1

I've recently discovered that when opening an email with a link in Outlook.com the link is being crawled by Microsoft. It seems to me that this is a severe breach of privacy – such links can often be used to automatically sign you into your account on some site which contains sensitive information.

Is it legal for Microsoft to do this? Is it legal for me to allow them to do this? Is there an acceptable purpose for such behaviour?

(For details on how I know that this is happening, see How do I stop Outlook.com from following links in email?)

Improve this question
1
  • Uh are you sure the server is doing this and not your browser? Browsers have a setting which will prefetch links in the page you're viewing to speed up browsing. In Edge you can find this under Settings, Advanced Settings, Use page prediction...
    – Andy
    Oct 5 '15 at 1:17
2

I am not a lawyer. This is not legal advice. Before acting upon legal information found online consult a certified practitioner of law.

Yes, they can collect this information due to the following loose clause (in the privacy policy) on what data they can collect:

Microsoft collects data to operate effectively and provide you the best experiences with our services. You provide some of this data directly, such as when you create a Microsoft account, submit a search query to Bing, speak a voice command to Cortana, upload a document to OneDrive, or contact us for support. We get some of it by recording how you interact with our services by, for example, using technologies like cookies, and receiving error reports or usage data from software running on your device. We also obtain data from third parties (including other companies).

This clause basically allows them to collect any data that helps them operate effectively and improve your experience of their service. It would be extremely hard for you to prove that the data they are collecting is not improving your experience as you do not know how it is used and the burden of proof would be on you in a lawsuit.

Their accessing of this link is allowed by the following other loose clause in the privacy policy

Microsoft uses the data we collect to provide you the services we offer, which includes using data to improve and personalize your experiences. We also may use the data to communicate with you, for example, informing you about your account, security updates and product information. And we use data to help make the ads we show you more relevant to you. However, we do not use what you say in email, chat, video calls or voice mail, or your documents, photos or other personal files to target ads to you.

This allows them to use this in almost any way they want for the same reasons I explained above about the unfortunate looseness of this clause.

You are not violating the law by giving them permission to access these link. Furthermore, it is not the same as illegal digital access to a site because they can legally access this website because they are only using a URL which you have given them permission to use.

As said by this guide published out of Stanford:

Many copyright experts believe that deep linking (links that bypass a website’s home page) is not copyright infringement — after all, the author of a novel can’t prevent readers from reading the end first if they so desire, so why should a website owner have the right to determine in what order a user can access a website? Some well-known websites such as Amazon.com welcome deep links. However, if a commercial website has no linking policy or says that deep links are not allowed, it’s wise to ask for permission before deep linking. Why? Because many websites — even the listener-friendly National Public Radio — have asserted rights against deep linkers under both copyright and trademark law principles. - See more at: http://fairuse.stanford.edu/overview/website-permissions/linking/#sthash.wnR38eRj.dpuf

As stated in the qoute above it is murky water as to what you can link to. It gets even murkier in international law as shown is the below qoute from the same page:

International law is equally murky. For example, in 2002, a Danish court prevented a website from deep linking to a newspaper site. But in 2003, Germany weighed in on the issue when its federal court ruled that deep linking was not a violation of German copyright law. Subsequently, an Indian and a Danish court both separately ruled against the practice of deep linking in 2006. - See more at: http://fairuse.stanford.edu/overview/website-permissions/linking/#sthash.wnR38eRj.zEJo8Fnf.dpuf

However, from what I have found nothing involving deep linking as been tested in courts in the United States. But, I believe that from a practical standpoint it would be hard to enforce anti-deeplinking case law because it has become so deeply engrained in internet culture.

I am not a lawyer. This is not legal advice. Before acting upon legal information found online consult a certified practitioner of law.

Improve this answer
8
  • What if the terms and conditions of the target site specify that only the owner of the account is authorised to access said account -- that access is non-transferable?
    – MichaelRushton
    Oct 1 '15 at 10:39
  • @MichaelRushton You are not doing anything wrong that is between Microsoft and the company in question.
    – user2425
    Oct 1 '15 at 10:40
  • I am the company in this case. I send an email with a one-time, temporary link to be used only by the intended recipient. I don't give permission for the recipient's mail client to use it.
    – MichaelRushton
    Oct 1 '15 at 10:41
  • @MichaelRushton I am not sure on that one. It would be very hard to enforce.
    – user2425
    Oct 1 '15 at 10:44
  • @MichaelRushton My theory is that the company who wishes the recipient to restrict access to the link has the burden of making accidental unauthorized access unlikely. Hyperlinks, by their very nature, can be followed by anybody, and if you put something out on the Internet with no restrictions other than obscurity of the link and a human-language note to the recipient, you probably don't have a reasonable expectation of the contents remaining private. There are other more appropriate mechanisms you could feasibly employ to prevent unwanted accidental access.
    – Patrick87
    Oct 1 '15 at 20:52
0

It is legal, and you gave them permission to use your information in this way. You can check their privacy policy here.

Improve this answer
4
  • I can't see anything in there that mentions following links in (or reading in general) personal emails.
    – MichaelRushton
    Sep 30 '15 at 10:28
  • Also, I can't see how it could even be legal. The sender might not give permission to Microsoft to visit the link, and the recipient can't have authority to override this, can he?
    – MichaelRushton
    Sep 30 '15 at 10:32
  • @MichaelRushton lets say I write a script that runs when I open an email. This script opens new browser tabs and navigates to every link contained in the email. As a recipient I can do this. Why (under which legal theory) does your permission stop me from doing that, or from allowing my mail client to do it?
    – jqning
    Sep 30 '15 at 12:45
  • 1
    I'm not sure what you mean. As far as I'm aware, if someone other than the intended recipient accesses a private area of someone else's site then that's against the law. Is that not right? How is it any different to hacking? So I suppose there are two questions here; 1) have I given permission to Microsoft to crawl links in my emails, and 2) am I allowed to give permission to Microsoft to crawl links in my emails without the consent of the target site?
    – MichaelRushton
    Sep 30 '15 at 12:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.