Private emails sent and received by Gmail users are sometimes read by third-party developers, Google admitted, despite promises to stop the practice.
Users whose accounts are linked to third-party apps may have unwittingly given developers access to their emails, a report by the Wall Street Journal published Monday said.
Allowing third-parties to access user data has become "common practice" among companies like Google, one veteran tech executive told WSJ.
"Some people might consider that to be a dirty secret. It's kind of reality," said former chief technology officer of eDataSource Inc. Thede Loder.
Google says the practice is covered in its user agreement and that the Alphabet company abides by strict guidelines for user data sharing. It said the practice requires "explicit opt-in consent from that user."
Google allows its users to connect their accounts to external services such as price comparisons and travel planning.
When linking an account to a third party, users are asked to certain access permissions, often including access to read, send, manage or even delete emails.
Gmail is a prime data source for app developers and marketers, as it contains a wide range of consumer information ranging from travel itineraries to shopping histories.
With 1.4 billion users that make up nearly two-thirds of all active email users worldwide, Gmail is the world's top email service.
Critics and security experts have said that while the policy may be covered in the user agreement, it's still not a "reasonable" stipulation that third parties can access a user's private data.
"You can spend weeks of your life reading terms and conditions," University of Surrey professor Alan Woodward told the BBC.
"It might well be mentioned in there, but it's not what you would think of as reasonable, for a human being in a third-party company to be able to read your emails."
Google said last year its computers would no longer scan Gmail inboxes for info to personalize ads, so that users could "remain confident that Google will keep privacy and security paramount."
Google has faced a series of complaints over its privacy policies and advertising revenue since it launched Gmail in 2004.
