Various online reports have mischaracterized and misquoted a Google legal brief in a class action case In re Google Inc. Gmail Litigation. The reports (which I won’t dignify with links) claim that Google said its Gmail users should have no privacy expectations.  These statements are misleading to the point of being journalistic malpractice.

Google never said that Gmail users have no expectation of privacy. To the contrary, Google’s brief cited its privacy policy and terms of service. Read the brief here: http://goo.gl/Bj895U  In those documents, Google expressly defines the privacy rights of users who sign up for the free Gmail electronic communication service (ECS). Gmail users can legitimately hold Google to those terms – but when Gmail users’ subjective privacy expectations differ from Google’s published terms, those expectations are not reasonable.

The case involves complaints both by holders of Gmail accounts and by persons who send email to Gmail accounts, but are not themselves Gmail account holders. Their complaint asserts  that Google cannot scan email for the purposes of targeted advertising – because that amounts to interception of the email. Irrationally, the plaintiffs don’t assert that Google cannot scan (so-called deep packet inspection) email to prevent malware, block spam, automatically sort content into folders, etc.

A central issue in the brief is the privacy expectations of non-Gmail users who send email to a Gmail addressee. The Gmail TOS and privacy policy don’t strictly apply those people, who never accepted those terms. But all email senders should be aware that ECS providers routinely scan incoming emails. These practices are widespread and easily discoverable by reading the well-publicized ECS TOS and privacy policies. These ECS providers are not intercepting emails – they are processing emails as part of the service they offer. These plaintiff senders voluntarily transmitted their email messages to Google with the full knowledge of Google’s role and these practices.

As to those senders, Google is a third party ECS provider. Google’s brief said “people who use web-based email today cannot be surprised if their communications are processed by the recipient’s ECS provider in the course of delivery. Indeed, ‘a person has no legitimate expectation of privacy in information he voluntarily turns over to third parties.’ Smith v. Maryland, 442 U.S. 735, 743-44 (1979).”  This is well settled law.