Judge refuses to throw out Google email scanning lawsuit

Judge refuses to throw out Google email scanning lawsuit

Summary: For the second time this month, a federal judge has refused to dismiss a case accusing the tech giant of potentially violating wiretap laws to target advertisements through email scanning.

TOPICS: Google
credit brian turner
Credit: Brian Turner

On Thursday, a federal judge refused to throw out a lawsuit which alleges Google's email scanning practices break federal wiretap laws -- for the second time this month.

U.S. District Judge Lucy Koh said in a 43-page ruling that users can sue the firm in a proposed class-action suit for scanning their Gmail email accounts, which is allegedly used to create targeted advertisements and profile users by "reading" emails, as reported by The Wall Street Journal.

The tech giant insists the scans are automated and no human operator views the results or contents of individual emails. In August, a motion filed by Google against the complaint said that "a person has no legitimate expectation of privacy in information he voluntarily turns over to third parties."

In a statement, Google said it is "disappointed" with the ruling and is considering its options, commenting:

"Automated scanning lets us provide Gmail users with security and spam protection, as well as great features like Priority Inbox."

The ruling comes after Google was accused of violating the Federal Wiretap Act, which usually prevents the interception of "wire, oral, or electronic communications" unless a wiretap order -- similar to a warrant -- is granted to police officers. The Supreme Court has said that as wiretapping is a serious invasion of privacy, recording communications should only take place when investigating serious crimes. 

Google, seeking to have the alleged privacy breach case dismissed, argued that email scanning is an exception to this law, as it falls within ordinary business practices -- including the delivery of a message and allowing the service to function -- which makes the process legal. However, the Cupertino, Calif.- based judge said that this exception was only admissible if interceptions were "instrumental" to sending an email -- rather than used to target advertising and create user profiles.

"The statutory scheme suggests that Congress did not intend to allow electronic communication service providers unlimited leeway to engage in any interception that would benefit their business models, as Google contends. In fact, this statutory provision would be superfluous if the ordinary course of business exception were as broad as Google suggests," Koh wrote.

The federal judge also threw out the tech giant's claim that scanning was necessary if email services were to function. The firm argued that users who agree to the company's terms of service and privacy policies -- and non-Gmail users who received emails from a Gmail account -- gave implicit consent simply because of how email operates. Koh, however, could not find clear notifications in Google's terms of service which state that the firm would intercept communication to glean data for targeted advertising or the creation of user profiles.

The Gmail service has over 400 million users worldwide.

Koh said:

"Google further contends that because of the way that email operates, even non-Gmail users knew that their emails would be intercepted, and accordingly that non-Gmail users impliedly consented to the interception. Therefore, Google argues that in all communications, both parties -- regardless of whether they are Gmail users -- have consented to the reading of emails.

The Court rejects Google's contentions with respect to both explicit and implied consent. Rather, the Court finds that it cannot conclude that any party -- Gmail users or non-Gmail users -- has consented to Google's reading of email for the purposes of creating user profiles or providing targeted advertising.

Accepting Google's theory of implied consent -- that by merely sending emails to or receiving emails from a Gmail user, a non-Gmail user has consented to Google's interception of such emails for any purposes -- would eviscerate the rule against interception."

Google is not permitted to immediately appeal the decision to the 9th U.S. Circuit Court of Appeals. Instead, the company has to gain Koh's permission in an interim appeal.

Topic: Google

Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.


Log in or register to join the discussion
  • Google...

    the biggest invasion of privacy in the history of the world. I can't believe people would use gmail when there are many other alternatives (often better) out there that respect their customer's privacy.
    • EMail Privacy?

      Anyone who thinks email is private, or secure, does not understand how email, nor the Internet, works.
      • Use your head dude! What do you think the lawsuit is about?

        It's precisely to try to make sure that, e-mail is private, and that invasion of that privacy could result in legal action.
        • You obviously still don't understand.

          Because of the actual way Email works, that is literally impossible. I'm not talking about, "Oh, well it isn't possible because of the way Google works," I'm talking about, "Literally, no matter how you implement email, unless you're using PGP encryption, it is *literally* impossible."

          An email is composed of several sections. Often these sections are things like, "Text only version of the message, HTML version of the message, Attachments, attachment data, sender/receiver information..." Etc. At the VERY MINIMUM, Google would have to scan the entire Email to look for these sections, and store the data in their own more optimized database for easier retrieval. This is at a VERY MINIMUM, and already they're having to scan and parse the entire email!

          What's more, since the content of email is not encrypted (only data between servers, unless you use PGP or something similar), as soon as you send an Email, that server has access to the full message. It is NOT equivalent to normal mail; there is no envelope that needs to be opened or anything. It's just *there*. What's more, in order to properly handle that message and make sure it gets received by the person you're sending it to, lets them see the attachments, and lets them choose between plain text and HTML, they HAVE to scan the whole thing anyway.

          The Email server parsing emails (both the ones sent BY it to others, and the emails sent TO it by others) is thus going to happen no matter what, across all email systems you can imagine. Even if you own, run, and maintain your own Email server, anyone you send emails to can (*GASP!*) read your emails. and YOU (*GASP!*) can read THEIR emails! But in order to do that, the respective third-party servers have to actually read those emails too, not just the individual person you're sending the email to.

          This lawsuit literally could be sent to ANY company running their own email server. The only reason why it's not being thrown out is because Koh has a history of not understanding technology... You should read about her Apple verdict.
          • right, but...

            that's just how email works, and has to be like that for it to work.
            But that doesn't mean that while parsing the message, any company can extract data from it for any purpose but the delivery. That is what's being judged as unlawful, and the judge seems to know the diference between standard operation and "extra access".
    • tell me an alternative

      My beef with people like you is that you think Google should offer FREE email just because they're swell. You think you deserve a valuable service at no cost to you.

      Which free email service do you use that offers the service level that gmail offers?
    • Then i'd say kiss the poor spam filter good bye

      How else do you think the spam filters setup by the emails provider works. Yeah they aren't that effective but work well enough to where I dont have to filter through 200+ spams daily when checking my mail.

      And when the ones I mark as spam gets added to the providers spam db/filter. at some point it gets passed through to everyones account. Maybe its coincidental but I have several dummy accounts in which I was getting the same spam in inboxs. I marked several as spam in one account and just deleted them once in other accounts. Well a few weeks later the spams not flagged in other accounts from same provider automatically started showing up in the spam folder.

      just some food for thought.
      Free Webapps
  • Not Sure

    Not sure the judge has this right. Lawyers would have shut this down at Google if they thought the company was potentially at risk here.

    All this and the fact that Koh seems like she's trying to be controversial.
    • Re Google lawyers

      Not true. Human Resources folks divide a company's employees into "line" and "staff". "Line" people are those directly involved in providing the company's products--in Google's case folks who sell advertising, software and hardware engineers, folks who install and maintain the hardware, etc.

      EVERYONE else is "staff". Lawyers AT A LAW FIRM are "line". Lawyers, (accountants, maintenance workers, etc.) are STAFF.

      Routinely, STAFF folks are "at the bottom of the totem pole". "The tail doesn't get to wag the dog." Google doesn't have HUNDREDS of in-house lawyers, it probably only has a few dozen. And they probably basically take care of routine matters like local regulatory filings, responding to "nuisance" complaints (i.e., folks who write complaints to one company after another claiming some ridiculous violation of law that is total b.s., in hopes of getting some money), and answering routine in-house legal questions.

      OUTSIDE COUNSEL don't have managerial authority. They don't even ATTEMPT to tell management what to do because their firm would get dumped and lose MILLIONS in legal fees. They only give advice on specific issues when asked. And even when asked, they don't have decision-making authority, they just provide research and recommendations.
    • "Not sure the judge has this right."

      UUUhhh... What?

      No. Judges make the decisions. Lawyers argue the points.
      • Just because a decision was made doesn't mean the decision is right.

        This one is actually stupid. Right up there with laws trying to define the value of PI.

        Email has never been private. The body of the email CAN be private, but only if the sender encrypts the body before sending, and the receiver decrypts it to read.

        Anything between hitting "send" and "get mail" is open season.

        If you don't like this, you should also consider that any decision against Google will also kill all spam filters handled at the server. Microsoft (or any other Email service) won't be happy because their bandwidth will be sucked dry by the spam they will be forced to hold. Users won't be happy due to their mail box storage being overflowed every couple of hours.

        Of course, there COULD be a bright side... It just might force ISPs to stop using NAT, which would allow every user to be running their own private mail server which could then discard whatever the user wants.

        The NSA won't be happy either... as suddenly there would be no centralized mail servers they can harvest ... scanning the mail in the same way, but without any oversight.
        • Spam filters would probably pass muster

          They serve the interests of the user and make the service more attractive.

          Of course, if you're running an advertising supported service, the real customers are the advertisers (the people who pay), but that's probably not relevant in this case.
          John L. Ries
          • ADVERTISING serves the interest of the user and makes the service attractiv

            Or would you rather PAY?

            My beef with people like you is that you think Google should offer FREE email just because they're swell. You think you deserve a valuable service at no cost to you.

            Which free email service do you use that offers the service level that gmail offers?
    • Disagree

      While IANAL and I don't profess to be familiar with the relevant laws, I think the judge is correct that scanning to facilitate advertising is not "instrumental" in running an e-mail service.
      John L. Ries
      • Maybe not instumental but highly desirable

        You're right, gmail could offer completely random advertisements to support FREE email. I really look forward to seeing advertisements for a car wash in Alabama, roofing services in Florida and announcements about the monster truck rally *anywhere*!

        I would *never* click one of those ads, click-through rates and conversion rates would plummet, gmail ad revenues would plummet and google would be forced to reduce service in some way. Maybe cut storage to 500MB or drop all email over 6 months old. If you were google and gmail revenues dropped 50 - 75% how would *you* respond? You're answering to your shareholders; they demand corporate profits and google *needs* profits to stay in business. How do you respond to a giant drop in revenue?
  • Forwarded email

    I haven't read the opinion, but another issue is forwarded email. What about folks who use a NON-gmail account but forward the email to their gmail account? Folks emailing them have no reason to think Google is involved in any way, so there definitely is NOT an argument that they impliedly consented to have Google scan their email.
  • Google shouldn't be scanning for marketing purposes...

    ...However, this decision has father reaching aspects as a LOT of companies scan e-mail for viruses and for spam. Technically, this decision would allow people to sue for that as well. That would be obviously bad.

    My beef with Google is that they are scanning my private stuff to make money off me, whether it's done by people or machine. Them scanning it and building a marketing profile to sell off to other companies bothers me greatly. Frankly, I couldn't give a care in the world for Priority inbox as I generally use POP, but if I didn't I still wouldn't need it as I've been sifting through e-mails quickly for almost 25 years now.
    • Private Stuff?

      You've been using email for 25 years and STILL think its private? Go find a book on Internet protocols for god sake. Privacy? Email? sheesh.
      • Your house isn't private property because crowbar technology can unlock it.

        Your wallet is not private property because pickpocketing technology can relieve you of it. Your car is not private property because car-jacking technology can take your car away from you when you are sitting in it, and hot-wiring technology can take it away from you when you are not sitting in it. Telephone conversations are not private because wiretapping technology can listen in on it. Oops, there IS a statute that specifically says that wiretapping is illegal without a warrant. The existence of a technology for stealing something from you does NOT give other people (or ISPs) the right to steal it!
        • Email is not encrypted, not protected.

          Your house has walls, windows, doors, etc. to partition the inside from the outside. Your pocket seals shut from the flatness, and besides that, has walls on all sides to prevent things from falling out (duh). Cars have key systems.

          What does email have? NOTHING. Absolutely nothing. If you're lucky, the email servers handling your email will encrypt the traffic to other email servers, so that people between the servers can't intercept it. But that's not what this is talking about; this is talking about the servers themselves.

          And those email servers themselves have those emails in plaintext, and they HAVE to have it in plaintext.

          This is like you sending a postcard to your significant other, and expecting that the mailman not look at the picture on the front. He's going to have to look at the postcard to see where to send it to, so he's going to see the picture on it! He HAS to. No choice. Nothing to protect the postcard, as it's not in an envelope.

          Email is not secure. Email is not private. Email has NEVER been secure OR private. The only way it ever can be is if you encrypt the email with PGP or similar.

          If you care about privacy, either encrypt or DON'T USE EMAIL.