Yahoo, bucking industry, scans emails for data to sell for ads
Firm analyzes more than 200 million inboxes, a practice many have declared off-limits
The U.S. tech industry has largely declared it is off limits to scan emails for information to sell to advertisers. Yahoo still sees the practice as a potential gold mine.
Yahoo’s owner, the Oath unit of Verizon Communications Inc., has been pitching a service to advertisers that analyzes more than 200 million Yahoo Mail inboxes and the rich user data they contain, searching for clues about what products those users might buy, said people who have attended Oath’s presentations as well as current and former employees of the company.
Oath said the practice extends to AOL Mail, which it also owns. Together, they constitute the only major U.S. email provider that scans user inboxes for marketing purposes.
The strategy bucks a recent Silicon Valley trend toward more data privacy and shows an industry divided on where to draw the line between user protections and technologies that many advertisers crave.
Alphabet Inc.’s Google, the most popular email provider, with 1.4 billion users, said it stopped scanning messages in Gmail for ad targeting last year, citing user privacy. Microsoft Corp., the former email leader, said it has never used email data for advertising.
Yahoo’s practice began more than a decade ago and expanded over the years, said a person familiar with the matter. The company has increasingly looked for new ways to wring revenue out of its aging portfolio of web properties, which have stagnated in the era of smartphones and social networking.
When Verizon created Oath last year, it envisioned the new unit as a future advertising rival to Google and Facebook Inc. for its potential to marry data on Verizon’s vast pool of wireless subscribers with Yahoo’s highly trafficked online hubs, Verizon executives have said.
Oath owns dozens of popular websites, such as HuffPost and Yahoo Finance. It helps advertisers show messages on these sites as well as across the web, using a variety of ad-placement services.
Email scanning has become one of the company’s most effective methods for improving ad targeting, said Doug Sharp, Oath’s vice president of data, measurements and insights. He said that the practice applies only to commercial emails in people’s accounts—from retailers, say, or mass mailings—and that users have the ability to opt out.
Mr. Sharp said being served ads is part of the trade-off users make in exchange for free online services, and that Yahoo’s research shows they prefer ads that are relevant to them.
“Email is an expensive system,” Mr. Sharp said. “I think it’s reasonable and ethical to expect the value exchange, if you’ve got this mail service and there is advertising going on.”
He said Yahoo offers an ad-free email service for which customers pay $3.49 a month. It also scans the emails sent in that service. Yahoo provides an optout option to users of both the free and paid services.
Yahoo’s algorithms look for commercial emails and identifies them using a database of commonly sent emails. The algorithms link certain types of emails to certain consumer preferences, and then places a “cookie,” a piece of tracking code, on that user’s computer to help advertisers show them messages in the future.
Oath promises to give advertisers an edge by identifying groups of users who have bought certain products or services based on the receipts, travel itineraries and promotions in their inboxes, said Mr. Sharp. For example, he said, Yahoo’s system labels people who receive trade confirmations from online brokerage accounts as “investors” who can be targeted for finance-related advertisements. Privacy questions Oath is testing the boundaries of what users may be comfortable sharing. Unlike with web-browsing habits and search histories, many users expect a greater degree of privacy when it comes to personal-communication tools such as email, said Lauren Gelman, an online-privacy lawyer and former executive director of Stanford Law School’s Center for Internet and Society.
Google previously sold ads related to keywords in email messages. It used the information in personal and commercial email messages to show users relevant ads while they were looking at Gmail—not to target any users elsewhere on the web—a Google spokeswoman said.
The practice excluded paid users of Gmail, she said. Google and Oath said they prevented advertisers from targeting users based on certain sensitive categories of email, such as health conditions.
Google said it stopped targeting ads based on Gmail data last year, saying it wanted users to “remain confident that Google will keep privacy and security paramount.”
Google already collects so much data from its search engine that it no longer needed to rely on email data, said Andreas Reiffen, chief executive of digital-ad consultant Crealytics GmbH.
Oath’s email scanning appears to go a step further than Google’s former system, by creating interest profiles of users based on the data in their email and using that intelligence to target them elsewhere on the web. Oath groups similar users together as an “audience” to which marketers can target ads, Mr. Sharp said.
Yahoo Mail users who receive frequent emails about driving for Lyft Inc. are sometimes placed into a “self-employed” audience, Mr. Sharp said. Some people who bought several plane tickets in the past year are labeled frequent travelers. A spokeswoman for Lyft declined to comment.
The cookies Oath places on users’ computers allow it to identify which audience they are part of and show them ads without ever providing any personally identifiable information to marketers, Mr. Sharp said.
Oath’s systems are designed to ignore personal messages and look for only commercial emails, which make up the vast majority of the messages that arrive in Yahoo Mail inboxes, Mr. Sharp said. Its algorithms strip out all personal information, such as names and email addresses.
At one point, Oath’s computers mistakenly labeled invitations to Indian weddings—which traditionally are sizable, multiday gatherings—as commercial emails, “because they end up as mass-mailed forms” to so many people, Mr. Sharp said. The company fixed that problem by looking for phrases common to wedding invitations and discarding any results.
In its privacy policy, Oath says all Yahoo Mail users may have portions of some emails reviewed by human employees. Oath employees may manually review sections of mass-mailed commercial emails that appear to be “boilerplate,” or the same for many users, the policy says.
A small number of users have explicitly opted in to letting human beings read all of their emails as a way to refine the algorithms and make sure no personal emails are being mislabeled, Mr. Sharp said. This is how the company discovered the Indian wedding problem, he said. Scanned receipts Oath uses receipts in Yahoo Mail inboxes as proof that an ad campaign convinced a user to buy a product, a person with the matter said.
Yahoo has scanned email for years and included language in its privacy policy saying the company can scan and analyze all email messages. Over time, it added some detail to that disclosure, including an explanation of how it looks for massmailed commercial emails.
But Yahoo executives haven’t widely discussed the email-data collection, and many people never read the fine print. Some Yahoo Mail users only became aware of this practice when Oath emailed them in April with an update to its terms of service.
In one message prompting users to respond, Yahoo gave two options: “I Accept,” or “I’ll do this later.” Users can opt out of all Yahoo ad personalization by visiting its “ad interest manager” page and clicking a button.
The new privacy policy is “telling me all of my stuff is basically going to be rifled through and used however they want to use it,” said Lisa Bell Roden, 53, who lives in Ashburn, Va., and relies on the email service for her work with small businesses and entrepreneurs on media production. “That, to me, is rather offputting,” she said, although she has no plans to close the Yahoo account.
The U.S. Federal Trade Commission requires companies to clearly disclose how they collect personal data in privacy policies. The EU’s new data-protection rules require companies to obtain users’ express consent for all data collection before they begin using a product or service.
Mr. Sharp said the company changed its terms of service this year to comply with the European regulations. “It’s an odd thing, consent,” he said, “because I think the people who care about it are aware of it, and that’s as it should be.”
Yahoo paid $4 million in 2016 to settle a federal class-action lawsuit that claimed its scanning of email violated federal wiretap laws. Yahoo, which didn’t admit wrongdoing, agreed as part of the settlement terms to make a technical change: Rather than scanning emails while they are “in transit,” Yahoo now waits until they arrive in an inbox to scan them.
Oath’s new privacy policy prevents users from filing classaction suits and instead requires them to pursue their grievances through arbitration or smallclaims court.
Initially, Yahoo mined users’ emails in part to discover products they bought through receipts from e-commerce companies such as Amazon.com Inc., people familiar with the practice said. Yahoo salespeople told potential advertisers that about one-third of Yahoo Mail users were active Amazon customers, one of the people said. In 2015, Amazon stopped including full itemized receipts in the emails it sends customers, partly because the company didn’t want Yahoo and others gathering that data for their own use, someone familiar with the matter said.
Yahoo Mail, an email pioneer, struggled as users defected to Gmail. When Marissa Mayer, a former Google executive, joined Yahoo as CEO in 2012, she made email central to her strategy. Yahoo’s reputation took a hit in 2016, when it said a data breach compromised many users’ privacy. Ms. Mayer, who left Yahoo after Verizon bought it, didn’t respond to requests for comment.
Verizon created Oath following its Yahoo and AOL acquisitions, putting former AOL head Tim Armstrong in charge. Oath didn’t make Mr. Armstrong available for comment.
In meetings with marketers, Oath representatives have acknowledged that many people use Yahoo Mail as their primary service for unwanted commercial email, one of the people who heard the pitch said. They indicated this is an advantage for advertisers who want to collect as much commercial data on users as possible, the person said.
Some Oath advertisers said the pool of potential Yahoo Mail users is too small to send highly targeted ads. Even out of tens of millions of users, only a small portion are likely to have bought specific items, one advertiser said.
Others have raised questions about user privacy under Oath’s system. “I think the challenge of it,” said Rob Griffin, chief technology officer of digital-ad consultancy Tovo Labs, “is, how do you monetize it without the icky factor?”