Updated October 2026: This post has been expanded from its original December 2013 version with the full story of the court case, what was decided, and how Gmail's practices changed afterward. It is a historical account; Gmail's policies today differ from those described for 2013.
In the summer of 2013, a line buried in a legal brief turned into one of the biggest tech privacy stories of the year. Defending itself against a lawsuit over how Gmail scanned messages, Google argued that people who send email to a Gmail user should not reasonably expect that message to stay private from Google's automated systems. Privacy advocates called it a stunning admission. Google said it was simply describing how email works.
The argument came at a sensitive moment. Only weeks earlier, documents leaked by Edward Snowden had revealed the scale of government surveillance programs, and people were asking new questions about who could read their communications. This post walks through what Google actually argued, how the court responded, and how the fight shaped the way Gmail handles your messages today.
The lawsuit: scanning email to sell ads
When Gmail launched in 2004, its business model was unusual. The service was free and offered far more storage than competitors, and it paid for itself by showing ads next to your messages. Those ads were chosen by software that scanned the content of emails for keywords. Write to a friend about a trip to Hawaii, and you might see ads for flights and hotels.
By 2013, several lawsuits had been filed claiming that this scanning violated federal and state wiretapping and privacy laws. The cases were consolidated in federal court in San Jose, California, under U.S. District Judge Lucy Koh, as In re Google Inc. Gmail Litigation.
The plaintiffs fell into a few groups:
- Gmail users, who argued they had not meaningfully agreed to have their messages scanned for advertising.
- Students and staff at schools using Google's education services, where Gmail accounts were assigned by the institution.
- People who did not use Gmail at all but sent messages to Gmail users. They had never accepted Google's terms of service, yet their emails were scanned once they arrived in a Gmail inbox.
That last group was the heart of the controversy. A Gmail user could at least be said to have agreed to Google's terms. Someone writing from a different email provider had not.
What Gmail ad scanning looked like in practice
For most users in 2013, the scanning was visible only through the ads it produced. In the classic Gmail layout, a strip of text ads ran along the right side or top of an open message, chosen to match its contents. Mention a wedding, and you might see ads for photographers or venues. Mention a broken laptop, and repair shops or new computers would appear.
In May 2013, Google added another layer when it introduced inbox tabs. Messages were automatically sorted into Primary, Social, and Promotions, and Google soon began placing ads at the top of the Promotions tab, formatted to look much like ordinary emails. That sorting itself depended on automated analysis of every incoming message.
None of this was secret, and Google described ad targeting in its policies. But many users never connected the ads they saw to the idea that software was reading their personal messages. The lawsuit forced that connection into the open, and much of the public reaction in 2013 came from people realizing for the first time how the free service was paid for.
What Google argued
In a motion filed in June 2013 asking the court to dismiss the case, Google made several arguments:
- The scanning was automated. Google stressed that no human read the messages. Software processed them to show relevant ads, filter spam, and detect malware.
- Gmail users had consented. Google pointed to its terms of service and privacy policy, which users agreed to when they signed up.
- Senders had implicitly consented too. Google argued that anyone sending email understands it will be processed by the recipient's email provider in order to be delivered.
- Federal law bars the claim when one party consents. Under the Electronic Communications Privacy Act, an interception is not illegal if one party to the communication agrees to it.
The line that drew attention came in support of the sender argument. Google cited Smith v. Maryland, a 1979 Supreme Court case holding that people have no legitimate expectation of privacy in information they voluntarily hand to a third party. In that case, the information was the list of phone numbers a person dialed, which the phone company necessarily recorded. Google compared sending an email to sending a letter to a business colleague, who should expect that an assistant might open it.
Google also noted the scale involved: Gmail had more than 400 million users at the time and was funded by advertising.
The backlash
In August 2013, the nonprofit group Consumer Watchdog posted Google's court papers online and highlighted the expectation-of-privacy argument. Coverage spread quickly, from technology sites to NPR and international newspapers. The phrase most outlets repeated was the idea that Gmail users, and the people who email them, should not expect privacy.
Google pushed back on that framing. It said the brief was not a new position and was not about human access to email. The company pointed out that every email provider must process messages to deliver them, filter spam, and protect against viruses, and that showing ads was simply another form of automated processing.
Critics countered that there is a difference between processing a message to deliver it and analyzing its contents to build an advertising business. They also noted the timing: with the Snowden revelations still fresh, many people were rethinking how much access any company, not just governments, should have to private communications.
What the judge decided
- 2010-2013
Lawsuits claim Gmail ad scanning violates federal and state wiretap and privacy laws - June 2013
Google files a motion arguing senders have no reasonable expectation of privacy - August 2013
Consumer Watchdog publishes the filing and draws wide media attention - September 2013
Judge Lucy Koh refuses to dismiss most of the case - March 2014
Koh denies class certification, ending the bid for one giant class action - April 2014
Google rewrites its terms to spell out automated analysis of email - June 2017
Google says consumer Gmail will no longer be scanned for ad personalization
September 2013: the case moves forward
Judge Koh largely rejected Google's motion to dismiss. One of her key findings was that Google's terms of service and privacy policy did not clearly tell users that their emails would be scanned to build advertising profiles. Disclosures that were vague or scattered across documents, she concluded, did not amount to clear consent. She also rejected the argument that ad-targeting scans were simply part of the "ordinary course" of delivering email, which would have exempted them from the wiretapping law.
It was a significant early win for the plaintiffs. The case would proceed.
March 2014: no giant class action
The plaintiffs then asked the court to certify the case as a class action covering hundreds of millions of email users. They sought statutory damages that, applied across that many people, could have run into billions of dollars.
Judge Koh denied class certification. Her reasoning turned on consent. Whether any individual had agreed to the scanning, she found, depended on what that person knew, and people could have learned about Gmail's scanning from many sources: Google's own disclosures, news coverage, or public debate. Sorting out who knew what would require individual inquiries, which made a single class action unworkable.
The ruling meant users would have to bring claims individually or in small groups, which sharply reduced the financial threat to Google. Google said it was pleased the court agreed it had been upfront about Gmail's automated processing.
How Google changed Gmail
The court decisions did not order Google to stop scanning, but the pressure led to several changes over the following years:
- Clearer terms, 2014. In April 2014, Google updated its terms of service to state explicitly that its automated systems analyze content, including emails, to provide features such as tailored advertising, search results, and spam and malware detection. The change addressed the disclosure gap Judge Koh had identified.
- Schools first. Also in 2014, Google said it would stop scanning email in its education services for advertising purposes, responding to concerns about students' privacy.
- No more ad scanning, 2017. In June 2017, Diane Greene, then head of Google Cloud, announced that consumer Gmail content would no longer be used or scanned for ad personalization later that year. That brought free Gmail in line with Google's paid business email, which had never been scanned for ads.
The 2017 change ended the practice at the center of the lawsuits. It did not end automated processing altogether. Gmail still analyzes messages for spam and malware filtering, and for features such as categorizing your inbox, suggesting replies, and pulling travel or package details into other Google services.
Why the case still matters
The Gmail litigation is a useful lens on several questions that are still unsettled.
Consent buried in terms of service
Judge Koh's view that vague disclosures do not count as clear consent has echoed through later privacy debates. Regulators in the United States and Europe have increasingly pushed companies to explain data practices plainly rather than relying on long legal documents few people read.
The third-party problem
The Smith v. Maryland idea, that sharing information with a company reduces your privacy expectations, has been heavily criticized as a poor fit for a world where nearly everything flows through companies. In 2018, the Supreme Court limited its reach in Carpenter v. United States, ruling that police generally need a warrant to obtain historical cellphone location records. That case was about government access, not ad scanning, but it reflected the same shift in thinking.
Email was never designed to be private
Standard email works more like a postcard than a sealed letter. Messages pass through servers operated by the sender's provider, the recipient's provider, and sometimes others along the way. Encryption between servers has become much more common since 2013, but your provider can still read the message once it arrives, because it holds the keys.
Protecting your email privacy today
If the Gmail case makes you think more carefully about your own inbox, here are practical steps:
- Review Gmail's smart features. In Gmail settings, under the General tab, you can turn off "Smart features and personalization." This limits how your email content is used for features in Gmail and other Google products. Some conveniences, such as automatic inbox categories, will stop working.
- Check which apps can read your email. Visit your Google Account's security settings and review third-party apps with access to your Gmail. Remove anything you do not recognize or no longer use.
- Use end-to-end encryption for sensitive messages. Services such as Proton Mail, or encryption tools such as PGP, encrypt messages so that only the sender and recipient can read them. Both people generally need to use compatible tools.
- Move sensitive conversations elsewhere. For truly private conversations, an end-to-end encrypted messaging app such as Signal offers stronger protection than standard email.
- Assume email may be read. As a working rule, do not put anything in a standard email that you would be uncomfortable seeing exposed in a breach or a legal dispute.
The bottom line
Google's 2013 argument was legally narrow, but it touched a nerve because it said out loud what many people had not thought about: free email is paid for in part with the contents of your inbox. The courts did not shut down Gmail's scanning, yet the public pressure that followed pushed Google to explain its practices more clearly and, eventually, to stop scanning email for ads. The broader lesson holds up: understand what your email provider can see, and use stronger tools when privacy really matters.
Sources
- NPR, "Gmail Users Shouldn't Expect Privacy, Google Says In Filing" (August 2013)
- Consumer Watchdog statement and court filings
- PCWorld on Judge Koh's September 2013 ruling
- VOA on the March 2014 class certification ruling
- NPR via Spokane Public Radio on Google ending ad scanning (June 2017)
Top image: "Typing computer screen reflection" by Almonroth, CC BY-SA 3.0, via Wikimedia Commons (resized). Charts by Thank You Robot.
0 Comments