Google has confirmed that private emails sent and received by Gmail users can sometimes be read by third-party app developers, not just machines.
People who have connected third-party apps to their accounts may have unwittingly given human staff permission to read their messages.
One company told the Wall Street Journal that the practice was "common" and a "dirty secret".
Google indicated that the practice was not against its policies.
One security expert said it was "surprising" that Google allowed it.
Gmail is the world's most popular email service with 1.4 billion users.
Google lets people connect their account to third-party email management tools, or services such as travel planning and price comparisons.
When linking an account to an external service, people are asked to grant certain permissions - which often include the ability to "read, send, delete and manage your email".
According to the Wall Street Journal, this permission sometimes allows employees of third-party apps to read users' emails.
'Not asked permission'
While messages are typically processed by computer algorithms, the newspaper spoke to several companies where employees had read "thousands" of email messages.
Edison Software told the newspaper it had reviewed the emails of hundreds of users to build a new software feature.
Another firm - eDataSource Inc - said engineers had previously reviewed emails to improve its algorithms.
The companies said they had not asked users for specific permission to read their Gmail messages, because the practice was covered by their user agreements.
"You can spend weeks of your life reading terms and conditions," said Prof Alan Woodward from the University of Surrey.
"It might well be mentioned in there, but it's not what you would think of as reasonable, for a human being in a third-party company to be able to read your emails."
Google said only companies that had been vetted could access messages, and only if users had "explicitly granted permission to access email".
It pointed the BBC to its developer policies, which state: "There should be no surprises for Google users: hidden features, services, or actions that are inconsistent with the marketed purpose of your application may lead Google to suspend your ability to access Google API Services."
It said Gmail users could visit the Security Check-up page to see which apps they had linked to their account, and revoke any they no longer wanted to share data with.
Latest Stories
-
Brazil great Marta to retire from international duty
18 mins -
Otto Addo was forced to accept Black Stars coaching job – Mohammed Polo
23 mins -
Karim Zito qualified to be Black Stars head coach – Mohammed Polo
30 mins -
Platinum Cup makes return on April 27
36 mins -
MoE is not changing uniforms or re-painting all public schools – Kwasi Kwarteng clarifies
1 hour -
16th Africa Aquatics Swimming Championships: Nubia and Harry to represent Ghana in Angola
1 hour -
Four defendants in NDA case by OSP open defence today
1 hour -
GFA commissions first set of floodlights at Ghanaman Soccer Centre of Excellence
1 hour -
Basic public school uniform change an initiative, not a policy – Kwasi Kwarteng
1 hour -
Bawumia appeals for peace in Gonjaland, donates GHȼ100K, bull
2 hours -
Drake: AI Tupac track gone from rapper’s Instagram after legal row
2 hours -
Repainting schools, changing uniforms a misplaced priority – Joy FM listeners on rebranding of basic public schools
2 hours -
UEFA U-16 Tournament: Black Starlets bounce back with 5-1 win over Serbia
2 hours -
There’s nothing strange about changing colours for basic public schools – Education Ministry PRO
2 hours -
Diana Asamoah causes arrest of personal assistant over GH₵4k MoMo theft
3 hours