Before you click Allow on an email tracker

Usually it is, as long as you know which screen you are agreeing to. Setting up a Gmail tracker can involve up to three separate permission prompts, each granting something different, and the one that matters most tends to be the one people click through fastest. Google publishes exactly what each Gmail permission allows and what an app must pass before it may ask for the broadest one, so this is a question you can check for yourself in a couple of minutes.

Three prompts, three different grants

The first comes from Chrome. When you add an extension, Chrome shows a permission warnings dialog on installation describing what the extension will be able to do, and the line worth reading is the one naming websites. A tracker needs Gmail's own site so it can add buttons to your compose window. Chrome's permissions reference attaches the wording "Read and change all your data on all websites" to several of its most powerful permissions, and a Gmail tracker has no reason to need that reach.

The second is ordinary Google sign in: your name, email address and profile picture, so the tracker knows who you are. The third is the Gmail connection itself, Google's consent screen, which lets the vendor's servers act on your mailbox while you are away. That is the grant to slow down for.

Reading the Gmail line on the consent screen

Google sorts Gmail permissions, called scopes, into three tiers on its Gmail API scopes page, and the consent screen shows each one's plain description. The send scope, described as "Send email on your behalf", is in the sensitive tier. The restricted tier holds the scopes that reach into your mail, including read only access to your messages and the full scope, which Google describes as able to read, compose, send, and permanently delete all your email from Gmail.

The useful test is whether the scope matches what the product does. A tool that only reports opens has no obvious need to read your messages. A tool that sends mail for you needs a send scope. Google's own note on the full scope says to request it only when an app must permanently delete messages without going through the trash, because everything else can be done with narrower scopes. There is one more case the note leaves out: Google's page on OAuth for IMAP, POP and SMTP says the scope for SMTP access is the full mail scope, so an app that sends through Gmail's SMTP server needs it too.

What Google checks before an app gets the widest access

Restricted scopes come with an audit. Under Google's restricted scope verification rules, an app that accesses restricted data from or through a server must pass a security assessment by an independent assessor that Google approves. The assessment follows the App Defense Alliance's framework, known as CASA, and has to be repeated at least every 12 months to keep the access.

Until that review is complete, Google warns you. Its help page on unverified apps says an unverified app screen appears before the consent screen when an app has requested verification for sensitive or restricted scopes and the verification is not yet finished, and such an app is limited to 100 new users in total. The screen tells you nobody outside the company has audited the app yet. It says nothing about intent, so weigh it alongside what you know about the vendor.

Verified apps are also bound by the Google API Services User Data Policy. Its Limited Use rules confine the data to user facing features, forbid selling or transferring it to advertising platforms and data brokers, and forbid people at the company reading your mail unless you agreed to them viewing specific messages or it is needed for security or the law.

The right question is whether the access matches the job, and whether the vendor has explained that match in writing.

Our own answer, in full

We ask for the full mail scope, so we owe you the reasons. The first is sending: each tracked copy goes out over Gmail's SMTP server as you, with the delivery split so every recipient gets their own tracked copy while the To and Cc lines they see stay exactly as you wrote them. The second is cleanup. If a copy carrying a recipient's tracking ever lands in your own Sent folder, we delete it permanently, because a copy moved to Trash keeps its tracking image and could report your own reading as the recipient's. That is precisely the case Google's note describes.

Our privacy policy lists every operation we perform in your Gmail next to the narrowest scope that would allow it. We find the copies we sent by the Message ID we generated for them, read the one draft you are sending when it carries attachments, and when you reply we read only the two headers that thread the reply correctly. We do not list, browse or search your mailbox. The token that lets us send is stored encrypted, and disconnecting revokes the grant at Google itself rather than only inside our app. In Chrome, the extension asks for Gmail's site and our own server, nothing wider.

Our security assessment is still in progress. Until it completes, Google shows its unverified app screen to anyone connecting and holds us to 100 users, which is why access is early and limited.

A two minute check for any tracker

• Read the Chrome prompt. Gmail on the list is expected. Access to all websites deserves a question.
• Match the Gmail scope to the features. A tool that sends needs a send scope, and a tool asking to read your mail should say what it reads and why.
• Look for the written reason. Google's own account help advises reading an app's privacy policy and security disclosures before giving it access to your account.
• Notice the unverified app screen if it appears, and ask the vendor where its security assessment stands.
• Know the way out. The linked apps page in your Google Account shows what each app can reach, lets you remove its access, and has a Report this app button if you think one is misusing data.

If our answer reads the way you would want a vendor's to, Fast Mail Tracker is in early access while Google's review runs, and you can request a place with the install button below.