Proton has accused Microsoft's new Outlook for Windows app for becoming a data collection service. It has outlined the various ways and data that the email app harvests from end users.

Proton Mail's article is about a week old and flew under my radar, but given that user privacy is at stake, I think it warrants a discussion here. The Switzerland-based email service has termed the new Outlook as a surveillance tool that is used for targeted advertising.

Microsoft Outlook is sharing user data with 772 advertisers

According to Proton, some users in Europe who download the new Outlook for Windows app, will see a modal (pop-up) that displays a user agreement, which mentions that Microsoft shares your data with 772 third-parties. Yes, you read that right, 772. The only reason you may see that pop-up is because the European Union's General Data Protection Regulation (GDPR) makes it mandatory for web services to inform users about data collection and cookies. The rest of the world isn't as lucky.

Interestingly, users in the U.K. can view a "list of advertising partners" that are working with the Redmond company. Instead of a universal toggle to opt-out of these ads, the app displays a toggle for each advertising company, along with a privacy policy for each ad service. Proton says that these policies are written in a way to confuse users, allowing the companies to sell the personal data of users to third-parties.

The agreement allows these entities to do the following

• Store and/or access information on the user’s device.
• Develop and improve products
• Personalize ads and content
• Measure ads and content
• Derive audience insights
• Obtain precise geolocation data
• Identify users through device scanning

I don't think users are going to mind all these companies looking over their shoulder and reading their mails, right? Actually, it is much worse than you think. Microsoft's advertising policy mentions that it does not collect personal data from emails, chats or documents for targeted ads. Data that is collected via telemetry is used to improve the user experience. But Proton says that Microsoft Outlook collects the following data from users:

• Name and contact data
• Passwords
• Demographic data
• Payment data
• Subscription and licensing data
• Search queries
• Device and usage data
• Error reports and performance data
• Voice data
• Text, inking, and typing data
• Images
• Location data
• Content
• Feedback and ratings
• Traffic data

Most of those are not even related to sending and receiving mails, I'm not even sure how this can be legal. Microsoft shares the data with Service providers, User-directed entities, Payment processing providers and Third parties that perform online advertising services for Microsoft.

Even the Mac version of the new Outlook isn't spared from these shenanigans. It displays ads that look similar to message notifications. Some of these are ads come from third-parties, while some are ads for Microsoft's other apps, such as Microsoft 365.

That's just wonderful. If you want to dive in to Microsoft's Privacy Policy, read it here.

(Images via Proton and Microsoft)

Outlook "steals" your email passwords

As Martin pointed out in November 2023, German blogs, Heise and CT had discovered that syncing third-party email accounts such as Gmail, Yahoo with Outlook would allow the app to send the passwords (IMAP and SMTP credentials) and other data (emails, contacts, and calendar).

If you think that's bad, wait till you read this. You cannot use the new Outlook app without syncing these data with Microsoft's servers, i.e. your usernames and passwords are sent to the company's cloud servers. While the data is sent using TLS, the IMAP and SMTP username and password are sent to Microsoft in plain text. This could allow the company to access your emails, and share the data with third-parties.

Proton alleges that Microsoft has proven that it is no different from Google, Meta and other such companies that indulge in data collection and ad delivery services.

I can't say I like the Outlook app, the old Mail app is/was better, the new one is just a web wrapper for Outlook.com. If you don't want to use Outlook for Windows, just right-click on the app in the Start menu and select Uninstall. You can also do this from the Settings > Apps > Installed Apps section. But, don't be surprised if Outlook comes back after a Windows Update.

Thunderbird and Apple Mail for macOS are the only desktop email clients I use, and recommend. What about you, got any favorites? Or do you use the new Outlook for Windows app?