When you download an app, it might request access to your Gmail account. But what you might not realize when you grant access is that these apps may analyze your Gmail data — including the content of your emails — for their product, and potentially for targeting ads. Apps are also allowed to share your information with third parties, as long as Google determines that it adequately discloses that to users. The Journal previously reported that “hundreds” of apps can scan the email of “millions” of users.
Google says it reviews apps to make sure they are clearly communicating what they have access to. But unless Gmail users are diligent, security experts that Mashable spoke with say the policy potentially exposes people in ways they may have not consented to or understood.
Several experts said that app developers’ access to user data is more than just potentially creepy or invasive, though. Giving an app access to your Gmail can expose received emails as well as sent emails. So, because the policy could expose both your and your friends’ data, app access to Gmail could create a security risk similar to the mechanism that allowed for Facebook’s Cambridge Analytica scandal.
In that instance, a researcher used a third-party app, downloaded by 270,000 people, to gather data on all 87 million Facebook users in their friend networks, and then sold the data to a company (Cambridge Analytica) that used it to engage in political advertising. So, similarly, if you happen to send an email to a Gmail user who has given an app permission to read their emails, not only can that app see your correspondence and information — but a further removed third party can also see your emails, without you having ever given consent to either party.
“I do not see what is to prevent this type of access to be abused and misused in a similar way to Cambridge Analytica,” Brian Honan, a cybersecurity consultant for major banking companies who used to work with Europol, said. “Third-party apps with access to peoples’ accounts can expose a lot of personal data about those persons which could be used to target subsequent adverts or messages to them.”
In a letter, Google reportedly told Congress that when Gmail users grant apps access to their accounts, they may — perhaps inadvertently, if they do not read the terms closely enough — allow these apps to harvest their personal information. Apps can then use what people talk about in their emails, along with demographic and other information, to target their advertising. Google lays out the policy here.
Further, under Gmail’s rules, developers are then allowed to share Gmail users’ data with still other external parties. Google says that it vets the apps, and allows this data sharing as long as it determines that the developers are adequately disclosing the activity.
Gmail itself ended the practice of using the content of people’s emails for ad targeting in July 2017. But it has apparently kept the ability in place for outside parties — so long as users “consent.”
Experts say this portion of Gmail’s app developer policy is concerning for several reasons, on the fronts of both security and privacy.
“Without technical controls built in, app vendors are going to get to wherever they can within the platform, and within user accounts,” Rebecca Herold, a top information security expert and consultant to multi-national corporations, who is also known as “The Privacy Professor,” said. “That’s what the apps are designed to do, to gather data. These companies need to build a more rigorous set of controls to prevent that from happening.”
The most straightforward problem with Gmail’s policy is the security vulnerabilities it could open users up to.
“All of these third-parties have been vetted by Google, but the reality is that every company is vulnerable to data breaches,” said Gary Davis, McAfee’s chief consumer security evangelist. “The more an individual or company shares personal data, the greater the likelihood of that information falling into malicious hands.”