Analysis of publicly available corporate filings, patent applications, and leaked internal documents confirms that major email providers operate pervasive content scanning infrastructure across all user communications. This is not metadata collection. This is full-content interception at scale.

• Content Scanning: Every inbound and outbound message is parsed by machine learning classifiers. Attachments are opened, OCR'd, and indexed.
• Behavioral Profiling: Send patterns, recipient graphs, and response times are fed into advertising models. Your email habits are a product.
• Third-Party Data Sharing: Aggregated email intelligence is shared with XXXXXXXX advertising partners and data brokers under broad ToS clauses.
• Government Access: FISA Section 702 compels providers to grant bulk access without individual warrants. Over 200,000 targets annually.
• Retention: Deleted messages are retained in backend systems for up to 180 days after user deletion. Some providers retain indefinitely for "safety."

Your domain's MX record is the single point of control for all email routing. When your MX points to a Big Tech provider, every message — sent or received — transits their infrastructure. They hold the keys. They read the mail. They build the profile.

Even if you encrypt with PGP or S/MIME, metadata is fully exposed: who you talk to, when, how often, and from where. Metadata alone is sufficient for comprehensive surveillance. Former NSA Director Michael Hayden confirmed: "We kill people based on metadata."

• CRITICAL: Any organization routing mail through Google, Microsoft, or Yahoo has zero email privacy. Period.
• CRITICAL: Free email services are funded by advertising. You are the product. Your mail is the raw material.
• HIGH: Even paid Google Workspace and Microsoft 365 accounts are subject to the same scanning infrastructure.
• HIGH: U.S.-based providers are subject to National Security Letters with gag orders — they cannot tell you when your data is accessed.

• Route MX records through infrastructure you control or a provider with zero-access architecture
• Deploy DANE/TLSA records to cryptographically bind your mail server's TLS certificate to DNS
• Implement MTA-STS to enforce TLS and prevent downgrade attacks
• Use DNSSEC to prevent DNS poisoning of your MX records
• Choose a provider in a jurisdiction with strong privacy laws outside Five Eyes intelligence sharing
• Demand end-to-end encryption at the transport layer — not just at rest

This briefing is compiled from publicly available sources including: SEC filings, published patent applications (US Patent Office), EFF research, ODNI transparency reports, and provider Terms of Service agreements. Nothing here is secret. That's the problem — it's all happening in plain sight.