Privacy Concerns

Google Chat Spaces

Google Chat Spaces are, in my view, a very serious privacy issue. At the time of writing, I believe that the use of Google chat spaces that permit members from more than a single domain are in breach of data protection laws in many jurisdictions including GDPR in the UK and Europe. As such, I avoid using them.

I certainly will not participate in any Chat Spaces with any of my primary email accounts. If need be, I will set up a throwaway account to use specifically for a Chat Space.

Anyone who invites me to a Chat Space using anything other than an email address I have sanctioned for use in a Chat Space will be asked to immediately rescind that invitation (and warned that I am liable to report them to the ICO! )

The Issue

The moment an email address is invited to join a Google Chat Space, that email address is added to the list of 'invited' members for that Space. That list, as well as the list of 'added' members is completely visible to all members of that Space. That means that EVERYONE in that chat Space can see the email addresses of EVERYONE that is a member or has been invited to become a member.

This is essentially equivalent to the manager of that Chat Space sending an email to all current and prospective members of that Space listing the email addresses of all current and prospective members of that Space.

I cannot stress strongly enough, if you value control over who has access to your email address -

AVOID USING GOOGLE CHAT SPACES 

Rescinding Invitations

If you are invited to a Chat Space you can ask the space manager to rescind that invitation so that your email address is no longer exposed. You need to do this even if you leave a group or did not join the group at all because unless you do, your email address will remain on the 'Invited' list. But that's not all! Even if your invitation to the Space is removed the fact that you were invited will continue to be exposed within the space USING THE NAME ASSOCIATED WITH THE ACCOUNT THAT WAS INVITED.

Example:
I was recently (March 2024) invited to join a newly created Space using my primary personal email. I took exception to this and asked the Space manager to remove my invitation and re-invite me using a different email address - which they did. However my name - the one associated with the first account invited - remained fully visible to all members of that Space (see image below). I asked for my name to be removed but it appears that this is not possible and the only recourse was to completely delete the group and start again.