Google has expanded end-to-end encryption for Gmail on Android and iPhone devices through the official Gmail app. This feature was previously available to desktop users within Workspace and is now accessible on mobile devices with the same approach.

Currently, access is restricted to organizations using Google Workspace Enterprise Plus, and these organizations must have either the Assured Controls or Assured Controls Plus add-ons. Administrators must enable client-side encryption on Android and iOS devices before users can start using this feature.

How Gmail's Mobile End-to-End Encryption Works

When both the sender and recipient are using the Gmail app with end-to-end encryption enabled, encrypted messages appear as normal email threads. Users can send an encrypted message by tapping the lock icon in the compose window and selecting the extra encryption option.

Recipients who do not use the Gmail client are redirected to a secure web page to read and respond to the message. Attachments are also protected by encryption. Administrators are responsible for enabling client-side encryption at the organizational level. Individual users do not need to acquire, configure, or change security certificates.

How This Differs from S/MIME

Traditional enterprise email encryption is often based on S/MIME, which requires issuing a certificate to each user and modifying encrypted messages before they are sent. Google's approach eliminates this need for Gmail-to-Gmail communication, simplifying the setup process for both users and IT teams.

However, this process is not entirely seamless for all recipients. Those outside the Gmail app still have to use a browser to access encrypted messages. For Gmail users, the only step after the administrator enables the feature is to toggle the encryption option on or off.

Compliance and Data Protection Context

End-to-end encryption in Gmail is particularly important for organizations subject to data protection regulations like GDPR. These regulations dictate how sensitive information should be processed and transmitted. In some regions, there are also data sovereignty laws that restrict where certain data can be stored or sent. Using E2EE helps reduce the risk of data interception during transmission, which can affect compliance with these regulations.

Google has not provided a timeline for expanding Gmail E2EE access beyond Google Workspace Enterprise Plus or for offering it to individual Google accounts.