Yahoo still scans users’ emails for data to sell to advertisers, a practice that many tech companies have moved away from, according to The Wall Street Journal.

Yahoo’s owner, Oath, is in talks with advertisers to provide a service that would analyze over 200 million Yahoo Mail inboxes for consumer data, sources told WSJ. Oath did not immediately respond to a request for comment.

Oath confirmed to the WSJ that it performs email scannings and said that it only scans promotional emails, usually from retailers. Users have the ability to opt out, it said. Oath’s argument is that email is an expensive system, and people can’t expect a free service without some value exchanged.

The opt-out page is hard to find

Even the emails in Yahoo’s premium email service, which costs $3.49 a month, are subject to the analysis, unless users opt out. To opt out, you have to specifically head into the Ad Interest Manager here and select “opt out.” The page is not located in Settings, which makes it hard to find.

Oath uses algorithms to sort Yahoo emails by different consumer preferences and places cookies that will show users similar advertising in the future. For instance, users who often buy plane tickets are labeled frequent flyers by Oath’s algorithms. Those who receive emails inviting them to drive for Lyft are sorted as “self-employed.” Advertisers can then target these groups of users when taking out ads with Oath.

Personal emails are ignored and personally identifiable information is hidden from the data that’s given to advertisers, Oath told the WSJ. The algorithm has made mistakes before, though. Invitations to traditional Indian weddings that can be sent to a large number of recipients and take place over several days, were mistakenly labeled as commercial emails, which Oath then had to correct. Now, wedding invitations are also ignored, Oath told the WSJ.

It’s spelled out in Oath’s privacy policy

The process of reviewing these emails requires human readers as well as algorithm sorting. As we reported in April, Oath’s privacy policy allows it to read AOL and Yahoo emails to tailor ads, and that includes human readers, not just machines.

The move looks like Oath is scraping the bottom of the barrel with its mail service as it struggles to combat the more popular Gmail. Anonymous sources told the WSJ that Oath representatives know many people use Yahoo Mail as their spam account that collects unwanted emails from retailers, and that’s precisely what advertisers could capitalize on. Still, in these meetings, advertisers expressed doubt if Yahoo Mail was even big enough to send highly targeted ads. Even if Oath provided data from 200 million accounts, only a few of those users would have bought specific items.

Yahoo has also struggled with a series of data breaches that have marred its reputation. Every single Yahoo account (3 billion users) was hacked in 2013. In 2017, in a survey of 2,500 US adults, Statista found that 44 percent of people used Gmail compared to 29 percent that used Yahoo Mail. While Yahoo Mail remains popular in those aged 65 and older, only 19 percent of those aged 18–29 still use it compared to 61 percent who prefer Gmail.

While Yahoo’s record on data privacy may be dubious, Google has also had its own issues with Gmail over the past year, despite ending targeted advertisement last year, citing users’ privacy concerns.

In May last year, a sophisticated phishing attack swept through Gmail, disguised as a Google Docs permission request. Then, last July, the WSJ found that Gmail third-party app developers can still read users’ emails if users give consent. Both the phishing attack and the WSJ report highlighted the vulnerabilities in Google’s permissions system.

But the difference is that, unlike Yahoo and its reliance on Yahoo Mail, if users who are looking for more secure and private email services end up leaving Gmail, Google can still count on its search engine and a slew of other products people still use frequently.