Email privacy is a broad topic dealing with issues of unauthorized access to, and inspection of, electronic mail, or unauthorized tracking when a user reads an email. This unauthorized access can happen while an email is in transit, as well as when it is stored on email servers or on a user's computer, or when the user reads the message. In countries with a constitutional guarantee of the secrecy of correspondence, whether email can be equated with letterstherefore having legal protection from all forms of eavesdroppingis disputed because of the very nature of email.</ref>
In 2022 a lookback at an 1890 law review article about personal privacy (the "right to be left alone”) noted how "digital technology has been allowed to invade our lives" both by personal choice and behavior, and also by various forms of ongoing monitoring.
An email has to go through potentially untrustworthy intermediate computers (email servers, ISPs) before reaching its destination, and there is no way to verify if it was accessed by an unauthorized entity. Through the process of information being sent from the user's computer to the email service provider, data acquisition is taking place, most of the time without the user knowing. There are certain data collection methods (routers) that are used for data privacy concerns, but there are others that can be harmful to the user. This is different from a letter sealed in an envelope, where, by close inspection of the envelope, it might be possible to determine if it had been previously opened. In that sense, an email is much like a postcard, the contents of which are visible to anyone who handles it.
There are certain technological workarounds that make unauthorized access to email difficult, if not impossible. However, since email messages frequently cross national boundaries, and different countries have different rules and regulations governing who can access an email, email privacy is a complicated issue.
Companies may have email policies requiring employees to refrain from sending proprietary information and company classified information through personal emails or sometimes even work emails. Co-workers are restricted from sending private information such as company reports, slide show presentations with confidential information, or email memos.
Technological workarounds
There are some technical workarounds to ensure better privacy of email communication. Although it is possible to secure the content of the communication between emails, protecting the metadata, for instance who sent email to whom, is fundamentally difficult. Even though certain technological measures exist, the widespread adoption is another issue because of reduced usability.
Encryption
According to Hilarie Orman, mail encryption was first developed in the mid-1980s. She states that mail encryption is a powerful tool that protects one's email privacy. Although it is widely available, it is rarely used, with the majority of email sent at risk of being read by third parties. In general, encryption provides protection against malicious entities. However, a court order might force the responsible parties to hand over decryption keys, with a notable example being Lavabit. Encryption can be performed at different levels of the email protocol.
Transport level encryption
With the original design of email protocol, the communication between email servers was plain text, which posed a huge security risk. Over the years, various mechanisms have been proposed to encrypt the communication between email servers. One of the most commonly used extension is STARTTLS. It is a TLS (SSL) layer over the plaintext communication, allowing email servers to upgrade their plaintext communication to encrypted communication. Assuming that the email servers on both the sender and the recipient side support encrypted communication, an eavesdropper snooping on the communication between the mail servers cannot see the email contents. Similar extensions exist for the communication between an email client and the email server.
End to end encryption
In end-to-end encryption, the data is encrypted and decrypted only at the end points. In other words, an email sent with end-to-end encryption would be encrypted at the source, unreadable to email service providers in transit, and then decrypted at its endpoint. Crucially, the email would only be decrypted for the end user on their computer and would remain in the encrypted, unreadable form to an email service, which wouldn't have the keys available to decrypt it. Some email services integrate end-to-end encryption automatically.