e-mail is displayed. Different ads may be served at different times depending on when the e-mail message is viewed, or re-viewed.
2.2 What is "internal" and "external" e-mail information used in the analysis?
"Internal e-mail information" and "external e-mail information" are both used in the scanning and analysis process, according to the patent(paragraphs 51-80). Internal e-mail information is the actual data contained within an e-mail message where as external e-mail information is data derivedfrom the internal information using Gmail's analysis algorithms (e.g. by looking at the IP of the sender and/or the timezone in the timestamp, the geographic location can be determined).
2.3 Will Gmail build profiles of subscribers and/or non-subscribers?
2.4 Why is Gmail different than spam filtering?
From a technicalstandpoint, there is no categorical difference between Google "content extraction" and spam filtering-- each involves an automated process that analyzes the body and/or header information of e-mail messages. However, from a legal standpoint, there is a fundamental difference between filtering out unwanted junk e-mail and analyzing the content of private communications in order to target advertisements. (See 1.3d "Bad Legal Precedent") Additionally, Google may choose to create profilesof subscribers and the people with whom they e-mail, possibly cross-referencingother Google products (Google search engine, Orkut, etc).
2.5 It's a computer, not a person reading your e-mail. What's the big deal?
2.6 What patents has Google filed for Gmail?
[The primary Gmail patent] United States Patent Application 20040059712: "Advertisers are permitted to put targeted ads on e-mails. The present invention may do so by (i) obtaining information of an e-mail that includes available spots for ads, (ii) determining one or more ads relevant to the e-mail information, and/or (iii) providing the one or more ads for rendering in association with the e-mail."
United States Patent Application 20040059708: "The relevance of advertisements to a user's interests is improved. In one implementation, the content of a web page is analyzed to determine a list of one or more topics associated with that web page. An advertisement is considered to be relevant to that web page if it is associated with keywords belonging to the list of one or more topics. One or more of these relevant advertisements may be provided for rendering in conjunction with the web page or related web pages."
United States Patent Application 20040093327: "Advertisers are permitted to put targeted ads on page on the web (or some other document of any media type). The present invention may do so by (i) obtaining content that includes available spots for ads, (ii) determining ads relevant to content, and/or (iii) combining content with ads determined to be relevant to the content."
3.1 What are the Federal wiretapping laws, and does Gmail implicate them?
The Electronic Communications Privacy Act (ECPA)was passed in 1986 as an update to the law governing the interception of electronic communication, including e-mail. Title I of ECPA (The Wiretap Act) ( 18 U.S.C. § 2511) governs communications "in transit."
The federal Wiretap Act only requires one of the parties to consent to the acquisition of the communication. However, the Ninth Circuit Court of Appeals has indicated (in construing the authorization provision of the Stored Communications Act) that an ISP will not be insulated from liability if it "procures consent by exploiting a known mistake that relates to the essential nature of his access." Theofel v. Farey-Jones, 341 F.3d 978, 983 (9th Cir. 2003). Therefore, even the Gmail subscriber herself has consented to the acquisition of her communication, thus negating the application of the Wiretap Act, only if Gmail has adequately revealed and explained the "essential nature" of their access to the e-mail communications.
3.2 What is California's wiretapping law, and why does Gmail implicate it?
As interpreted by the California courts, § 631 criminalizes "three distinct and mutually independent patterns of conduct": (1) intentional wiretapping, (2) willfully and without the consent of all parties reading/attempting to read or learn the contents or meaning of any communication while it is in transit or being sent from/received in California, and (3) attempting to use or communicate any information learned by engaging in the activities prohibited under (1) and (2). See Tavernetti v. Superior Court, 583 P.2d 737 (Cal. 1978), cited in Burns v. Nature's Best, 114 Cal. Rptr. 2d 881 (Cal. Ct. App. 2001).
"willfully and without the consent of all parties to the communication, or in any unauthorized manner"
Google's actions are willful because the service is designed for the purpose of scanning and extracting the content of e-mail messages that pass through its Gmail system.
Google does not have the consent of all parties to each communication. While Gmail users arguably consent to scanning of their own e-mails, parties sending messages to Gmail users have no knowledge of Google's scanning and extraction, and have not consented to these actions.
"reads, or attempts to read, or to learn the contents or meaning of any message, report, or communication"
Scanning of the text of e-mails and extracting, compiling, and using information from this text is an attempt to "learn the contents or meaning" of the communication.
While no human reads the content of e-mail passing through Gmail, the information extracted from these e-mails is available for human viewing in the form of keywords, advertisements, data, etc. Google claims that this information is collected without connections to personally identifying information and is viewed by humans only in aggregated form.
"while the same is in transit or passing over any wire, line, or cable, or is being sent from, or received at any place within this state"
A legal "jurisdictional" issue exists as to whether the e-mail is "within" California.
The statute is violated only if the reading/learning occurs while the communication is in transit, passing over any wire, or being sent/received. However, no court has addressed what it means under California law for an e-mail message to be "in transit" or "being sent from, or received." It may turn on when in the path of the e-mails journey Google is scanning the e-mail and extracting content (e.g. whether it occurs before or after the e-mail has been "received" by the intended reader).
3.3 Is there a "service provider exception" under California wiretapping law?
Unlike in the federal laws, there is no exception in the California wiretapping law for ISPs. Even if there were, Google would be unlikely to qualify for it with their Gmail service, at least under the narrow formulation of the exception. Under a formulation like that in the Wiretap Act (§ 2511) (which exempts a service provider for interceptions "in the normal course of his employment while engaged in any activity which is a necessary incident to the rendition of his service"), content analysis for the purposes of targeted marketing is not "a necessary incident" to the provision of e-mail service.
3.4 What legal objections have been raised in other countries?
Data protection and privacy advocates in other countries have also voiced objections to Gmail, particularly in the EU. In April, Privacy Internationalfiled a complaintwith the UK Information Commissioner, outlining their privacy objections to the Gmail service.
The EU's Data Protection Directive (95/46/EC)affords strong privacy protections, exeeding those available in the United States. EU privacy advocates are very concerned that the Gmail service, which is of course available internationally, violates key principles and provisions embodied in the Data Protection Directive.
Generally, EU privacy advocates have argued that Gmail is a violation of closely-held data protection principles, such as responsibility for the security of personal information held by a provider of service (in its terms of service Google disavows all responsibility for security violations), confidentiality of communications between one party and another (the Directive's working group stated that "no third party should be allowed to read the contents of e-mail between two parties), and control over personal information (Gmail users are not permitted to use any device, manual or otherwise, to monitor, cache, or copy any content from the Gmail service).
Of course, the easiest thing you can do to prevent Google's invasion of your privacy is to not sign up for an Gmail account. In fact, this is what Google and other Gmail advocates have been saying in response to privacy complaints-simply use another e-mail service. For other email providers and privacy tools, see EPIC's Practical Privacy Tools page.
Remember, since Gmail is scanning and extracting incoming e-mails as well, even if you aren't a Gmail user, your privacy may still be violated by Gmail. To avoid such scanning, keep an eye on the domain of e-mail addresses to which you are you are sending and replying.
For more information on the privacy risks posed by Gmail, see http://www.epic.org/privacy/gmail/faq.html.
Use two browsers. have one browser dedicated to checking your Gmail, which you never use for Google searches, thus preventing your Google search cookies from being linked to your Gmail account.
Use an anonymizer.For example, download Anonymizer.com's free privacy toolbarwhich enables anonymous browsing and blocks and tracks cookie settings.
However, it is unknown whether using these methods will "de-link" you from any information Google has already collected about your searching and e-mailing habits.
4.4 What are YOU guys doing about it?
Privacy groups have responded in various ways to Gmail. For example, EPIC signed an open letter to Google regarding Gmail and co-wrote a letter to the California Attorney General outlining possible violations of California wiretapping laws.
Legislative proposals to address Gmail have been introduced in in California and Massachusetts. In California, State Senator Liz Figueroahas introduced SB 1822, a bill that would directly affect Gmail's ability to continue in its current form. This bill would allow scanning for the purposes of ad placement of incoming, outgoing, and stored e-mail and other electronic messages only if the provider abides by certain conditions (does not retain any personally identifiable information, does not disclose any of this information to third parties, deletes messages in a timely manner upon request, etc.) and has the express consent of all parties to a communication. Exceptions are made for scanning e-mails for spam and viruses, and for businesses' provision of e-mail services to employees. The Massachusetts legislation, House Bill 1209, is not directed specifically towards Gmail, but is a general bill that would set up a "Special Commission on Privacy Concerns" that could consider data protection issues and threats to electronic and informational privacy, such as Gmail.
Google bans Gmail sales, BBC News, July 2, 2004.
The Trouble with Gmail, Security Focus, Jun 14 2004.
Tightening the Reins on Gmail, Reuters, May 27, 2004.
My Left Arm for a Gmail Account, Wired News, May 20, 2004.
Does Gmail breach wiretap laws?, CNET News.com, May 4, 2004.
Gmail accounts go up for bid, CNET News.com, April 30, 2004.
Don't be afraid of the big bad Gmail, Salon.com, April 26, 2004.
Legislator seeks to block Gmail, CNET News.com, April 22, 2004.
State senator drafts Google opt-out Bill, The Register, April 13, 2004.
Gmail likely to clear U.K. privacy hurdles, ZDNet, April 13, 2004.
Google values its own privacy. How does it value yours?, The Register, April 13, 2004.
Germans garotte Google Gmail over privacy, The Register, April 8, 2004.
Google mail is evil - privacy advocates, The Register, April 3, 2004.
Google: 'Gmail' no joke, but lunar jobs are, USA Today, April 1, 2004.
Google launches e-mail, takes the Bill Gates defense, The Register, April 1, 2004.
Open letterfrom thirty-one privacy and civil liberties organizations to Google urging them to suspend Gmail until its serious privacy issues are resolved (April 19, 2004).
Letterfrom EPIC, Privacy Rights Clearinghouse and World Privacy Forum to California Attorney General arguing that Gmail violates the California Wiretap Statute (May 3, 2004).
Letterfrom EPIC, Privacy Rights Clearinghouse and World Privacy Forum to Google founders S. Brin and L. Page urging suspension of Gmail (May 3, 2004).
Responsefrom CA AG acknowledging Gmail's potential wiretap violation (June 4, 2004).
Google's Press Releaseannouncing launch of Gmail service (April 1, 2004).
Federal Wiretap Act, 18 U.S.C. § 2511.
Federal Stored Communications Act, 18 U.S.C. § 2701.
California wiretapping law, CA Penal Code § 631.
California Sen. Figueroa's electronic privacy bill, SB 1822.

References: § 2511
 v. 
 § 631
 v. 
 v. 
 § 2511
 § 2701
 § 631