Judge Cuts Google No Slack in Gmail Wiretap Case

Google may have breached federal and California wiretapping laws by machine-scanning Gmail messages in order to deliver targeted advertising, U.S. District Judge Lucy H. Koh ruled on Thursday. As a result of the ruling, a class-action suit against Google over the issue can now proceed.

The suit, which is being heard in the U.S. District Court for the Northern District of California, contends that non-Gmail users were also subject to illegal interception when they sent email to Gmail users.

With some 450 million users globally, Gmail, along with the company’s Google Apps business, is the world’s largest email service. Google sought to have the federal case dismissed under a section of the Wiretap Act that authorizes email providers to intercept messages when it facilitates the message’s delivery or if the interception is incidental to the functioning of the service.

“We’re disappointed in this decision and are considering our options,” Nadja Blagojevic, a Google spokesperson, told the E-Commerce Times. “Automated scanning lets us provide Gmail users with security and spam protection, as well as great features like Priority Inbox.”

‘A Valuable Corporate Asset’

Google revised its terms of service and privacy policy in 2012, but the average user — even having read the new policies — would not necessarily understand that the emails were being intercepted so as to create user profiles or as a way to provide targeted ads, Koh noted.

“Whether or not it is plain in the terms of service, Google has pretty clearly telegraphed to the industry that content you provide is content they use,” said Jim Purtilo, associate professor in the computer science department at the University of Maryland. “This is independent of privacy settings.

“Some people who indicate ‘don’t advertise to me’ misinterpret that to mean their content is protected, but Google takes that to only narrowly mean you should not get direct ads,” Purtilo told the E-Commerce Times. “Your content is still joined with many other bits of information about you in order to sharpen your profile, which is a valuable corporate asset.”

Definition of Privacy

What’s needed is a better definition of privacy, suggested Alan Webber, industry analyst and managing partner at the Altimeter Group.

“This is why the judge is allowing this go forward,” Webber explained. “What we need is a better definition of what is private information online.

“It is clear that date of birth, social security and that sort of thing is considered private information,” Webber told the E-Commerce Times, “but content in an email that is being aggregated is another issue.”

No Law Yet

At this early stage of the class-action suit, Koh’s opinion does not create any new law, Cynthia Larose, chair of the privacy and security practice at Mintz Levin, told the E-Commerce Times.

“Judge Koh’s opinion directly responds to Google’s claims and arguments in its motion for summary judgment seeking dismissal of the class action,” Larose explained.

Still, “a close review of the opinion gives one a good read into how this particular federal judge views the interplay between the federal wiretap laws — the Electronic Communications Privacy Act of 1986 — and Google’s arguments,” she said.

‘A Reasonable Expectation’

As for privacy, it’s not clear what’s reasonable in terms of expectations.

“The average user of Gmail or other free email services expects that email has the same amount of privacy as first-class mail,” Larose suggested. “That just is not the case.

“Judge Koh did grant Google’s motion to dismiss some claims under the California Invasion of Privacy Act that specifically alleged the unauthorized electronic eavesdropping on confidential conversations,” she added. “She pointed to decisions from the California appellate courts that rely on the theory that individuals cannot have a reasonable expectation that their online communications will not be observed or ‘recorded’ by third parties.

“Email is not akin to phone calls or first-class mail, and other courts have clearly made that point over time,” Larose stressed. “Unfortunately, the average email user has failed to understand that.”

How the class-action case proceeds from here “will depend on the courtroom combat skills of legal grammarians as they parse each assertion in the terms of service,” Purtilo noted. In the meantime, “the bigger take-away is, little to nothing of your content goes unused by Google.”