Author's Note: see the Addendum at the bottom of this article for a discussion of the October 14 Google Gmail Privacy Notice.

 

Introduction

I recently sought out and accepted an invitation to use Gmail. Gmail is Google's free advertising-supported email service, still in beta testing.

Based on a few experiments, it looks like a good service. It offers massive storage and, if you don't mind being served targeted (and tastefully formatted) ads that reflect the contents of the emails streaming through the system, you may also like that feature as well.

 

But I have some questions about where Gmail is heading that I'd like to think about some more. 

The Advertisements

As a matter of fact, I don't mind the ads. This is a free service, I figure the price is reasonable as long as the ads are meaningful, not offensive, and don't flash, wiggle, or make noise. (I use Google's search service and have never been annoyed by the ads.)

As a test of the Gmail ad service, I sent this email to myself using Gmail:

• I am composing a blog entry about Google's Gmail service, with specific reference to the privacy of what happens to emails even after they are deleted by the user.

It came back to my Gmail inbox immediately with three text ads prominently displayed on the right hand of the screen, all for blogging related products or services.

Clicking on “more sponsored links” displayed another page of blogging related text only ads. Nothing displayed about privacy, though, even though I know that tools and procedures for managing privacy and digital ownership rights are hot topics in I.T. circles these days.

I sent myself a picture taken of me and my wife at the Nationals versus Mets game in Washington DC and it came back to me accompanied by baseball related ads. Seems reasonable.

Policy and Privacy Questions

Still, I have not yet “dived in” to using Gmail, basically because I don't know how my email and communication patterns will be used down the road, and the Gmail Privacy Policy, Gmail Terms of Use, and Gmail Program Policies do not spell out what Google's plans for the future are.

Here is a point extracted from the pre-October 14, 2005) Gmail Privacy Policy:

• Because we keep back-up copies of data for the purposes of recovery from errors or system failure, residual copies of email may remain on our systems for some time, even after you have deleted messages from your mailbox or after the termination of your account.

According to the first bulleted item above, copies may be kept for an unspecified time. Google does not specifiy what it means by “...for some time.” (See Addendum 18 October 2005 below)

This is also included in the Gmail Privacy Policy:

• We also may collect information about the use of your account, such as how much storage you are using, how often you log in and other information related to your registration and use of Gmail. Information displayed or clicked on in your Gmail account (including UI elements, ads, links, and other information) is also recorded. We use this information internally to deliver the best possible service to you, such as improving the Gmail user interface, preventing fraud within our advertising system, and better targeting related information.

OK, so they plan to keep track and analyze how I use the system in order to do a better job of delivering ads and services. That's to be expected. But again, no specifics are provided on how this relates back to the content of my emails or how long that content will be retained.

The Gmail Terms of Use point out a series of things you're not supposed to use Gmail for (posting obscenities, doing illegal stuff, spamming, unauthorized use of intellectual property, etc.) and spells out what Google can do to enforce the terms:

• Google also reserves the right to access, read, preserve, and disclose any information as it reasonably believes is necessary to (a) satisfy any applicable law, regulation, legal process or governmental request, (b) enforce this Agreement, including investigation of potential violations hereof, (c) detect, prevent, or otherwise address fraud, security or technical issues (including, without limitation, the filtering of spam), (d) respond to user support requests, or (e) protect the rights, property or safety of Google, its users and the public.

How they become aware of such activities is not clear. I assume that they have monitoring programs they run to check for certain words, word combinations, and images, just as they use automated programs to check for what ads to display. (I don't know this for a fact, I'm just inferring this from what I read here).

Again, it's a free service, advertiser supported, so I don't think it's reasonable to expect them NOT to take advantage of the fact that they are not the U.S. Mail with its prohibition against steaming open sealed envelopes and selling the contents. After all, Google doesn't want to get sued for doing something like facilitating massive transmission of copyrighted works for which they have not obtained explicit permission to distribute.

Speaking of intellectual property, the Gmail Terms of Use distinguish between “The Service” and the actual content of the mail that flows through The Service:

• Intellectual Property Rights. Google's Intellectual Property Rights. You acknowledge that Google owns all right, title and interest in and to the Service, including without limitation all intellectual property rights (the "Google Rights"), and such Google Rights are protected by U.S. and international intellectual property laws. Accordingly, you agree that you will not copy, reproduce, alter, modify, or create derivative works from the Service. You also agree that you will not use any robot, spider, other automated device, or manual process to monitor or copy any content from the Service. The Google Rights include rights to (i) the Service developed and provided by Google; and (ii) all software associated with the Service. The Google Rights do not include third-party content used as part of Service, including the content of communications appearing on the Service.

• Your Intellectual Property Rights. Google does not claim any ownership in any of the content, including any text, data, information, images, photographs, music, sound, video, or other material, that you upload, transmit or store in your Gmail account. We will not use any of your content for any purpose except to provide you with the Service.

How about that phrase “Google Rights.” Neat, huh?

Left unsaid is whether Google intends to create derivative works or programs based on indexing and analysis of the content of the emails flowing through the system. Also not stated is how the creator of the original emails would share in any commercial value that may be based, at least partially, on the email content and/or data describing the clicking behavior of the user. Just as Google analyzes emails and applies rules to decide which ads to display, is it too remote to expect that such rules could also take into account the user's communication patterns or use of other Google resources (such as Froogle usage?) Again, this is speculation on my part, but I am attempting to think creatively here.

Gmail Program Policies is a grab bag of “prohibited actions” -- no re-selling of the service, no impersonations, no pyramid schemes, etc. In summary, nothing harmful or illegal. My basic reaction is: Google's business is providing a voluntary, free service, and if you want to use it, you have to agree to play by their rules. Sounds like That's Life in the Big City to me.

Incidentally, there are a couple of items in the Prohibited Actions list that caught my attention which don't appear to relate directly to harmful or illegal activities::

• Interfere with other Gmail users' enjoyment of the Service

• Reformat or frame any portion of the web pages that are part of the Gmail Service

What if I “unknowingly” interfere with someone “enjoyment” of the “service?” And what if I use a desktop utility or browser add-on that allows me to rearrange or modify page components to make them load faster or look better? And especially, what if I figured out a way to NOT display the ads?

Summary and Preliminary Conclusions

I believe Google when its says it will attempt to protect my privacy and not resell my personal information. It would be suicide for Google to behave otherwise.

I also believe that Google would eventually reveal my personal information when ordered to do so by the Federal Government; if you can't trust major news organizations to not turn over their reporters' notes to the Feds, I don't think you can assume any information maintained by Google can be protected either. That fault is not unique to Google however and raises issues that are outside the scope of this review. So I don't think that on the matter of privacy alone I would be reluctant to use Google's Gmail service.

 

I am concerned, however, with what is left unsaid by Google concerning email retention and how it may develop new products or services that take advantage of the content of my emails and/or my behaviors surrounding that content.

I also don't know what Google intends to do with data it collects related to my use of other services it owns, and whether or not that will be tied back to what I do or transmit (or receive) via Gmail.

Part of this concern comes from the researcher in me as I contemplate the body of data that can be collected over time related to communications behavior. For example, think of the tracking analysis possibilities concerning, say, a college student who is getting ready to graduate from college who will be making --- and communicating about -- significant lifestyle, purchasing, health care, insurance, and travel decisions. Imagine being able to analyze the content of emails, source and targets of links embedded in the email, and the mention of words and company names. Think of the commercial value this database would have when extended to include millions of young people, who can now be tracked over many years. The commercial value of such a database would be awesome!

I think I'll check Google's stock price.

But I'm going to hold off using Gmail just yet. I want to think about this some more.

 

Addendum 18 October 2005

 

Google updated its privacy policy on October 14, 2005. Here is what the Gmail Privacy Notice now says under the heading "Your Choices:"

You may organize or delete your messages through your Gmail account or terminate your account through the Google Account section of Gmail settings. Such deletions or terminations will take immediate effect in your account view. Residual copies of deleted messages and accounts may take up to 60 days to be deleted from our active servers and may remain in our offline backup systems.

Noticeably absent from this is any definitive statemet of when all traces of your emails are totally erased from the system or what uses might be made of the email contents stored on the "offline backup systems."