Elevating user trust in our API ecosystem

Editor’s note: Since publishing this post, we’ve updated our FAQ here. We’ve also updated the effective date of these changes from January 9, 2019 to January 15, 2019.

Google API platforms have a long history of enabling a vibrant and secure third-party app ecosystem for developers—from the original launch of OAuth which helped users safeguard passwords, to providing fine-grained data-sharing controls for APIs, to launching controls to help G Suite admins manage app access in the workplace.

In 2018, we launched Gmail Add-ons, a new way for developers to integrate their apps into Gmail across platforms. Gmail Add-ons also offer a stronger security model for users because email data is only shared with the developer when a user takes action.

We’ve continually strengthened these controls and policies over the years based on user feedback. While the controls that are in place give people peace-of-mind and have worked well, today, we’re introducing even stronger controls and policies to give our users the confidence they need to keep their data safe.  

To provide additional assurances for users, today we are announcing new policies, focused on Gmail APIs, which will go into effect January 9, 2019.  We are publishing these changes in advance to provide time for developers who may need to adjust their apps or policies to comply.

Of course, we encourage developers to migrate to Add-ons where possible as their preferred platform for the best privacy and security for users (developers also get the added bonus of listing their apps in the G Suite Marketplace to reach five million G Suite businesses).  Let’s review the policy updates:

Policies

To better ensure that user expectations align with developer uses, the following policies will apply to apps accessing user data from consumer Google accounts (Note: as always, G Suite admins have the ability to control access to their users’ applications. Read more.).

Appropriate Access: Only permitted Application Types may access these APIs.

Users typically directly interact with their email through email clients and productivity tools.  Users allowing applications to access their email without their regular direct interaction (for example, services that provide reporting or monitoring to users) will be provided with additional warnings and we will require them to re-consent to access at regular intervals.

How Data May Not Be Used:  3rd-party apps accessing these APIs must use the data to provide user-facing features and may not transfer or sell the data for other purposes such as targeting ads, market research, email campaign tracking, and other unrelated purposes.  (Note: Gmail users’ email content is not used for ads personalization.)

As an example, consolidating data from a user’s email for their direct benefit, such as expense tracking, is a permitted use case. Consolidating the expense data for market research that benefits a third party is not permitted.

We have also clarified that human review of email data must be strictly limited.

How Data Must Be Secured:  It is critical that 3rd-party apps handling Gmail data meet minimum security standards to minimize the risk of data breach.  Apps will be asked to demonstrate secure data handling with assessments that include: application penetration testing, external network penetration testing, account deletion verification, reviews of incident response plans, vulnerability disclosure programs, and information security policies.

Applications that only store user data on end-user devices will not need to complete the full assessment but will need to be verified as non-malicious software.  More information about the assessment will be posted here in January 2019. Existing Applications (as of this publication date) will have until the end of 2019 to complete the assessment.

Accessing Only Information You Need:  During application review, we will be tightening compliance with our existing policy on limiting API access to only the information necessary to implement your application.  For example, if your app does not need full or read access and only requires send capability, we require you to request narrower scopes so the app can only access data needed for its features.

Additional developer help documentation will be posted in November 2018 so that developers can assess the impact to their app and begin planning for any necessary changes.

Application Review

All apps accessing the Covered Gmail APIs will be required to submit an application review starting on January 9, 2019.  If a review is not submitted by February 15, 2019, then new grants from Google consumer accounts will be disabled after February 22, 2019 and any existing grants will be revoked after March 31, 2019.

Application reviews will be submitted from the Google API Console.  To ensure related communication is received, we encourage developers to update project roles (learn more) so that email addresses or an email group is up-to-date.

Covered Gmail API Scopes

https://mail.google.com/

https://www.googleapis.com/auth/gmail.readonly

https://www.googleapis.com/auth/gmail.metadata

https://www.googleapis.com/auth/gmail.modify

https://www.googleapis.com/auth/gmail.insert

https://www.googleapis.com/auth/gmail.compose

https://www.googleapis.com/auth/gmail.settings.basic

https://www.googleapis.com/auth/gmail.settings.sharing

FAQ

Editor’s note: Since publishing this post we’ve updated our FAQ here.

How does this apply to my enterprise accounts (G Suite, Cloud Identity)?

These changes only impact consumer Google accounts. G Suite administrators are able to control access to their users’ applications.

Which apps need to submit an application?

All apps that request the covered APIs need to submit a review.  This includes web, iOS, Android and other native client types.

What are the key dates for application review?

Applications accessing the covered Gmail APIs can apply beginning January 9, 2019 and must submit a review by February 15, 2019. Applications that have not submitted a review may have consumer account access disabled for new users on February 22, 2019 and existing grants revoked by March 31, 2019.

If my app is for use by my enterprise only, do I need to submit a review?

It depends.  If all of your users are G Suite account holders, then no.  If your users created consumer Gmail accounts, then your app will need to complete a review for your app to access a consumer account.

What if I have several apps, will they all need to be reviewed?

Yes, the application review is based on the Client ID level.  Each app accessing the covered API scopes must be submitted for review.

If my app uses a combination of covered and non-covered APIs, how does that impact me?

The app will need to be submitted for review.  If it is not, access to all covered API scopes will be disabled for consumer accounts.

As Google announces additional APIs that need to complete an application review, do I need to re-submit for the entire review?

As new policies for APIs are announced, your app will need to be re-reviewed.  Any changes made to your app to comply with the policy should enable the review to be completed more efficiently though your app may need to address API-specific policies.

How long will it take to review my app?

The entire process may take several weeks depending on the volume and the number of follow-up questions needed.  While your app is being reviewed, no enforcement actions such as disabling the app or revoking access will be taken.

How do I get my review completed faster?

Your review can be completed faster if your review submissions is as detailed and thorough as possible.  Please make sure the following are prepared

• Your app can be accessed and used by our review team with their test accounts.  

• Your app’s website is complete, descriptive and includes easy access to the privacy policy.

• Update your privacy policy to include the “recommended limited use snippet” to be posted here by November 12, 2018.

Why is the security assessment needed?

To keep user data safe, we are requiring apps to demonstrate a minimum level of capability in handling data securely and deleting user data upon user request.  

How will the security assessment work?

First, your application will be reviewed for compliance with policies governing appropriate access, limited use, minimum scope. Thereafter, you will use a third party assessor to begin your security assessment.  Your app will have the remainder of 2019 to complete the assessment. The assessment fee is paid by the developer and may range from $15,000 to $75,000 (or more) depending on the size and complexity of the application.  This fee is due whether or not your app passes the assessment; the fee includes a remediation assessment if needed. If your app has completed a similar security assessment, you will be able to provide a letter of assessment to the assessor as an alternative. More details on the security assessment will be provided by January 9, 2019.

Why is Google asking apps to pay for the security assessment?

The security assessment will be completed by a 3rd party to ensure the confidentiality of your application.  All fees are paid directly to the assessor and not to Google. As we’ve pre-selected industry leading assessors, the letter of assessment your app will receive can be used for other certifications or customer engagements where a security assessment is needed.