Google said they stopped reading your email in 2017. They didn't — they just changed what they read it for. Now their AI reads it too, enabled by default. The machine scanning your inbox got an upgrade, not a removal. Gmail encrypts your email in transit — then decrypts it on Google's servers where they can read everything. There is no end-to-end encryption for regular users. 'Confidential Mode' is a lie — Google can still read those emails too.
What they claim: Gmail requests only permissions needed for email functionality
What we found: Gmail Android requests 66 permissions including fine location, contacts, phone state, camera, audio, and boot-on-startup. Exodus reports zero trackers — because Gmail IS the tracker. All telemetry is first-party Google code, invisible to third-party analysis. The email app that reads your messages also knows your location, contacts, and starts running before you do.
What they claim: Google says it 'stopped scanning email content for advertising' in 2017
What we found: Gmail still scans every email for Smart Reply, Smart Compose, nudges, travel cards, package tracking, event extraction, and payment detection. In late 2025, Google enabled Gemini AI to read emails by default — requiring opt-out across two separate settings pages. Google stopped scanning for ads but never stopped scanning. The machine reading your email just got smarter.
What they claim: Google's privacy policy says they 'keep your data safe and secure'
What we found: Google is a confirmed PRISM participant since January 2009. NSA documents show 98% of PRISM production came from Yahoo, Google, and Microsoft. Google complied with 235,000+ government data requests in H1 2024. Under FISA Section 702, reauthorised April 2024 with expanded authority, the FBI can search Gmail content without a warrant. Google cannot tell you it happened.
What they claim: Gmail's free tier provides email to 1.8 billion users
What we found: Free Gmail shows ads in the Promotions and Social tabs. In September 2025, France's CNIL fined Google EUR 325M because these ads were designed to look like real emails — deceiving 53 million users. The free email service is funded by advertising designed to trick you into clicking ads disguised as messages.
What they claim: Gmail uses TLS encryption to 'protect your email in transit'
What we found: TLS encrypts email between servers but Google holds the keys and can read every email at rest. Gmail has NO end-to-end encryption for regular users. Confidential Mode is not E2EE — Google can still read it. Client-Side Encryption exists only for enterprise Workspace customers with organisation-controlled keys. 1.8 billion users have no way to send an email Google can't read.
What they claim: Gmail is presented as a secure email service that protects your data
What we found: In 2018, the Wall Street Journal revealed that third-party developers including Return Path and Edison Software had human employees reading Gmail users' emails. Google had granted these companies API access to scan inboxes. Google's response: this was covered by the developers' terms of service. Hundreds of companies had access to read private emails.
What they claim: Gmail's Terms of Service say Google needs a license to 'provide the services'
What we found: The license grants Google rights to 'host, reproduce, distribute, communicate, and use your content' including to 'modify and create derivative works.' Google's Gemini AI uses email content to generate Smart Replies, summaries, and suggestions — creating derivative works from your private communications. Your emails train Google's AI.