# WEB.DE privacy rating

Free, ad-supported email service from 1&1 Mail & Media in Germany, with webmail, mobile apps, calendar and cloud storage. Paid plans remove third-party ads and ad tracking.

## Summary

WEB.DE scores 38 out of 100 (grade F) on the email providers criteria. It meets 5 of 21 criteria: TLS configuration, open protocols, custom domains, IMAP support and POP3 support. It partly meets transparency report, security headers, modern web standards, end-to-end encryption, email security standards, SMTP submission and mail transport security. It does not meet open source, no trackers or telemetry, no ads or data sales, independent audit, tells users about requests, encrypted mailbox storage, sign up without personal data, Sender Rewriting Scheme and ARC sealing. It is based in Germany: Fourteen Eyes member; EU member (GDPR). Automated tests: SSL Labs grade A+, Mozilla HTTP Observatory grade B, Internet.nl website score 86% and Internet.nl email score 82%.

- Website: https://web.de
- Jurisdiction: Germany. Fourteen Eyes member. EU member (GDPR).
- Platforms: Web, Android, iOS
- Home page trackers: Criteo
- Category: [Email providers](https://privacyratings.com/email-providers/)
- Grade: F (38/100)

## Criteria

| Criterion | Answer | Note | Evidence |
| --- | --- | --- | --- |
| Open source | No | Closed source. |  |
| No trackers or telemetry | No | The home page loads a Criteo pixel, and the privacy policy describes usage analysis and personalized advertising based on consent. | https://agb-server.web.de/datenschutz |
| No ads or data sales | No | The free service is funded by advertising, including personalized ads. With consent, mail from commercial senders is analyzed to build an interest profile. | https://agb-server.web.de/datenschutz |
| Independent audit | No | No independent audit is published. |  |
| Transparency report | Partial | A yearly DSA transparency report, shared with GMX, counts only orders under the EU Digital Services Act. Other law enforcement requests are not counted. | https://web.de/impressum/ |
| Tells users about requests | No | No published policy on notifying users about data requests. |  |
| TLS configuration | Yes | Grade A+ | https://www.ssllabs.com/ssltest/analyze.html?d=web.de&hideResults=on |
| Security headers | Partial | Grade B (75/100+) | https://developer.mozilla.org/en-US/observatory/analyze?host=web.de |
| Modern web standards | Partial | Score 86% | https://batch.internet.nl/site/web.de/22660415/ |
| End-to-end encryption | Partial | OpenPGP encryption works through the Mailvelope browser extension and the WEB.DE apps, and is off by default. The help pages say new setup in webmail is not possible at the moment. | https://hilfe.web.de/sicherheit/pgp/einfuehrung.html |
| Encrypted mailbox storage | No | Encryption at rest for stored mail is not documented. |  |
| Open protocols | Yes | IMAP, POP3 and SMTP work with other apps once enabled in settings. | https://hilfe.web.de/pop-imap/index.html |
| Custom domains | Yes | Paid Domain & Mail plans add a custom domain with up to 500 addresses in the WEB.DE mailbox. | https://produkte.web.de/homepage-mail/persoenliche-domains/e-mail-adressen-anlegen/ |
| Sign up without personal data | No | Registration asks for name, date of birth and postal address, and requires a German or Swiss mobile number confirmed by SMS. | https://hilfe.web.de/account/logindaten/registrierung.html |
| Email security standards | Partial | Score 82% | https://batch.internet.nl/mail/web.de/22855367/ |
| IMAP support | Yes | imap.web.de:993 (implicit TLS). IMAP4rev1 advertised with IDLE. |  |
| POP3 support | Yes | pop3.web.de:995 (implicit TLS). CAPA: TOP, UIDL, USER, SASL, IMPLEMENTATION. |  |
| SMTP submission | Partial | smtp.web.de:465 (implicit TLS). Missing: SMTPUTF8, PIPELINING. |  |
| Mail transport security | Partial | Passes: SPF, DMARC quarantine, TLS-RPT, DNSSEC, DANE all. Missing: MTA-STS testing. |  |
| Sender Rewriting Scheme | No | No published documentation on SRS for forwarded mail. |  |
| ARC sealing | No | No published documentation on ARC signing or validation. |  |

Source: https://privacyratings.com/email-providers/web-de/
Edit: https://github.com/privacyratings/privacyratings.com/edit/main/ratings/email-providers/web-de.md