Gmail's New Privacy Restrictions Lead to Big Disruptions for Startups

Google's move to cut developers off from scanning people's Gmail for ad targeting might go unnoticed by most users - but it could upend a whole segment of apps, highlighting the outsized power and influence Google wields as a gatekeeper of data.

Last week, Google announced new privacy restrictions that included limiting how developers can use Gmail data. Google said in its updated policy that third-party apps could only collect information in ways that improve email functionality, such as drawing information from email receipts to help customers track trip itineraries or find discounts for online shopping. But companies can no longer use that same data to target ads or generate market research.

That could imperil the business models of some popular email extensions, like Unroll.me or Earny. Under the new rules, Unroll.me, which unsubscribes customers from emails, will no longer be able to share information it gleans from its customers' inboxes with a market research company it works with. Earny, an app that scans email shopping receipts for refunds on purchases, will be barred from sharing and selling its customers' data to an email marketing firm.

Google's clampdown will provide customers with more data security, experts say. But some policy experts and startup investors worry the pendulum may have swung too far, and the data restrictions could stifle innovation and actually result in more power for tech titans such as Google.

"In the process of locking down the data that you store with them, the big platforms would be locking in their control of that data and their unilateral ability to leverage it," said Kevin Bankston, director of New America's Open Technology Institute, a technology-focused arm of the think tank.

Google declined to comment. The company previously announced it would partner with Microsoft, Twitter and Facebook to create tools that would give customers the ability to transfer their data across different services.

Facebook, the other keeper of vast amounts of data on billions of people, has also adopted more stringent data restrictions in the wake of its Cambridge Analytica scandal. The company announced in April it would limit the data developers could collect from events and groups on the platform. Three years earlier, Facebook made major changes to its own developer tools amid privacy concerns that hampered academics, other businesses and political campaigns.

"We need to find the right balance, giving people control over data sharing and preventing abuse without hampering people's experiences or hindering innovation," Facebook Director of Product Management David Baser said in a recent blog post.

Google's tightening of its data sharing policies might appear politically savvy after the company received inquiries earlier this year from Senators John Thune, Roger Wicker and Jerry Moran on third party email app developers' use of Gmail data, according to a letter. The inquiries came after the Wall Street Journal reported on app developers' email scanning practices.

But the restrictions may only tighten Google's already immense grip on data about its users, which it uses to bolster its ad business that generates billions in revenue. The customer data is also crucial to its research and development efforts in fields like artificial intelligence.

Customers have enjoyed a wide range of free services for years in exchange for their data. But in exchange for the growth of many new technology services, they've often given up some of their privacy.

"The right balance requires policies that give users meaningful control and protection but that also foster competition and innovation," said Terrell McSweeny, a former federal trade commissioner.

Previously, the large technology companies encouraged developers to access data through their platforms. Google aimed for its popular email service Gmail to be a foundation that other developers can build upon, creating services that would keep customers engaged and returning to its service.

"You become the sun which all these planets revolve around," said Venky Ganesan, managing director of Uber-investor Menlo Ventures.

Investors funnelled checks into startups built on email, and large companies like SAP's Concur and Capital One acquired businesses that scanned email to assist with trip planning or track prices online. Many of the businesses were viable because they sold data they obtained from inboxes to support ad targeting or market research.

Google itself stopped reading customers' emails for advertising purposes in 2017, in a move that was seen to bolster its corporate email business. Google was not mining corporate email for advertising uses, but the company's data collection practices had hindered its ability to sell to corporations in the past.

Google's announcement this week that it would limit Gmail scanning was tucked into a revelation that it had discovered a bug that potentially exposed the personal data of hundreds of thousands of users of its unpopular social network, Google+, prompting the broader crackdown on data sharing.

Startup investors say the companies' restrictions are a significant shift for Silicon Valley, where for the past decade, many prominent companies like gaming company Zynga have relied on the larger platforms to jumpstart their growth and attract more users.

Unroll.me, the email extension, is "still in the information gathering stage" on Google's new policy, a spokeswoman said. Its scanning of Gmail drew criticism last year when The New York Times exposed Uber was using the service to glean data from Lyft customers' receipts. Transferring receipt data to marketing firms such as Slice Intelligence would be banned by Google's new policy. (The company said at the time it was "heartbroken" to learn its users were upset in an apology blog post that is no longer available.)

Earny shares data it collects with marketing firm Return Path, according to Earny's privacy policy. Earny declined to comment, and Return Path didn't respond to a request for comment.

"These companies that sell data just got blown up," said Streak Chief Executive Aleem Mawani, who makes an add-on for Gmail that helps businesses manage leads.

Streak generates revenue through business subscriptions and does not sell data, Mawani said. He said he hopes Google's new rules will provide more transparency around how email extensions work and make his service more trustworthy.

Even Gmail developers that don't rely on selling data could be impacted by Google's changes. In addition to new restrictions on how customer data can be used, Google will implement a more stringent app review process, which will include a security check that will cost between $15,000 and $75,000 or more. For smaller startups, the new security assessment fees could prevent them from ever launching, he said.

Mawani said Streak is profitable and can absorb the costs of the review, but the cost will likely be the same as several months of an engineer's salary. "That does hurt a little bit," Mawani said.

© The Washington Post 2018