Angry email users can take Google to court for keyword scanning, judge rules

Sparrow Mac Unified inbox email stock

A group of email users can move forward with a class action lawsuit against Google for its Gmail keyword-scanning system, Judge Lucy Koh has declared. Earlier today, Koh filed a decision on Google's request to dismiss the case, which accuses it of violating anti-wiretapping laws by "reading" emails in order to display targeted advertisements. Though she agreed that aggrieved users couldn't legally bring a few of their claims to court, Google might still have run afoul of the California Invasion of Privacy Act and the federal Wiretap Act, and some of its far-reaching defenses stand little chance of success.

At the heart of the case is a question of whether Google's scanning constitutes intercepting a piece of communication without the user's consent. The company has mounted a number of defenses, from the extremely basic to the highly technical. Among other things, it's asserted that the scanning was necessary to the ordinary course of business, that individual states don't have jurisdiction in the case, and that its opponents can't show they were harmed by the scanning. But the case became infamous because of one phrase: "a person has no legitimate expectation of privacy in information he voluntarily turns over to third parties."

"Accepting Google's theory of implied consent would eviscerate the rule against interception."

The quote, actually taken verbatim from a 1979 court case, describes what's known as the third-party doctrine, which limits how much privacy users can expect when they turn over information to a third party like an email provider or phone company. Ironically, an argument that email can't reasonably be considered confidential is one of the only claims that Google won, at least under the California law in question. "Unlike phone conversations, email services are by their very nature recorded on the computer of at least the recipient, who may then easily transmit the communication to anyone else who has access to the internet or print the communications," Koh wrote, dismissing one of the California-specific charges.

In federal court, however, it's a different story. Koh unequivocally rejected Google's suggestion that non-Gmail users had to expect their communications would be scanned, and that they had therefore consented simply by virtue of using email. Even if the third-party doctrine could apply to people who use Gmail, Google has not "cited anything that suggests that by doing nothing more than receiving emails from a Gmail user, non-Gmail users have consented to the interception of those communications," she said. "Accepting Google's theory of implied consent — that by merely sending emails to or receiving emails from a Gmail user, a non-Gmail user has consented to Google's interception of such emails for any purposes — would eviscerate the rule against interception." Nor could Google claim that its scanning was necessary for the business of providing email, a narrow exception to anti-wiretapping law.

This doesn't mean the overall issue is decided. Koh didn't have to determine whether the plaintiffs made a strong enough argument to win, just whether Google had presented evidence that their claims shouldn't be considered at all. Now, the company's opponents have three weeks to amend the handful of dismissed complaints, after which the case will continue on the road to a trial. Google has lost some high-profile privacy cases, and it's possible this will add another to the pile — even if we likely won't find out for a while yet.

The Verge
Log In Sign Up

Log In Sign Up

Please choose a new Verge username and password

As part of the new Verge launch, prior users will need to choose a permanent username, along with a new password.

Your username will be used to login to Verge going forward.

I already have a Vox Media account!

Verify Vox Media account

Please login to your Vox Media account. This account will be linked to your previously existing Eater account.

Please choose a new Verge username and password

As part of the new Verge launch, prior MT authors will need to choose a new username and password.

Your username will be used to login to Verge going forward.

Forgot password?

We'll email you a reset link.

If you signed up using a 3rd party account like Facebook or Twitter, please login with it instead.

Forgot password?

Try another email?

Almost done,

By becoming a registered user, you are also agreeing to our Terms and confirming that you have read our Privacy Policy.



Choose an available username to complete sign up.

In order to provide our users with a better overall experience, we ask for more information from Facebook when using it to login so that we can learn more about our audience and provide you with the best possible experience. We do not store specific user data and the sharing of it is not required to login with Facebook.