# Gmail privacy rating

Google's free email service. Mail is stored and processed on Google's servers, and Google Workspace offers it for business domains.

## Summary

Gmail scores 41 out of 100 (grade D) on the email providers criteria. It meets 7 of 19 criteria: transparency report, tells users about requests, security headers, open protocols, IMAP support, POP3 support and SMTP submission. It partly meets independent audit, TLS configuration, encrypted mailbox storage and custom domains. It does not meet open source, no trackers or telemetry, no ads or data sales, end-to-end encryption, sign up without personal data, mail transport security, Sender Rewriting Scheme and ARC sealing. It is based in the United States: Five Eyes member; subject to the US CLOUD Act. Automated tests: SSL Labs grade B and Mozilla HTTP Observatory grade A+.

- Website: https://mail.google.com
- Jurisdiction: United States. Five Eyes member. Subject to the US CLOUD Act.
- Home page trackers: none found
- Category: [Email providers](https://privacyratings.com/email-providers/)
- Also rated: [Gmail app](https://privacyratings.com/email-clients/gmail-app/) (Email clients), [Google Takeout](https://privacyratings.com/email-backup/google-takeout/) (Email backup tools), [Google Chrome](https://privacyratings.com/browsers/google-chrome/) (Browsers), [Google Search](https://privacyratings.com/search-engines/google-search/) (Search engines), [Google Authenticator](https://privacyratings.com/two-factor-authentication/google-authenticator/) (Two-factor authentication), [Google Messages](https://privacyratings.com/messengers/google-messages/) (Messengers), [Google Meet](https://privacyratings.com/video-calls/google-meet/) (Video calls), [Google Voice](https://privacyratings.com/virtual-phone-numbers/google-voice/) (Virtual phone numbers), [Google Public DNS](https://privacyratings.com/dns-resolvers/google-public-dns/) (DNS resolvers), [Google Cloud](https://privacyratings.com/server-hosting/google-cloud/) (Server hosting), [Chrome Remote Desktop](https://privacyratings.com/remote-desktop/chrome-remote-desktop/) (Remote desktop), [Google Keep](https://privacyratings.com/notes/google-keep/) (Notes), [Google Calendar](https://privacyratings.com/calendars/google-calendar/) (Calendars), [Google Docs](https://privacyratings.com/office-suites/google-docs/) (Office suites), [Google Forms](https://privacyratings.com/forms/google-forms/) (Forms and surveys), [Google Translate](https://privacyratings.com/translation/google-translate/) (Translation), [Google Gemini](https://privacyratings.com/ai-assistants/google-gemini/) (AI assistants), [Google Drive](https://privacyratings.com/cloud-storage/google-drive/) (Encrypted cloud storage), [Google Maps](https://privacyratings.com/maps/google-maps/) (Maps and navigation), [Google Analytics](https://privacyratings.com/web-analytics/google-analytics/) (Website analytics), [Google Home](https://privacyratings.com/smart-home/google-home/) (Smart home), [Google Nest Cam](https://privacyratings.com/security-cameras/google-nest-cam/) (Security cameras), [Fitbit](https://privacyratings.com/wearables/fitbit/) (Wearables and health), [Google Fit](https://privacyratings.com/fitness-trackers/google-fit/) (Fitness trackers), [Google Photos](https://privacyratings.com/photo-management/google-photos/) (Photo management)
- Grade: D (41/100)

## Criteria

| Criterion | Answer | Note | Evidence |
| --- | --- | --- | --- |
| Open source | No | Closed source. |  |
| No trackers or telemetry | No | Google collects activity data across its services and uses it for analytics and personalized ads. | https://policies.google.com/privacy |
| No ads or data sales | No | The free service shows ads. | https://policies.google.com/privacy |
| Independent audit | Partial | Google Workspace, which includes Gmail, has third-party SOC 2 audits. Only the SOC 3 summary report is public. | https://cloud.google.com/security/compliance/soc-3 |
| Transparency report | Yes | Publishes counts of government requests for user data and how often data is disclosed, updated twice a year. | https://transparencyreport.google.com/user-data/overview |
| Tells users about requests | Yes | Google emails the user before disclosing information unless legally prohibited or in emergencies. | https://policies.google.com/terms/information-requests |
| TLS configuration | Partial | Grade B | https://www.ssllabs.com/ssltest/analyze.html?d=mail.google.com&hideResults=on |
| Security headers | Yes | Grade A+ (110/100+) | https://developer.mozilla.org/en-US/observatory/analyze?host=mail.google.com |
| Modern web standards | Not tested yet | Not tested yet. |  |
| End-to-end encryption | No | Personal Gmail accounts have no end-to-end encryption. Client-side encryption and S/MIME are limited to some Google Workspace business plans. |  |
| Encrypted mailbox storage | Partial | Data is encrypted at rest with keys Google holds. | https://docs.cloud.google.com/docs/security/encryption/default-encryption |
| Open protocols | Yes | IMAP and SMTP work with other apps. | https://support.google.com/mail/answer/7126229 |
| Custom domains | Partial | Custom domains require a paid Google Workspace business plan. | https://workspace.google.com/pricing |
| Sign up without personal data | No | Sign-up requires a birthday and gender. Adding a phone number is optional in the documented flow. | https://support.google.com/accounts/answer/27441 |
| Email security standards | Not tested yet | Not tested yet. |  |
| IMAP support | Yes | imap.gmail.com:993 (implicit TLS). IMAP4rev1 advertised with IDLE. |  |
| POP3 support | Yes | pop.gmail.com:995 (implicit TLS). CAPA: USER, RESP-CODES, EXPIRE, LOGIN-DELAY, TOP, UIDL, X-GOOGLE-RICO, SASL. |  |
| SMTP submission | Yes | smtp.gmail.com:465 (implicit TLS). SMTPUTF8, 8BITMIME, PIPELINING and AUTH advertised. |  |
| Mail transport security | No | Passes: SPF, MTA-STS enforce, TLS-RPT. Missing: DMARC none, DNSSEC, DANE none. |  |
| Sender Rewriting Scheme | No | No published documentation on SRS for forwarded mail. |  |
| ARC sealing | No | Google's documentation explains ARC but does not state that Gmail validates or adds ARC seals. | https://knowledge.workspace.google.com/admin/security/arc-email-authentication |

Source: https://privacyratings.com/email-providers/gmail/
Edit: https://github.com/privacyratings/privacyratings.com/edit/main/ratings/email-providers/gmail.md