In June 2017, Google announced it would stop scanning the contents of consumer Gmail messages to personalize ads. The news made headlines, and for good reason: for years, “Gmail reads your email” had been shorthand for everything people feared about free webmail. But the change didn’t make Gmail private in the way most people imagine. Google still processes message content for spam filtering, smart features, and security. Meanwhile, Proton Mail built its entire reputation on a different promise: encryption so strong that even Proton can’t read your inbox.
So which service actually deserves your trust? The honest answer is that “private” means two very different things to these two companies. Understanding that difference matters more than any feature checklist.
Two Very Different Ideas of Privacy
Gmail and Proton Mail are not rivals that happen to have different settings. They’re built on opposite business models and legal foundations, and everything else flows from that.
Gmail is a free product inside Google’s advertising and cloud ecosystem. It’s governed by Google’s general Privacy Policy rather than a Gmail-specific document, and Google’s stated approach is transparency about data collection combined with user controls. Google encrypts data in transit with TLS and at rest on its servers, but Google itself can access message content to run its services.
Proton Mail is a Swiss company that sells subscriptions. Its core design is zero-access encryption: messages and attachments are encrypted on the user’s device, and Proton states it cannot read stored content on its servers. Proton also publishes transparency reports showing how it handles government requests, which is a level of disclosure most free email providers don’t offer.
Neither company is lying. They’re just solving different problems. Google is building an intelligent assistant that happens to hold your mail. Proton is building a vault that happens to send mail.
How Encryption Actually Differs
This is where most comparisons get sloppy, so it’s worth being precise.
| Feature | Proton Mail | Gmail |
|---|---|---|
| Encryption in transit (TLS) | Yes | Yes |
| Encryption at rest | Yes, zero-access | Yes, but Google holds keys |
| End-to-end encryption for ordinary email | Only Proton-to-Proton | No |
| Provider can read stored messages | No (per Proton) | Yes, for service functions |
| Content scanning for ads | No | Stopped for consumer ads in 2017 |
| Jurisdiction | Switzerland | United States |
| Transparency report | Yes, published regularly | Limited provider-level detail |
The single most misunderstood row is end-to-end encryption. Proton Mail’s end-to-end encryption applies only when both sender and recipient use Proton. The moment you email a Gmail address, the message is protected in transit and at rest, but it is not end-to-end encrypted. That’s not a Proton flaw; it’s how email works. You cannot force encryption onto a recipient’s server that doesn’t support it.
This means the popular claim that “Proton Mail is encrypted, Gmail isn’t” is only half true. Both use TLS. The real difference is who holds the keys to stored mail, and whether the provider can read content at all.
What Google Actually Does With Your Email
The 2017 change was real, and it’s worth giving Google credit for it. Consumer Gmail no longer uses message content to target ads. If you’re still repeating the 2012-era warning that Gmail sells your email contents, you’re working from outdated information.
But “not used for ads” is not the same as “not processed.” Google’s own documentation describes automated systems that scan for malware and phishing, sort messages into categories, power Smart Reply and summary features, and detect abuse. Those are legitimate functions, and most users appreciate them. The privacy question is whether you’re comfortable with any human-adjacent access to content, governed by a US legal framework where subpoenas and national security requests are routine.
There’s also the broader ecosystem issue. Gmail doesn’t exist in isolation; it feeds into Google’s account-level data practices, which have drawn regulatory scrutiny repeatedly. Anyone who wants the full picture of how personal intelligence features and ad safeguards interact should read up on Google Gmail Photos AI data ad safeguards personal intelligence 2026, because the boundaries shift with each product launch.
The Jurisdiction Question Nobody Wants to Think About
Encryption is the headline. Jurisdiction is the fine print that actually decides cases.
Proton is based in Switzerland, outside both US and EU jurisdictions, and Swiss law governs what the company must hand over. Proton’s transparency reports show it receives relatively few requests and that Swiss authorities require a valid legal process. Because of zero-access encryption, even a compelled disclosure often yields little more than metadata.
Google is a US company subject to US legal process, including requests that can be sealed. It publishes transparency data at the company level, but the granularity is coarser than Proton’s. For a journalist, activist, or lawyer handling sensitive client material, that difference is not academic. For someone coordinating a family calendar, it may never matter at all.
The uncomfortable truth is that most people will never be targeted by a government request. But the people who are targeted rarely see it coming.
Usability: Where Gmail Still Wins Easily
A privacy comparison that ignores daily reality is useless. Gmail’s search, spam filtering, calendar integration, and mobile apps are genuinely excellent, refined over two decades. Its storage allowance dwarfs Proton’s free tier. If you run a business, Gmail’s ecosystem is hard to leave.
Proton Mail has improved dramatically. Its apps are polished, its search works, and its paid plans include custom domains, aliases, and a calendar. But free users get limited storage, and some conveniences require workarounds. Sending encrypted mail to non-Proton recipients involves password-protected messages, which is clever but adds friction.
Practical advice from people who’ve made the switch: don’t migrate everything at once. Forward your Gmail to Proton for a month, see what breaks, then move the accounts that matter. The most common mistake is a dramatic same-day migration followed by a panicked return when a banking verification email goes missing.
Metadata, Subject Lines, and Other Leaks
Even Proton’s model has limits, and honest comparisons should say so. Encryption protects the body of a message. It does not hide the fact that you emailed someone, when you did it, or how often. Metadata is the quiet leak in every email system, and intelligence agencies have historically found it more valuable than content.
Proton has progressively extended encryption to subject lines and calendar details for Proton-to-Proton communication, but a message to a Gmail address exposes more. If your threat model includes traffic analysis, email alone won’t save you. That’s why privacy-conscious users pair a hardened email account with a trustworthy tunnel; a guide to the best VPN services for privacy in 2026 is a sensible companion read, since it addresses the network layer that email never touches. (Privacy)
Password Managers and Account Security
Here’s a point that applies to both services equally: your inbox is the master key to your digital life. Password resets for banking, social media, and work accounts all land there. If an attacker gets into your email, they can take everything else.
That makes account security the foundation, not an afterthought. Strong unique passwords and two-factor authentication are non-negotiable on either platform. Hardware security keys are better still, and both Gmail and Proton support them. If you’re choosing a password manager to hold the credentials that protect your inbox, the comparison between 1Password vs Proton Pass is worth reading, and readers who prefer the reverse framing can look at Proton Pass vs 1Password instead. Budget-conscious users often ask about Bitwarden vs Proton Pass, which comes down to whether you value open-source auditing or ecosystem integration more. (Proton Mail)
The point is simple: switching to Proton Mail while reusing the same password everywhere is like installing a steel door and leaving the key under the mat.
Where Each Service Makes Sense
Choose Gmail if you want the best free email experience, you rely on Google’s ecosystem, your threat model is ordinary, and you’re comfortable with a US provider processing your data to run its services. Turn on two-factor authentication, review your security settings, and you’ll be reasonably well protected against criminals.
Choose Proton Mail if you handle sensitive material, you want a provider that structurally cannot read your stored mail, you prefer Swiss jurisdiction, or you simply object to advertising-funded infrastructure on principle. Pay for a plan; the free tier is a trial, not a lifestyle.
Consider both if you’re pragmatic. Many people keep a Gmail address for signups and shopping, and a Proton account for banking, legal, and personal correspondence. That’s not hypocrisy; it’s compartmentalization, and it works.
Common Mistakes People Make
The biggest error is assuming Proton Mail encrypts everything automatically. It doesn’t, and anyone who sends confidential material to a Gmail address from a Proton account has not achieved end-to-end encryption. Verify your recipient’s provider before assuming protection.
The second mistake is trusting a provider’s marketing over its documentation. Read the actual policy, not the homepage. If you want a grounding in the fundamentals first, this explainer on what internet privacy is and how you can protect it covers the concepts that make the policy language readable.
The third is neglect. A privacy-focused inbox with a recycled password and no second factor is less secure than a Gmail account with a hardware key. Configuration beats branding every time.
Conclusion
Proton Mail wins the privacy comparison on the dimensions that matter most: zero-access encryption, Swiss jurisdiction, and published transparency reporting. Gmail wins on usability, storage, and ecosystem depth, and its 2017 retreat from ad scanning was a genuine improvement. But Gmail’s model still requires Google to process your mail, and no setting changes that.
The right question isn’t “which is more private?” It’s “private from whom, and at what cost to my daily life?” For most people, the answer is a hybrid: Gmail for convenience, Proton for anything they’d mind a stranger reading. Whichever you choose, treat your inbox as the master key it is, lock it properly, and read the privacy policy of any provider before handing over your correspondence. That single habit will protect you more than any brand loyalty ever could.
Frequently Asked Questions
Does Proton Mail encrypt emails sent to Gmail addresses?
No. Proton Mail’s end-to-end encryption only applies when both sender and recipient use Proton. Messages sent to Gmail are protected in transit with TLS and at rest on Proton’s servers, but they are not end-to-end encrypted once they leave Proton’s infrastructure.
Does Gmail still scan emails for advertising?
Google stopped scanning consumer Gmail content for ad personalization in 2017. However, Google still processes message content through automated systems for spam filtering, malware detection, smart features, and abuse prevention. The scanning didn’t disappear; its purpose changed.
Can Google read my emails?
Yes, in principle. Google holds the encryption keys for data stored on its servers, which means it can access message content to operate its services or in response to valid legal process. This is a structural feature of how Gmail works, not a bug.
Is Proton Mail completely anonymous?
No. Proton Mail protects message content through encryption, but it still processes account metadata and payment information. Signing up with an anonymous method reduces the data linked to your account, but it does not make you invisible.
Which is safer for sensitive work documents?
Proton Mail is the stronger choice for sensitive material because stored messages are encrypted with keys Proton states it does not hold, and Swiss jurisdiction limits disclosure. That said, sending documents to a Gmail recipient removes end-to-end protection regardless of which service you use.
Can I use both Gmail and Proton Mail?
Yes, and many people do. A common approach is using Gmail for shopping, newsletters, and signups while keeping Proton for banking, legal matters, and personal correspondence. This compartmentalization limits exposure if one account is compromised.
