In testimony to the California Senate Judiciary Committee, EPIC West
Director Chris Jay Hoofnagle argued that Google's Gmail service presents
significant risks to personal privacy. Gmail is an advertising-supported
e-mail system that offers 1 gigabyte of storage. The Gmail system reads
the actual content of e-mail and attachments in order to target
advertising. While Google calls this process content "scanning," the
company's patents use the phrase "content extraction" to describe the
Gmail model.
Mr. Hoofnagle argued that Gmail users bargain away their own privacy,
but in doing so, also give away the privacy of non-subscribers. Those
who send e-mail to Gmail users also experience content extraction but
never receive notice or consent to the process.
Many information collection programs originally performed for commercial
purposes are now used for law enforcement or anti-terrorism purposes,
Mr. Hoofnagle said. In the 1990s, privacy advocates warned regulators
that direct marketers would turn over their information to the
government. Now we know that instead of turning it over, major direct
marketing companies, including Acxiom and Choicepoint, actively sell
personal information to the government. Similar risks exist with Gmail,
although Google did not address those risks in its testimony. Instead,
the company focused the debate on whether "personally identifiable
profiles" are created by content extraction. The company argues that
since there is no data retention from content extraction, there is no
risk to privacy. However, this argument ignores the risk that the Gmail
system could change, either by the company's own initiative, or by court
order sought by a law enforcement agency.
The ACLU of Northern California, also testifying at the hearing, argued
that content extraction may reduce Fourth Amendment expectations of
privacy. If a major online e-mail provider such as Google is allowed to
monitor private communications, even in an automated way, the
expectations of e-mail privacy may be eroded. These effects are
long-term and will undoubtedly outlive Gmail.
Google defends Gmail by stating that e-mail scanning is no different
than virus scanning or spam interdiction. While it is true that there is
no technical difference between these functions, there fundamental legal
difference. The law has long recognized that communications providers
should not peek into the contents of a message unless they have a valid
reason relating to the delivery of service. At the hearing, Google did
not address the legal difference.
EPIC Testimony on Gmail:
http://epic.org/privacy/gmail/casjud3.15.05.htmlEPIC Gmail FAQ:
http://epic.org/privacy/gmail/faq.html
