Employees of third-party app developers are reading Gmail users’ private messages, reported the Wall Street Journal on Monday. Outside app developers create services that function with Gmail to give users personalized assistance, like shopping or travel suggestions. However, these developers are also using personal emails to gain insight into users’ interests.

Last year, Google promised to not read user emails for ad targeting purposes. But the tech giant has done little to protect Gmail user accounts accessed by third-party developers, according to the Journal.

SEE: GDPR security pack: Policies to protect data and achieve compliance (Tech Pro Research)

Hundreds of app developers can peruse the emails of users who signed up for email-based services, even letting their employees do the scanning, according to the report. Specifically, the Journal mentioned Return Path and Edison Software as repeat offenders.

Return Path studies users’ emails and gathers data for marketers, reading about 8,000 user emails a couple years ago to assist in software development, said the paper. Edison Software also read emails to help launch the app’s “Smart Reply” tool, according to the Journal. Both Return Path and Edison defended their actions, saying that human intelligence is necessary to develop successful artificial intelligence (AI).

Google declined to comment on the Journal’s findings, but this information comes at a sensitive time in light of the Cambridge Analytica scandal, in which the data firm was accused of using the personal information of millions of Facebook users to try and change election results.

Google has emphasized their privacy agreement before, saying that they have strict rules for developers’ access to emails, and provide an option for users to opt in or out of third-party email access. However, many people don’t understand the extent of what they are signing up for, and may not realize that real people might be reading their emails instead of an automated program.

We also can’t know how well outside developers stick to rule, or whether there is any proof that Google keeps track of third-party developers’ habits. This means business professionals need to be careful about what they send via email, as sensitive or confidential messages may be compromised by outside developers searching through their email.

The big takeaways for tech leaders:

  • Outside developers are reading users’ Gmail messages to personalize email-based services, according to the Wall Street Journal.
  • While Google promised to stop reading user emails last year, they aren’t doing anything to monitor third-party app developers who have access to Gmail accounts.