Lawsuit alleging Gmail ads are “wiretapping” gets judge’s OK

It's widely understood that the ads Google puts in Gmail are based on the content of e-mails. The millions of Gmail users presumably accept the company's promise that "no humans read your e-mail."

Despite that, a lawsuit claiming that Google's practice violates pre-Internet anti-wiretapping laws will be going forward. Lawyers representing non-Gmail users of various stripes in a class-action lawsuit say their clients never agreed to have their e-mails intercepted and scanned by Google. They argue that Google's "interception" of those e-mails violates federal anti-wiretapping laws and state privacy laws. And today, US District Judge Lucy Koh agreed with them, refusing to grant Google's motion to dismiss the case.

Even an e-mail sender who read the company's privacy policies "would not have necessarily understood that her e-mails were being intercepted to create user profiles or to provide targeted advertisements," stated the judge. The plaintiffs in this case haven't consented implicitly or explicitly to have their e-mails scanned, and so the lawsuit can move forward, she ruled.

Some of the plaintiffs do use Google mail, but they're not free Gmail users, who would have agreed to Google's ad-scanning terms when they signed up. Rather, they're users of non-ad-based e-mail, including some of Google's own paid services, like Google Apps for Education. Those users of non-Gmail services didn't agree to get their e-mails scanned by the service, their lawyers argued. 

The proposed classes of plaintiffs—and there are several—are potentially huge. One includes "all US citizen non-Gmail users who have sent a message to a Gmail user and received a reply or received an e-mail from a Gmail user."

No, really, they’re all cool with it

In its defense, Google said that those users gave "implied consent" to Gmail's business practices when they chose to e-mail Gmail users. "Google's theory is that all e-mail users understand and accept the fact that e-mail is automatically processed," not just for advertising but for things like spam filtering, which is vital to running a modern e-mail service. In its motion to dismiss, Google described this class action lawsuit as an attempt to "criminalize ordinary business practices" that were nearly a decade old. 

Koh didn't buy it. Google's theory that non-Gmail users had offered "implied consent" when they shot off an e-mail to a Gmail user would "eviscerate the rule against interception," she wrote. 

Even for users who may have read some company policies, Koh found that Google's disclosures were lacking. They suggest that Google ads "were based on information 'stored on the services' or 'queries made through the Services'—not information in transit via e-mail," she wrote. Google also doesn't disclose that it uses e-mails to build "user profiles," not only to serve up the immediate advertisements.

Google did succeed in getting certain state law claims thrown out of the lawsuit, including claims under Pennsylvania law and some California state law claims.

The search giant hasn't lost this lawsuit—there's a long way to go. The plaintiffs have a lot of work ahead of them, including getting their case accepted as a class action. The fact that Google wasn't able to knock the case out on a motion to dismiss does increase the chances of a settlement, but it seems likely Google will fight tooth-and-nail on an issue like this. The company is already fighting hard against an adverse ruling that anti-wiretapping laws apply to its Wi-Fi data collection screwup. It suffered that ruling at an appeals court earlier this month and has asked for it to be reconsidered.

One user of an academic email system powered by Google told Ars he agreed with at least some of the sentiment of the lawsuit, in that Google hadn't fully disclosed how it was using emails it distributed.

"Here at Berkeley, I repeatedly asked both lawyers and engineers whether our gMail-powered email system, bMail, would profile students," said UC Berkeley law prof Chris Hoofnagle in an email to Ars. "They said there would be no ads, but would not make a writing about other data mining of bMail content.  We certainly did not consent to all of this, and in retrospect, I feel (as a relatively sophisticated player in this field) misled by the Google people."