Gmail

Is Gmail safe?

For security, Gmail is one of the safest places to keep an email account. Google's account protection is among the best available to ordinary users, and its spam filters stop most phishing before you see it. For privacy, it is weaker. Your mail is readable by Google's systems, the app shares data for advertising, and in 2025 France fined Google €325 million over the ads shown inside Gmail. We score it 62/100, a little above Google's Gemini (60).

How well does Gmail protect your account?

Email accounts are valuable to criminals because they unlock password resets for everything else. Gmail is hard to break into if you use what Google offers: passkeysPasskeyA way to sign in without a password. Your device holds a key tied to one website or app and unlocks it with your fingerprint, face or PIN.More in the glossary, 2-step verification and, for people at higher risk such as journalists and campaign staff, the Advanced Protection Program.

The filters are the other half. Google says Gmail blocks more than 99.9% of spam, phishing attempts and malware, and stops nearly 10 million spam emails every minute. No filter catches everything, and with billions of users, the 0.1% that slips through is still a lot of scam email.

We found no breach of Gmail's own systems in recent years. Rumours that "Gmail was hacked" usually turn out to be leaked passwords from other sites being tried on Gmail accounts, which 2-step verification defeats.

Can Google see your emails?

Yes, in the sense that matters for privacy. Gmail encrypts messages in transit with TLS, but only when the sender's or recipient's provider supports it; Gmail shows a red padlock when it does not. Mail is encrypted on Google's servers, but Google holds the keys. Personal Gmail has no end-to-end encryptionEnd-to-end encryptionEncryption in which only the sender and the recipient can read a message. The company running the service cannot see its content.More in the glossary. Client-side encryption, where the customer holds the keys, is limited to some paid Workspace plans.

Google's systems also read mail to run features: sorting into tabs, smart replies, package tracking, calendar events from bookings, and Gemini summaries if you use them. Google says it stopped using email content to pick ads and that it does "not scan or read your Gmail messages to show you ads". Apple's privacy label still lists coarse location, user ID and advertising data as used for third-party advertising, and email content for product personalisation.

The French fine over inbox ads

On 1 September 2025, France's data protection authority, the CNIL, fined Google €325 million (€200 million on Google LLC and €125 million on Google Ireland). It found that Gmail showed advertisements formatted like emails among real messages in the Promotions and Social tabs without users' consent, and that cookie consent at Google account creation was not valid. The CNIL said 53 million people in France had seen the ads, and ordered Google to fix both problems within six months.

The fine is about Gmail itself, not Google in general. It sits on top of a long list of earlier privacy penalties against Google, which is why we score Gmail's regulatory record at 40.

How to use Gmail safely

1. Turn on a passkeyPasskeyA way to sign in without a password. Your device holds a key tied to one website or app and unlocks it with your fingerprint, face or PIN.More in the glossary or 2-step verification, and remove old recovery phone numbers you no longer use.
2. Run Google's Security Checkup once a year to see signed-in devices and third-party apps with access to your mail.
3. Before clicking a link, check the full sender address and hover over the link. If an email asks you to sign in, go to the site yourself.
4. Turn off ad personalisation in your Google account and decide whether you want Gmail's smart features on.
5. Do not email passwords, ID scans or bank details. If you must, Gmail's confidential mode limits forwarding but is not end-to-end encryptionEnd-to-end encryptionEncryption in which only the sender and the recipient can read a message. The company running the service cannot see its content.More in the glossary.
6. Download your mail with Google Takeout occasionally. Losing access to a Gmail account is a bigger everyday risk than having it read.

Gmail for work and school

Workplace and school Gmail runs on Google Workspace, where the organisation, not you, is in charge. Administrators can read, retain and export mail, and Google says Workspace data is not used for ads. Compare Microsoft Teams for how employer control works in chat.

How we scored it

Security (74) and transparency and control (75) are Gmail's strongest factors: excellent account protection, strong filtering, and easy export and deletion. The regulatory record (40) is the weakest, driven by the CNIL's €325 million fine over inbox ads. Privacy (50) reflects advertising data sharing on the App Store label and the absence of end-to-end encryptionEnd-to-end encryptionEncryption in which only the sender and the recipient can read a message. The company running the service cannot see its content.More in the glossary.