Yahoo Mail’s practice of scanning emails has backfired in in Canada. Yahoo Mail and Rogers — the telecom that provides Yahoo’s email service in the country — have altered their new terms of service in response to a public outcry.    

In addition, The Office of the Privacy Commissioner of Canada (OPC) is probing Rogers and Oath, Yahoo Mail’s parent brand, according to media reports. .

Oath has removed an offending clause in its terms specifying “personal data of friends and contacts,” saying it is unnecessary. And it claims that it has never been used to drive advertising.

But that may not be enough. According to MobileSyrup, the OPC says it has received “complaints related to other aspects of the company’s terms of service agreement and have opened an investigation.”

The flap apparently started when a Canadian consumer named Janet Lo received a pop-up message from Rogers, asking her to review the new terms of service.  

Lo objected, and sent an email to a Toronto Star reporter, with the subject line: “Rogers customers — do they know their emails are being read?” A story followed 

The terms of service seem to demand permission from a user’s friends. According to the Star, the 27-page includes the following:

“By using the services, you agree that you have obtained the consent of your friends and contacts to provide their personal information (for example, their email address or telephone number) to Oath or a third party, as applicable, and that Oath or a third party may use your name to send messages on your behalf to make the services available to your friends and contacts. The services are not to be used for any form of spam.”

Well, no more. And it’s unclear whether Yahoo Mail will continue scraping other pieces of data.  

As recently reported by Email Insider, Oath has extended its scanning — already pursued by Yahoo Mail — to AOL email to drive targeted advertising.

But it may the wrong way to go. And the current incident may be a portent of problems in Europe as GDPR takes effect. 

As you can infer from the reaction in Canada, many consumers will object to having personal data extracted in this way. And even with consent, some regulator may decide that it is not an appropriate practice, and that consumers should not have to wade through a long document to learn about it.  

Oath should take a page from Google: It stopped scanning Gmail messages last year. But it has faced class action lawsuits over the practice. Granted, Oath has extended its arbitration clause and class-action waiver to Yahoo Mail, making it harder for consumers to sue. But that won’t prevent the EU or FTC from suing.