Data

How to secure Gmail and stop developers reading your messages

Google has been giving third-party developers access to your emails. Here's how to run a simple Gmail security checkup to regain your privacy

Google’s business is in data. The data it gathers from each time its products are used – from maps to search – allows it to personalise the adverts it sells. The more targeted an advert is, the more money can be made from it. But not all data.

In 2017 Google drew a line in the sand: emails are off limits. The firm announced after a decade of scanning and reading emails to help with personalisation it would stop the practice. User information should "remain confidential", Google said at the time.

There has been an exception to the rule. Companies that build handy add-ons for Gmail, which allow emails to be scheduled or calendar information to be extracted, have been able to read people's emails. As first reported by the Washington Post, the developers of hundreds of apps have been able to read people's emails, including entire messages, who they were sent to and other private details.

Human engineers from firms such as Return Path (an email marketing company) and Edison Software (the creators of an email app), the Wall Street Journal reported, have been able to read the emails of those that use their programs. This reading hasn't just been limited to machines but also includes humans who have had manual access. The third-party developers have used this access to improve their own software.

There's no suggestion that any companies have misused the data they've accessed (unlike in Facebook's Cambridge Analytical scandal). But, after the details emerged, Edison Software said it was going to stop reading emails altogether.

How To Email is broken. Here's how to realise your inbox zero dream

Google says that all apps are required to prompt users when they are installed if they want to access user data. Similarly, if an app wants to use a phone's camera it must ask for permission and the person using the device has to click 'allow' for this to happen.

In a blog post outlining its position on external developers having access to emails Google said it allowed users to "have options around how you access and use your email". Suzanne Frey, a director of security, trust and privacy, said Google vetted all apps that wanted to get inside customer inboxes.

"Before a published, non-Google app can access your Gmail messages, it goes through a multi-step review process that includes automated and manual review of the developer, assessment of the app’s privacy policy and homepage to ensure it is a legitimate app, and in-app testing to ensure the app works as it says it does," Frey wrote.

It's likely a large majority of people who have given third-party developers access to their emails did so without properly reading warnings about access. Thankfully, there are ways to check which apps you have granted permission to on Gmail and checkup your other security settings.

How to run a checkup on your Gmail's security

The first place to visit when locking down your Gmail account – and everything else you use Google for – is on the security settings dashboard. This explains how your account could be more secure and shows when new devices have logged in. You can also review app passwords and turn on two-factor authentication. And yes, you should turn it on.

There is a separate screen to see how many third-party apps have access to your Google account: this includes Gmail, Google Docs, contacts, payments, and other services from Google. The third-party apps with account access lets you see how long a service has had access to your Google account, what the permissions you gave it were (read, send, delete emails etc) and the option to remove access. However, as a word of warning, if you remove access to third-party developers it's highly likely that some of the services you've been using won't work in the same way, if at all.