Permission to read Gmail is more consequential than sharing a name and profile picture for sign-in. Review who is asking, what data and actions are requested, and whether the access is necessary for the feature you want.
Distinguish identity from mailbox access
Basic Sign in with Google can share profile information to identify you to an app. An additional request for Gmail data is a separate authorization.
Read the actual permission wording. Viewing or copying data differs from managing data, which can include creating, changing, or deleting information where authorized. Do not infer the scope from a button labeled Connect Gmail.
Evaluate the provider and purpose
- Is this the developer and website you intended to use?
- Does the requested access match the feature?
- Does the privacy policy explain use, retention, sharing, and deletion?
- Can you use a narrower feature or decline optional access?
- For organization mail, has the administrator approved the connection?
Mailbox access can expose sensitive correspondence and account-recovery messages. Consider the information in the mailbox, not only the convenience of the proposed feature.
Approve through the legitimate Google flow
Select the correct account and review the consent screen before confirming. Google says not to share your Google password directly with the third-party app as a substitute for controlled permission.
Google’s checks and an app’s verification status are useful information, but they do not replace your assessment of whether the requested access is appropriate.
Review and remove access later
Use the Google Account’s linked-app settings to inspect the provider’s access and remove it when no longer needed. Where access has a limited duration, inspect the expiry and extension request rather than assuming it lasts forever.
Removing access stops that future access relationship. The provider may still hold data it already copied, so use its separate deletion process if necessary.
If the request is unexpected
Cancel it and investigate through the app’s known website or your administrator. Do not approve in response to an unsolicited caller, an unexplained email, or a promise that consent is needed to cancel a hack.
If you already approved an unauthorized app, remove its access and review account security promptly. Keep a private record of the provider and permission without sharing mailbox contents publicly.
Browse Gmail & Google Account help
References
- Share some access to your Google Account data with apps from other developers
- How Google helps you share some of your account data with apps from other developers safely
- Manage links between your Google Account & apps from other developers
Reviewed against the linked official and developer guidance on October 27, 2026. Available options and screen labels can vary by account, device, region, and organization policy.