Don't expect Google to completely cut off marketing firms from your Gmail inbox.
The company has told a group of US senators that Gmail add-ons that scan your inbox can choose to hand over your data to someone else — but only if they're upfront about it.
"Developers may share data with third parties so long as they are transparent with the users about how they are using the data," Google VP Susan Molinari wrote to the Senate Commerce Committee in a July letter.
A year ago, Google ended its controversial email-scanning practice, which was used to serve up targeted ads. However, The Wall Street Journal reported this summer that hundreds of outside software developers can still search through your inbox via Gmail add-ons and mobile apps if you've agreed to install them.
These apps can help organize your inbox, offer shopping price comparisons and other email-related tools. But according to the Journal, the apps have also given their developers the ability to look through unredacted personal emails, which can be used for marketing or product-refinement purposes. In one instance, 8,000 emails were read by analysts at one app provider to help train the company's software.
The news prompted the Senate Commerce Committee to question Google about its email privacy practices and if any user data was at risk of exposure. "The reported lack of oversight from Google to ensure that Gmail data is properly safeguarded is cause for concern," the committee said at the time.
However, Google has told lawmakers that the company has protections in place to prevent potential abuse. "We continuously work to vet developers and their apps that integrate with Gmail before we allow them the ability to request access to user data," Molinari wrote in her letter, which was first reported on Thursday.
Her letter refrains from answering specifics over how app developers can share Gmail user data to third parties. But apps that need access to Gmail data must undergo a manual review from Google that'll involve examining the app's privacy policy and the data privileges it seeks to request, she said.
"Once they have been given access, we use machine learning (AI-powered software algorithms) to monitor those apps," Molinari added. "If we detect significant changes in the behavior of the app after it has been approved, we will once again manually review the app."
To educate users, Google will serve up warnings when a third-party app is installed that'll indicate what data it seeks to obtain from your Gmail inbox, and if the app has been verified. In the past, the company has suspended apps for failing to be transparent to users, violating its rules on spam, and requesting data permissions that were not relevant to the app.
Molinari also addressed whether Google employees ever peek into your inbox. "No humans at Google read users' Gmail, except in very specific cases where they ask us to and give consent, or where we need to for security purposes, such as investigating a bug or abuse," the company said.
Nevertheless, Google's defense assumes that people actually read all details in an app's privacy policy, when many of them can be long and hard to read. The whole issue is a reminder to be careful of what add-ons you install.
Google and other tech companies are set to face the Senate next week in a hearing over data privacy.