Outlook.com crawls links in my emails
<p>I've recently discovered that when opening an email with a link in Outlook.com the link is being crawled by Microsoft. It seems to me that this is a severe breach of privacy &ndash; such links can often be used to automatically sign you into your account on some site which contains sensitive information.</p>

<p>Is it legal for Microsoft to do this? Is it legal for me to allow them to do this? Is there an acceptable purpose for such behaviour?</p>

<p>(For details on how I know that this is happening, see <a href="https://stackoverflow.com/questions/32851044/how-do-i-stop-outlook-com-from-following-links-in-email">How do I stop Outlook.com from following links in email?</a>)</p>

<p>I am not a lawyer. This is not legal advice. Before acting upon legal information found online consult a certified practitioner of law.</p>

<p>Yes, they can collect this information due to the following loose clause (in the <a href="https://www.microsoft.com/en-gb/privacystatement/default.aspx" rel="nofollow">privacy policy</a>) on what data they can collect:</p>

<blockquote>
  <p>Microsoft collects data to operate effectively and provide you the best experiences with our services. You provide some of this data directly, such as when you create a Microsoft account, submit a search query to Bing, speak a voice command to Cortana, upload a document to OneDrive, or contact us for support. We get some of it by recording how you interact with our services by, for example, using technologies like cookies, and receiving error reports or usage data from software running on your device. We also obtain data from third parties (including other companies).</p>
</blockquote>

<p>This clause basically allows them to collect any data that helps them operate effectively and improve your experience of their service. It would be extremely hard for you to prove that the data they are collecting is not improving your experience as you do not know how it is used and the burden of proof would be on you in a lawsuit.</p>

<p>Their accessing of this link is allowed by the following other loose clause in the <a href="https://www.microsoft.com/en-gb/privacystatement/default.aspx" rel="nofollow">privacy policy</a></p>

<blockquote>
  <p>Microsoft uses the data we collect to provide you the services we offer, which includes using data to improve and personalize your experiences. We also may use the data to communicate with you, for example, informing you about your account, security updates and product information. And we use data to help make the ads we show you more relevant to you. However, we do not use what you say in email, chat, video calls or voice mail, or your documents, photos or other personal files to target ads to you.</p>
</blockquote>

<p>This allows them to use this in almost any way they want for the same reasons I explained above about the unfortunate looseness of this clause.</p>

<p>You are not violating the law by giving them permission to access these link. Furthermore, it is not the same as illegal digital access to a site because they can legally access this website because they are only using a URL which you have given them permission to use.</p>

<p>As said by <a href="http://fairuse.stanford.edu/overview/website-permissions/linking/" rel="nofollow">this guide</a> published out of Stanford:</p>

<blockquote>
  <p>Many copyright experts believe that deep linking (links that bypass a website’s home page) is not copyright infringement — after all, the author of a novel can’t prevent readers from reading the end first if they so desire, so why should a website owner have the right to determine in what order a user can access a website? Some well-known websites such as Amazon.com welcome deep links. However, if a commercial website has no linking policy or says that deep links are not allowed, it’s wise to ask for permission before deep linking. Why? Because many websites — even the listener-friendly National Public Radio — have asserted rights against deep linkers under both copyright and trademark law principles. - See more at: <a href="http://fairuse.stanford.edu/overview/website-permissions/linking/#sthash.wnR38eRj.dpuf" rel="nofollow">http://fairuse.stanford.edu/overview/website-permissions/linking/#sthash.wnR38eRj.dpuf</a></p>
</blockquote>

<p>As stated in the qoute above it is murky water as to what you can link to. It gets even murkier in international law as shown is the below qoute from the same page:</p>

<blockquote>
  <p>International law is equally murky. For example, in 2002, a Danish court prevented a website from deep linking to a newspaper site. But in 2003, Germany weighed in on the issue when its federal court ruled that deep linking was not a violation of German copyright law. Subsequently, an Indian and a Danish court both separately ruled against the practice of deep linking in 2006. - See more at: <a href="http://fairuse.stanford.edu/overview/website-permissions/linking/#sthash.wnR38eRj.zEJo8Fnf.dpuf" rel="nofollow">http://fairuse.stanford.edu/overview/website-permissions/linking/#sthash.wnR38eRj.zEJo8Fnf.dpuf</a></p>
</blockquote>

<p>However, from what I have found nothing involving deep linking as been tested in courts in the United States. But, I believe that from a practical standpoint it would be hard to enforce anti-deeplinking case law because it has become so deeply engrained in internet culture.</p>

<p>I am not a lawyer. This is not legal advice. Before acting upon legal information found online consult a certified practitioner of law.  </p>

<p>It is legal, and you gave them permission to use your information in this way.
You can check their privacy policy <a href="https://www.microsoft.com/en-gb/privacystatement/default.aspx" rel="nofollow">here</a>.</p>

privacy terms-of-service