Feeds

Does Gmail's tarted-up tab makeover bust anti-spam laws?

'Advert looks like an email, walks like an email...'

SANS - Survey on application security programs

Anti-spam experts are openly wondering whether Google's redesigned web mail service Gmail violates US laws against bulk unsolicited messages.

The CAN-SPAM Act (passed in 2003) makes the mass distribution of commercial electronic mail legal as long as the messages are properly formatted, include correct contact information and give the recipient the option to unsubscribe.

In late May, Gmail introduced a revamped interface featuring five tabs - labelled Primary, Social, Promotions, Updates and Forums - into which messages are sorted. The Promotions folder holds offers from online businesses a person uses, such as Amazon or Hotels.com, and acts as a pigeonhole for legitimate marketing email that's separate from other messages. (Spam still disappears into a separate holding pen.)

Above these marketing emails, in the Promotions tab, Gmail places one or more adverts based on the contents of the inbox, which is par for the course with Google. But these advertisements are dressed up as email messages yet they don't allow users to unsubscribe from "receiving" them, sparking outcry from email marketing experts.

Jordan Cohen, veep of marketing for Movable Ink, and John Caldwell, writing for Deliverability.com, claim Google's new webmail interface is in "flagrant violation of the CAN-SPAM Act", in that it there's no sight of an opt-out button for the ads in most cases.

"Google insinuates that only legitimate promotional emails will be routed to the Gmail 'Promotions' tab, while unsolicited messages will be sent to a Spam Folder," the duo wrote. "These ads dressed as faux email messages attempt to trick people into thinking that these are legitimate messages."

"Google will claim that since the ads aren’t transmitted via the Simple Mail Transfer Protocol, they are not email," wrote Cohen and Gladwell, who describe this as a potential "technical loophole" in US anti-spam laws.

The Google-promoted advertisements look like emails and behave as such: they have a subject line, an apparent From address, and a user can even forward them to others, notes Martijn Grooten, Virus Bulletin's anti-spam test director.

"If it walks like email and quacks like email... then it is subject to the CAN-SPAM Act," Grooten argued on the Virus Bulletin blog.

"Indeed, most of the advertisements fail to provide unsubscribe links - and for those that do, it is not clear whether Google will honour the 'unsubscribe' option."

Grooten notes that while there may be some merit to the duo's claims, the email marketeers have a vested interest and may well be upset that the Google-brokered ads are appearing in a prominent place in Gmail users' mail folders, while a substantial percentage of their own messages are at the mercy of spam filters.

"Deliverability.com is aimed at email marketers, to whom it may seem that these new advertisements are taking a significant slice of their cake," Grooten concluded. "What's more, Google will have a point if it argues that these advertisements weren't delivered through email and aren't stored in an email format - and thus aren't subject to the CAN-SPAM Act."

Whether or nor the messages are ads or emails is far from clear.

"If these ads are indeed emails, they are generated on Google's servers itself, so there would be no reason to transfer them from one system to another," Grooten told El Reg. "So I don't think the 'it wasn't delivered via SMTP' argument is very strong. I think it will boil down to whether it is more important how the messages are stored (probably not as emails - though I'm guessing here) or how they are presented (as emails)."

More debate on the ad or email issue can be found on a blog post by Laura Atkins of anti-spam consultancy and software firm Word to the Wise here.

Google declined our invitation to comment on the issue. El Reg presumes the advertising giant's lawyers cleared the Gmail redesign and declared it compliant with US anti-spam laws. ®

3 Big data security analytics techniques

More from The Register

next story
Lavabit loses contempt of court appeal over protecting Snowden, customers
Judges rule complaints about government power are too little, too late
Don't let no-hire pact suit witnesses call Steve Jobs a bullyboy, plead Apple and Google
'Irrelevant' character evidence should be excluded – lawyers
Record labels sue Pandora over vintage song royalties
Companies want payout on recordings made before 1972
EFF: Feds plan to put 52 MILLION FACES into recognition database
System would identify faces as part of biometrics collection
Edward Snowden on his Putin TV appearance: 'Why all the criticism?'
Denies Q&A cameo was meant to slam US, big-up Russia
Ex-Tony Blair adviser is new top boss at UK spy-hive GCHQ
Robert Hannigan to replace Sir Iain Lobban in the autumn
Judge halts spread of zombie Nortel patents to Texas in Google trial
Epic Rockstar patent war to be waged in California
German space centre endures cyber attack
Chinese code retrieved but NSA hack not ruled out
APPLE FAILS to ditch class action suit over ebook PRICE-FIX fiasco
Do not pass go, do cough (up to) $840m in damages
Whoever you vote for, Google gets in
Report uncovers giant octopus squid of lobbying influence
prev story

Whitepapers

Mainstay ROI - Does application security pay?
In this whitepaper learn how you and your enterprise might benefit from better software security.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.