Have you ever used Unroll.me, the web service that helps you unsubscribe from newsletters in bulk? If so, your emails have been scanned by that company and sold to third parties including Uber. There's a chance they're scanning your emails right now.
If you want to switch tabs right now and remove third-party access to your email account, I don't blame you. It's the first thing I did when I found out. Come back when you're ready, though, because I know you're curious how Uber is involved.
You might be aware that Uber is having, shall we a say, a difficult few months in the public relations department. The latest incident is a New York Times profile of CEO Travis Kalanick, which reveals the company was fingerprinting iPhones against Apple's terms of service---Apple CEO Tim Cook reportedly threatened to pull Uber out of the App Store altogether over it. That's what made headlines yesterday, but scroll down a little further and you'll find this tidbit about a company called Slice Intelligence, which Uber hired to do market research.
"Using an email digest service it owns named Unroll.me, Slice collected its customers’ emailed Lyft receipts from their inboxes and sold the anonymized data to Uber," the article states.
We Got Played
I used Unroll.me many years ago. If you're anything like me, a few things came to mind after reading about this.
- Wait...Unroll.me is owned by a market research company? When did that happen?
- That company scans people inboxes for reasons other than finding newsletters?
- Does this thing still have access to my emails?
When I first started using Unroll.me, it was a two-person startup. I had no idea the service was still enabled on my Gmail account all these years later, and I had no idea that a market research company with a villainous name had since bought the service.
I'll admit it: I got played. I feel betrayed. And I'm not the only one.
An uproar against Unroll.me quickly surged, and with good reason.
Is This Legal?
This is completely legal. Unroll.me doesn't exactly go out of its way to advertise that it's selling anonymized information from your inbox to third parties, but the information is there for anyone willing to dig for it. The Unroll.me privacy page specifically allows for "sharing" your information.
"We may share personal information we collect with our parent company, other affiliated companies, and trusted business partners," the page says. It's not clear, but the language allows for selling off information.
The Unroll.me team, for their part, have issued an apology best summarized as "sorry not sorry." From a blog post by co-founder Jojo Hedaya:
Our users are the heart of our company and service. So it was heartbreaking to see that some of our users were upset to learn about how we monetize our free service.
After that sarcastic-sounding introduction, the post points out that the language of the company's privacy statement allows them to do exactly what they've been doing. Only after stating that do they admit the transaction could be a touch more transparent, and specifically state that they'll add this information to their on-boarding process and Frequently Asked Questions page. That information should have been there all along.
But if I'm honest, this is mostly my fault. I signed up for a free service, and gave that service access to my inbox. Then I let it keep that access for years. I shouldn't have left it enabled that long.
How Do I Delete My Unroll.me Account?
Are you wondering how to delete your Unroll.me account? Go to Unroll.me and log in. Click your username at top-right, then click "Settings."
You'll find your settings, which includes an itsy bitsy "Delete my account" button. Click it with gusto.
Just like that, your account is gone.
I also recommend you make sure Unroll.me doesn't have access to your Gmail account, which you can do by heading to myaccount.google.com, then clicking the "Connected Apps and Sites" link.
From here you'll see a list of sites with access to your Google account. If you find Unroll.me in that list, disable it. There's a chance that Unroll.me will email you after you do this.
Savor the irony for a bit, then click "Unsubscribe."
What Can I Use Instead?
You might be wondering: is there anything I can use instead of Unroll.me, now that I've deleted it? Well, you could just unsubscribe from emails the correct way, by clicking the links in the emails themselves. In some cases Gmail itself adds a button to make this process easier for you:
But if you liked being able to keep track of what you unsubscribed from, Gmail Unsubscribe is an open source alternative from Digital Inspiration you can install as a Google script. Because the script lives entirely on your Google account, no third parties have access to your data while using it: it's yours.
To get started, click this link to copy the script to your Google Drive account.
Click "Make a Copy" and you'll be brought to the spreadsheet in your Google Drive.
Click the "Gmail Unsubscriber" button, then click "Configure."
You will be asked to authorize the spreadsheet to access your Gmail account. Again: you're giving access to the copy of the spreadsheet on your Google Drive, and not any third parties. When you're done you'll be asked to name a label for emails you'd like to unsubscribe from.
Head to Gmail and create a label with the same name you specified to the spreadsheet.
To unsubscribe from emails, simply apply the label to any newsletter you don't want to keep getting.
The unsubscribe link will be automatically clicked, and a note will be left on the spreadsheet.
It's a simple integration that involves giving up none of your information to third parties. Even better, it's open source. Shout out to Amit Agarwal for putting this together so quickly after this controversy arose. Here's hoping even better solutions show up in the months to come.