• by Wendy Davis  @wendyndavis, July 6, 2018

Google has been hit with a new privacy lawsuit for allegedly allowing outside developers to access Gmail messages.

"Despite its representations to its users regarding the security and privacy of their Gmail messages, Google gave hundreds of third-party developers -- like marketing and data-mining firms -- privileged access to its users’ inboxes," Ohio residents James Coyne and Michael Coyne allege in a class-action complaint filed Thursday in U.S. District Court in San Jose, California. "Such access allowed the developers’ employees to surreptitiously read Gmail user emails."

The suit comes several days after The Wall Street Journal reported that Google allows outside developers, including Return Path and Edison Software, to access Gmail inboxes.

Return Path typically uses computers to scan emails of people who signed up for a free app in the company's partner network, according to the Journal. But two years ago, employees of Return Path read around 8,000 emails in their entirety, the Journal reports.

Google said in a blog post Wednesday that it vets developers before allowing them access to Gmail in-boxes, and only grants access if the developers "accurately represent themselves," and "only request relevant data."

The company adds that it doesn't allow outside apps to access data until users have been shown a  "permissions screen" that shows "the types of data the app can access and how it can use that data."

But the Coynes suggest in their complaint that Google's permissions screen doesn't sufficiently notify users that their emails might be read by outside app developers.

"Google never informed its users that it would give such access to developers, nor did users give such informed consent to allow developers to read their emails," the suit alleges. "Responding to user outcry about its latest violation of its own representations regarding privacy, Google points the finger at its own users, foisting responsibility on them for downloading apps that integrate with Gmail, and stating that, regardless, users should not be concerned because the developers have been 'vetted.'"

The complaint includes allegations that Google violated California state privacy laws, a state consumer protection law, and a state computer fraud law. The Coynes are seeking monetary damages and an injunction ordering Google to refrain from the alleged practices.

Google has not yet responded to MediaPost's request for comment.