Why your email provider is reading your mail — and what you can do about it

Free email isn't free — it's paid for with access to your inbox. Here's what the major providers actually do with your messages, what changed in recent years, and what genuinely fixes it.

The business model behind free email

Running email at scale costs real money — storage, spam filtering, deliverability infrastructure, support. If you're not paying, that cost is recovered another way. For the largest providers, the recovery mechanism is knowing things about you.

What Gmail actually does today

Credit where it's due: Google stopped scanning consumer Gmail content for ad personalisation in 2017. Critics often skip this, and it was a genuine improvement.

What still happens:

• Content is processed for spam filtering, search indexing, Smart Compose and Smart Reply — all features users benefit from, all requiring readable content.
• Purchase, travel and event data is extracted from your mail to populate other Google products.
• Your activity — who you correspond with, what services email you, how you use the product — feeds the account-level profile that shapes advertising elsewhere.

So the accurate statement isn't "Google reads your mail to serve ads in Gmail." It's that your mail is readable, processed for multiple purposes, and part of a broader profile.

Microsoft and Outlook.com

Microsoft processes content for spam filtering, security and product features, and uses "diagnostic data" and service data to improve products, including AI systems. Enterprise Microsoft 365 tenants have considerably stronger contractual protections than free Outlook.com accounts — the tier matters a great deal here.

Why this is structural, not villainous

None of this requires bad intent. If a provider's revenue depends on knowing about users, product decisions will lean that way over time. If revenue comes from subscriptions, the same pressure runs the other direction. Incentives outlast policies — which is why the business model is more predictive than any privacy statement.

What actually fixes it

1. Pay for email. Simple and effective. A provider paid by subscription has no reason to mine your inbox.

2. Use encryption at rest with a provider who doesn't profile you. Your mail is protected on disk and isn't feeding an advertising pipeline. Tobava Mail encrypts received message bodies with AES-256-GCM and runs no ad network. Spam and virus filtering still has to read mail — that's true of every provider, and any claim otherwise is marketing.

3. Use end-to-end encryption for what matters. With PGP, the provider holds ciphertext only. See what end-to-end encryption really protects.

4. Split by sensitivity. Keep a free account for newsletters, shopping and signups. Move client work, financial and confidential correspondence to a private provider. This is often the most practical option — it concentrates protection where it matters without a total migration.

The part nobody mentions

Your correspondents' choices affect you too. If you email a Gmail user, that copy sits in Gmail under Google's terms, regardless of your provider. End-to-end encryption is the only thing that changes this — and it requires both parties.

That isn't a reason to give up. It's a reason to be realistic: switching providers materially improves *your* stored mail and removes *you* from a profiling pipeline. It doesn't unilaterally secure every conversation you're part of.

Questions worth asking your provider

• Is message content used for advertising or model training?
• What's encrypted at rest, and who holds the keys?
• Which subprocessors can access content?
• Can I export everything and leave?

If the answers are hard to find, that's an answer. Ours: no advertising, no profiling, no content scanning for marketing or model training, AES-256-GCM on received message bodies at rest, and full IMAP access so you can always take your mail elsewhere. We're funded by subscriptions, which is why we can say that. What we don't claim: end-to-end encryption, or that filtering never reads your mail.