A federal judge today found that Google may have breached federal and California wiretapping laws for machine-scanning Gmail messages as part of its business model to create user profiles and provide targeted advertising.

The decision by U.S. District Judge Lucy Koh was rendered in a proposed class-action alleging Google wiretaps Gmail as part of its business model. Google sought to have the federal case in California dismissed under a section of the Wiretap Act that authorizes email providers to intercept messages if the interception facilitated the message’s delivery or was incidental to the functioning of the service in general.

“Accordingly, the statutory scheme suggests that Congress did not intend to allow electronic communication service providers unlimited leeway to engage in any interception that would benefit their business models, as Google contends. In fact, this statutory provision would be superfluous if the ordinary course of business exception were as broad as Google suggests,” Judge Koh wrote.

Gmail, including its business service called Google Apps, is the world’s biggest email service, with some 450 million users globally.

The decision is also a blow to Yahoo, whose free email platform with more than 300 million users also scans email to deliver ads. Microsoft’s rebranded free Outlook webmail offering does not scan messages of its 400 million users.

It was the second time this month that a federal court has found Google potentially liable for wiretapping.

Just yesterday, Google asked a federal appeals court to reconsider a recent ruling finding Google potentially on the hook for wiretapping when it secretly intercepted data on open Wi-Fi routers.

The Mountain View-based company said the September 10 decision by the 9th U.S. Circuit Court of Appeals will create “confusion” about which over-the-air signals are protected by the Wiretap Act, including broadcast television.

That case concerns nearly a dozen combined lawsuits seeking damages from Google for eavesdropping on open Wi-Fi networks from its Street View mapping cars. The vehicles, which rolled through neighborhoods around the world, were equipped with Wi-Fi–sniffing hardware to record the names and MAC addresses of routers to improve Google location-specific services. But the cars also gathered snippets of content.

The search giant yesterday petitioned the San Francisco-based appeals court to reconsider its decision that allowed the case to proceed at trial — a ruling that upended Google’s defense.

Like the appeals court ruling, Judge Koh’s decision guts Google’s wiretapping defense in the Gmail case.

No trial date has been set.

“The ruling means federal and state wiretap laws apply to the internet. It’s a tremendous victory for online privacy. Companies like Google can’t simply do whatever they want with our data and emails,” said Jon Simpson, the privacy director for Consumer Watchdog of Santa Monica, California.

Google said in a statement that it was “disappointed” with the ruling and was considering its legal options. “Automated scanning lets us provide Gmail users with security and spam protection, as well as great features like Priority inbox,” the company said.

Google is not automatically eligible to appeal the ruling to the 9th U.S. Circuit Court of Appeals. It must ask Koh to grant permission in what is known as an interlocutory appeal. Because of the important legal issue, Koh is likely to grant an appeal rather than having a trial first.

Google maintained that Gmail users have consented to the scanning because of its end-user agreement.

Judge Koh, however, said the agreement did not adequately spell out to consumers that Google was reading messages. What’s more, Koh outright rejected Google’s contention that non Gmail users consented to the scanning of their messages when their communications interact with Gmail’s platform.

According to Koh:

Google further contends that because of the way that email operates, even non-Gmail users knew that their emails would be intercepted, and accordingly that non-Gmail users impliedly consented to the interception. Therefore, Google argues that in all communications, both parties — regardless of whether they are Gmail users — have consented to the reading of emails. The Court rejects Google’s contentions with respect to both explicit and implied consent. Rather, the Court finds that it cannot conclude that any party — Gmail users or non-Gmail users — has consented to Google’s reading of email for the purposes of creating user profiles or providing targeted advertising. Google points to its Terms of Service and Privacy Policies, to which all Gmail and Google Apps users agreed, to contend that these users explicitly consented to the interceptions at issue. The Court finds, however, that those policies did not explicitly notify Plaintiffs that Google would intercept users’ emails for the purposes of creating user profiles or providing targeted advertising.

Source: Wired