AOL and Yahoo Scan User Emails Then Sell Data to Advertisers, Report Says Verizon-owned Oath is pitching a service to advertisers analyzing AOL and Yahoo emails to provide targeted ad data, according to The Wall Street Journal.

Always read the privacy policy. Back in April, when you were getting endless emails about updated privacy policies in the race to comply with GDPR, Verizon-owned Oath released a new unified privacy policy for AOL and Yahoo, which gave the email services the right to scan user emails for targeted advertising purposes.

Now several months later, a Wall Street Journal report finds that Oath has been pitching a service to advertisers that analyzes more than 200 million Yahoo Mail inboxes for data on which products a user might buy. The practice also extends to AOL mail, Oath said.

Doug Sharp, Oath's vice president of data, measurements and insights, told the Journal that the email scanning is an opt-on service that only applies to commercial emails in people's accounts, not personal mail. Yahoo also has a $3.49/month ad-free email service, which also scans emails, the paper says.

Oath and Verizon did not immediately respond to PCMag's request for comment.

The updated privacy policy states that AOL and Yahoo "analyze and store all communications content, including email content from incoming and outgoing mail," which allow the services to "deliver, personalize and develop relevant features, content, advertising and services." The policy also says the scanning can extend to instant messages, posts photos, attachments, receipts and other communications.

The Journal states that Yahoo has been employing these types of targeted ad data practices for more than a decade. In its current iteration, the process involves algorithms that scan for commercial emails, strip out any personally identifiable information (PII) about the user, and place a cookie on the device to aid in targeting advertisements to consumer preferences.

Even more pressing privacy concerns arise when automated errors and human employees are taken into account. Sharp told the Journal that Oath fixed a bug that mislabeled Indian wedding invitations as commercial emails. The privacy policy also states that all users may have "portions of some emails" reviewed by human employees, and Sharp said a small number of users have opted into letting humans read all of their emails in order to refine the scanning algorithms.

In an environment where increased scrutiny on data privacy has led email services such as Google's Gmail to stop email scanning and roll out better user privacy controls, Oath is doubling down on what the company sees as a lucrative revenue stream. The Journal says Oath representatives in marketing meetings acknowledged that many people use their Yahoo email addresses for unwanted commercial email, providing an advantage for advertising data.

When Verizon bought Yahoo, we noted that the hidden threat in the deal was in online advertising revenue. The email-scanning practices are core to the overarching strategy of the merger, giving Verizon an end-to-end pipeline from consumers to advertisers.

AOL and Yahoo users can control their privacy preferences and opt out of these services using Yahoo's Ad Interest Manager, or by managing their settings on Oath's Privacy Controls page.