# Yahoo Mail privacy rating

Free, ad-supported email service from Yahoo with webmail and mobile apps. A paid Yahoo Mail Plus plan removes ads.

## Summary

Yahoo Mail scores 30 out of 100 (grade F) on the email providers criteria. It meets 6 of 19 criteria: transparency report, tells users about requests, TLS configuration, open protocols, IMAP support and POP3 support. It partly meets SMTP submission. It does not meet open source, no trackers or telemetry, no ads or data sales, independent audit, security headers, end-to-end encryption, encrypted mailbox storage, custom domains, sign up without personal data, mail transport security, Sender Rewriting Scheme and ARC sealing. It is based in the United States: Five Eyes member; subject to the US CLOUD Act. Automated tests: SSL Labs grade A+ and Mozilla HTTP Observatory grade B-.

- Website: https://mail.yahoo.com
- Jurisdiction: United States. Five Eyes member. Subject to the US CLOUD Act.
- Home page trackers: Google Tag Manager
- Category: [Email providers](https://privacyratings.com/email-providers/)
- Also rated: [Yahoo Search](https://privacyratings.com/search-engines/yahoo-search/) (Search engines)
- Grade: F (30/100)

## Criteria

| Criterion | Answer | Note | Evidence |
| --- | --- | --- | --- |
| Open source | No | Closed source. |  |
| No trackers or telemetry | No | Yahoo Mail loads Yahoo analytics and a consent platform for advertising partners, and the privacy policy covers ad targeting across services. | https://legal.yahoo.com/us/en/yahoo/privacy/index.html |
| No ads or data sales | No | The free service shows ads. Yahoo Mail Plus removes them. | https://legal.yahoo.com/us/en/yahoo/privacy/index.html |
| Independent audit | No | No independent audit report is published. Yahoo states its controls are assessed by an external auditor, but no report is public. |  |
| Transparency report | Yes | Publishes counts of government data requests by country and how they were answered. | https://www.yahooinc.com/transparency/ |
| Tells users about requests | Yes | Yahoo notifies users about third-party requests for their information before disclosure, unless prohibited by law. | https://www.yahooinc.com/transparency/about/global-principles.html |
| TLS configuration | Yes | Grade A+ | https://www.ssllabs.com/ssltest/analyze.html?d=mail.yahoo.com&hideResults=on |
| Security headers | No | Grade B- (65/100+) | https://developer.mozilla.org/en-US/observatory/analyze?host=mail.yahoo.com |
| Modern web standards | Not tested yet | Not tested yet. |  |
| End-to-end encryption | No | Not supported. |  |
| Encrypted mailbox storage | No | Encryption at rest for stored mail is not documented. |  |
| Open protocols | Yes | IMAP, POP3 and SMTP work with other apps. | https://help.yahoo.com/kb/SLN4075.html |
| Custom domains | No | Not available for Yahoo Mail accounts. |  |
| Sign up without personal data | No | Sign-up requires a date of birth and a verified mobile number. | https://help.yahoo.com/kb/SLN2056.html |
| Email security standards | Not tested yet | Not tested yet. |  |
| IMAP support | Yes | imap.mail.yahoo.com:993 (implicit TLS). IMAP4rev1 advertised with IDLE. |  |
| POP3 support | Yes | pop.mail.yahoo.com:995 (implicit TLS). CAPA: IMPLEMENTATION, EXPIRE-NEVER, PIPELINING, RESP-CODES, TOP, UIDL, USER, SASL. |  |
| SMTP submission | Partial | smtp.mail.yahoo.com:465 (implicit TLS). Missing: SMTPUTF8. |  |
| Mail transport security | No | Passes: SPF, DMARC reject, TLS-RPT. Missing: MTA-STS testing, DNSSEC, DANE none. |  |
| Sender Rewriting Scheme | No | No published documentation on SRS for forwarded mail. |  |
| ARC sealing | No | No published documentation on ARC signing or validation. |  |

Source: https://privacyratings.com/email-providers/yahoo-mail/
Edit: https://github.com/privacyratings/privacyratings.com/edit/main/ratings/email-providers/yahoo-mail.md