Yahoo and AOL are reportedly scanning emails for data to sell to advertisers

Yahoo is scanning people's email for information to sell to advertisers, according to a report in The Wall Street Journal.

The tech giant scans more than 200 million Yahoo Mail inboxes for information about what people have bought, such as receipts from department stores or automotive loan companies, the Journal reported Tuesday. Executives at Yahoo, which was bought by Verizon in June 2017 and placed under its Oath umbrella, have been pitching interest-based advertising to marketers.

Yahoo puts emails into different categories; for example if someone receives a flight confirmation, they might be put into a "frequent traveler" group. That person might then see advertising for hotel chains that might appear on other websites. AOL, also owned by Oath, scans emails in this way as well, the Journal's report said. Data are aggregated and anonymized, so advertisers wouldn't have access to an individual's information.

This type of scanning only applies to emails from organizations and not personal messages, according to Oath's vice president of data, measurements and insights, Doug Sharp, who told the Journal that Yahoo's research shows people prefer personalized advertising. "Email is an expensive system," he added. "I think it's reasonable and ethical to expect the 'value exchange,' if you've got this mail service and there is advertising going on."

Oath's privacy pages explain that the company makes "educated guesses" about people's interests based on their activity on its sites and apps (it also owns Huffington Post and TechCrunch), and provides ads relevant to what appears online. "Oath's automated systems may analyze all content (such as Mail and Messenger content including instant messages and SMS messages) to detect, among other things, certain words and phrases," the company states.

An Oath spokesperson gave CNBC the following statement Wednesday:

"Putting consumers in the driver's seat when it comes to their data and building safeguards to protect that data is our top priority. Interest-based advertising around Yahoo Mail does not use personally identifiable information and is developed algorithmically using only commercial emails, never personal emails. Yahoo Mail users have always had the ability to opt out of this process. In fact, we made it easier for all our users to manage their options with a privacy dashboard when we relaunched our policies in April 2018."

Personalized advertising is nothing new. AT&T, for example, is set to develop a new ad platform that will sell highly targeted advertising on TV content, based on household data, a model known as "addressable advertising." But at the same time, tech companies have had to change how they handle personal data because of Europe's General Data Protection Regulation (GDPR). Facebook removed Partner Categories, an ad option that allowed companies to use third-party data to find customers, ahead of GDPR's introduction in May. Oath emailed Yahoo Mail users in April 2018 with an update to its terms of service, ahead of GDPR.

Previously, Google announced in June 2017 that it would no longer scan Gmail messages for ad personalization because of users' privacy concerns.

Oath's privacy center states people can opt out of interest-based ads, and links to its privacy controls page can be found within Yahoo Mail and other Oath sites.

— CNBC's Michelle Castillo contributed to this report.