Is it illegal to continue using oAuth tokens after a user asks to remove them?

Question

We have an app that allows users to connect their CRM.

The CEO wants to "fool" users into making them believe that they can delete the OAuth tokens so that we don't have access to their data anymore.

However, the CEO wants the dev team to continue using those tokens in the background and read the user's data.

I'm the lead developer, and I have concerns about the legality of what he's asking. I don't want to be guilty by association.

This is a pre-seed startup in the United States.

Also, the CEO wants to download all of the CRM data from our users and re-sell it to other users.

For example, if Lyft were to connect their CRM to our tool, the CEO wants to use that data to sell it to Uber and vice-versa.

He claims this is legal because users are allowing us to read their CRM data and once we get the data, the data become ours, and we can do whatever we want with it. Is this true?

Are there any policies that we or I should be aware of before rolling out this solution?

We also request users to connect their business emails (Gmail and Outlook) to our tool. The CEO wants us to download all of their emails and store them in our database in plain-text. Are there any policies or regulations that I, as a dev lead, should be aware of?

Edit: There is no "legal" department, we have investors, and some investors have asked about the legality, and the CEO keeps saying "we're covered" He claims that he hired three firms to go over legal issues, but he refuses to share the name of the firms with me. He always evades the question with things like "Let me handle that."

Answer 1

Legalities

What is being proposed is illegal in most jurisdictions and particularly so if any of your users is in the EU or an EU citizen.

All jurisdictions I know of have a law that prohibits businesses from engaging in deceptive or misleading conduct; in most cases irrespective of intent. Deliberately setting out to "fool" your customers is a textbook definition of deceptive or misleading conduct.

You can only use data for the purposes for which it was collected - particularly if it is personal information as most CRM data is. Even if your ToS say you can use it however you like, that term may be unenforceable (i.e. you can't rely on it) because a) it may be misleading or deceptive, b) it may be unconscionable or c) it may breach consumer protection laws.

EU and Argentinian residents and citizens have a legal "right to be forgotten" so you must be able to delete personal data related to them. Even if your app is targeted at countries that do not have this right, you will have to deal with the fact that your users may hold such citizenship.

Reputation

This is a stupid idea even if it was legal. If your users do not trust your business you won't have a business.

Answer 2

The CEO wants to "fool" users

You are essentially admitting that the company you are working for is about to deceit its customers and asking whether that is legal.

The relevant set of laws is rather sparse and does not give direct answers in regards to oAuth tokens or other details of that level (which is probably making your CEO think he can "handle" the arising questions). Probably the most relevant bit of legislation that applies here is The Federal Trade Commission Act (15 U.S.C. §§41-58) which prohibits unfair or deceptive practices and has been applied to online privacy and data security policies. I am pretty sure that, in practice, if the users take your company to court, it will be held liable because:

users are allowing us to read their CRM data and once we get the data, the data become ours, and we can do whatever we want with it. Is this true?

While the users are still allowing you to read their data it is completely up to the Terms/EULA what you can do with it. However, once you have made the users think that they have withdrawn your access (e.g. they "deleted" oAuth tokens), you are no longer authorized to read the current data (although the Terms may still allow you to use the old data you obtained when you had access). Silently continuing to access their data without their knowledge/approval is definitely a deceit.

The CEO wants us to download all of their emails and store them in our database

There would be nothing wrong with that if it was in the Terms. But if it is not, that would be a blatant (and easily punishable) breach of privacy.

Note that you may also be held personally liable for this wrongdoing (if/when proved so). "Just doing your job" claim will not work.