It is an open secret if you talk to any Google employee that Gmail data is heavily used to enrich other Google services, including ad placement, even if indirectly. They also can and will give it to authorities thanks to bulk keyword sharing agreements with or without individual warrants.

https://www.forbes.com/sites/thomasbrewster/2021/10/04/googl...

US citizens should take careful note of the fact their data is only usefully constitutionally protected if it is hosted at home.

Going to take that first part with a grain of salt since I feel like any "open secrets" at Google end up with many whistleblowers and feature articles

Google Workspace makes money from Gmail by charging business users for it. Gmail is the freemium version to make employees demand their employers buy Workspace over Office 365.

It's a similar model to GitHub.

That link doesn’t support your claim

It is a publicly known example of a blanket keyword search warrant. How is this not relevant? This sort of order could apply to any Google service.

Its literally in the Google Workspace terms of service they don't do this with workspace data.

Until they get a blanket keyword warrant or need more data to train their ad placement AI that they do not use -directly-.

> is there hard evidence of misuse of Gmail user data?

Yes, the Snowden leaks.

It doesn't matter whether Google themselves takes privacy seriously, they are a US company and therefor when handling personal information we must always assume that everything that is uploaded to their servers is sent straight to the NSA as well. Because that's what US law allows for.

I'm not even exaggerating, according to the latest rulings by EDPB, storing personal information on US servers is pretty much always forbidden unless you store it in encrypted form and control the encryption key.

Pretty sure all the big players are working around that by hosting European things in their European data centers. But maybe the US government can pressure them to give that information up too in which case it would mean US companies that have or use private data shouldnt be allowed to operate in Europe

The CLOUD ACT was passed explicitly because Microsoft argued that data hosted on European servers was out of reach of the US government.

Ah well in that case it seems that no American company with private data should be allowed to do business in Europe if we look at the recent laws in Europe and this American one?

It's more complicated than that, for now it looks like courts will decide on a service by service basis.

What does the CLOUD ACT do?

Just read the TOS of gmail. Looks like you are not aware what you allow them to do with your email.

Could you share the relevant part of the TOS here? Others may appreciate the education as well.

> We also collect the content you create, upload, or receive from others when using our services. This includes things like email you write and receive, photos and videos you save, docs and spreadsheets you create, and comments you make on YouTube videos.

It is not really a question of how much you trust Google.

The issue is that the US government is entitled access to all data hosted by US companies. This means data hosted by a US company is not safe according to GDPR.

Google has lost the PR war in Europe they are now a political punching bag there. Practically Gmail is probably one of the best choices for privacy with a good track record including attempted breach by China playing a role in their exiting the country. But in principle Google as an ad company will never be acceptable to those who want privacy to be more valued

You might be confusing privacy with security here

Privacy implies security as well

But just because an application is secure does not necessitate that it is respecting privacy laws

Exactly, which is the case for Google in general. Probably one of the most "secure" places to put your data, but from a privacy point of view self-hosting would be better, but then the security will be lower.