Updated July 2026. The argument “Apple aliases are like SimpleLogin” has gone bust. Researcher Tyler Murphy showed back in June 2025 that you can trace the real address behind a Hide My Email alias. Apple claimed to fix it in March 2026: false. Public disclosure on July 1st (404 Media, picked up by 9to5Mac and MacRumors), the bug still holds, all tested aliases are traceable. A Hide My Email alias doesn’t protect you from someone who really wants to know. A Proton Pass or SimpleLogin alias, hosted outside the ecosystem that’s tracking you, yes.

Updated May 2026. Proton Mail now offers post-quantum encryption for new emails, on all plans including free. Strong differentiating argument vs Apple Mail (PQ3 iMessage silo only) and Gmail (zero). Details in the radar.

You’re on a Mac. You’ve probably been using Apple Mail for years without asking too many questions, or you switched to Gmail because “it’s convenient.” Maybe you’ve heard of Proton Mail and you’re wondering if it’s really worth migrating.

In reality, the question is wrong. These aren’t three competing email clients. They’re three different contracts, with your device, your provider, and your data.

Apple Mail is a client. Gmail is a service (and a data collection ecosystem). Proton Mail is a architectural promise. Understanding the difference is 80% of the decision.

The Three Approaches

Apple Mail + iCloud Mail: Apple makes the client, hosts your emails if you use iCloud Mail. Perfect native integration on Mac and iPhone. Mail Privacy Protection blocks tracking pixels. But iCloud Mail isn’t end-to-end encrypted, Apple can technically access it, and the servers are partly in the US.

Gmail: free service funded by a ad network that’s still over 73% of Alphabet’s revenue (2025). Email isn’t the product, your public profile is. Very powerful, very smooth, US jurisdiction with all that implies.

Proton Mail: fundamentally different contract. Encryption keys are generated on your device. Proton stores your encrypted emails but can’t read them. Swiss jurisdiction, outside 5/9/14 Eyes. Not a marketing promise, real security by architectural constraint.

Apple Mail (+ iCloud Mail)

What You Get

Perfect integration into the Apple ecosystem. Apple Mail natively syncs with your contacts, calendar, Siri, Handoff, Focus Modes. On Mac, it’s smooth. On iPhone, it’s the reference.

Mail Privacy Protection (iOS 15+, macOS Monterey+) masks your IP address from senders and preloads images in the background, so senders see “email opened” but don’t know when or where. Real protection against tracking pixels, on by default since iOS 15.

For iCloud Mail, Apple uses the Secure Enclave on your devices to protect access keys. Emails in transit are encrypted. Apple also introduced Advanced Data Protection for iCloud (opt-in), which extends end-to-end encryption to many iCloud data categories, but not emails, contacts, and calendars for interoperability reasons.

Honest Limitations

iCloud Mail isn’t end-to-end encrypted. Apple can technically access your email content if legally compelled, and the iCloud servers are partly hosted by AWS and Google Cloud, ironically. Apple is subject to US law, National Security Letters, and the CLOUD Act.

Dependence on the ecosystem is real: Apple Mail is excellent if you stay within the Apple world. Connecting a third-party client or automating workflows is more laborious than with Gmail. Advanced features (filters, aliases, multi-domain management) are still limited compared to Gmail or Proton.

Concrete Action

Turn on Mail Privacy Protection: Settings > Mail > Privacy Protection > Hide Mail Activity.

Read: Securing Your Emails for full settings (plain text, block remote content, Bridge configuration).

Gmail: The Service That Knows Everything About You

The Business Model, Clearly

Google is the largest ad network in history. Gmail is free because it funds this ad network, not because Google is philanthropic.

In practice, Google analyzes your emails to:

• Extract intent signals (running purchase confirmation, sports equipment targeting)
• Feed your Google Ads profile (inferred interests, estimated income, family situation)
• Cross with your Search, YouTube, Maps, and Chrome data

Google officially stopped scanning for direct ad targeting in 2017, a voluntary decision to reassure enterprise clients (G Suite). Google already had enough targeting data without needing to read your emails. Metadata is still analyzed: who’s writing to you, when, how often, from which services.

US Jurisdiction: The Legal Problem

• CLOUD Act (2018): US authorities can compel Google to hand over data stored abroad, including for European citizens, without going through international judicial cooperation
• National Security Letters: secret orders, no prior judicial review, with a gag order preventing you from being informed
• 5 Eyes: the US participates in the most integrated surveillance alliance in the world

The GDPR applies to Google in Europe in principle. In practice, US-EU data transfers are in permanent legal dispute, and the CJEU has invalidated successive EU-US data transfer frameworks: Safe Harbor in 2015 (Schrems I) and Privacy Shield in 2020 (Schrems II).

Proton Mail: The Different Contract

What End-to-End Encryption Really Changes

Encryption keys are generated on your device, not on Proton’s servers. Proton stores your encrypted emails but can’t read them. Even under judicial compulsion, they can only hand over unreadable text.

What this changes:

• Emails between Proton users are only readable by you and the recipient
• Proton can’t analyze your content, it simply can’t read it
• In case of a server breach, stolen data is encrypted and unusable

What this doesn’t change:

• Emails to non-Proton accounts (Gmail, Outlook…) are transit-encrypted but readable on the recipient’s side
• Metadata (sender, recipient, timestamp) remains partially accessible
• Proton sees when you log in, from which IP address (unless you combine with Proton VPN)
• Full-text search is constrained: Proton can’t index what it can’t read. On desktop with Proton Bridge (paid plans), the index is local and improves. On mobile, it’s significantly less powerful than Gmail.
• Proton Bridge + Apple Mail: if you’re on a Mac, the Bridge (paid plan) + Apple Mail combination works very well, you keep the native Apple interface with Proton’s encryption underneath. Probably the best of both worlds for a Mac user.

Read: Complete Bridge + Apple Mail Configuration

Swiss Jurisdiction: The Structural Advantage

Proton is headquartered in Geneva. Switzerland is neither in the EU nor in the 5/9/14 Eyes alliances. A foreign access request must go through Swiss diplomatic channels, under control of a Swiss judge. Proton publishes an annual transparency report.

Gmail and iCloud Mail = US = 5 Eyes. Your provider can be legally compelled, secretly, to monitor your account and transmit data to other alliance countries without informing you.

Proton Mail = Switzerland = outside 14 Eyes. Any access request goes through Swiss diplomatic channels, under judicial control. Longer, more transparent, structurally more protective.

Read: Consult the Glossary for the full detail of the 5/9/14 Eyes alliances and the CLOUD Act.

Plain Text, HTML, and Surveillance: The Layer the Comparison Doesn’t Cover

Choosing the right email service is good. Understanding what happens in your inbox before you even read a message is better.

Tracking pixels, HTML/CSS exploits, fingerprinting by formatting: these surveillance vectors work independently of the service you use. Gmail, Proton, or Apple Mail, if you don’t have the right settings, you’re exposed.

Read: Securing Your Emails: What End-to-End Encryption Doesn’t Do Alone

CNIL 14/04: Tracking Pixels Now Regulated

On April 14, 2026, the CNIL adopted its recommendation on tracking pixels in emails. In short: a pixel used to profile, measure, or target you with ads requires your explicit consent. Transactional emails, order confirmations, security alerts, password resets are exempt. Three months to comply, mid-July 2026, then inspections begin.

In practice, who’s already in compliance by default?

Proton Mail blocks tracking pixels server-side before even delivering the email. Always aligned.

Apple Mail with Mail Privacy Protection masks your IP and proxies images via Apple’s servers. Pixels don’t know when you open or where. Active by default since iOS 15.

Gmail lets them through. Google loads images via its own proxy, masking your IP from the sender, but not blocking pixel triggering. Google knows you opened it. The sender too. Google’s compliance needs revisiting, especially for its European Workspace clients broadcasting campaigns without proper consent.

Read: Securing Your Emails: The Full Chapter on the CNIL Recommendation

The Honest Comparison

Apple Mail Free (5GB iCloud), iCloud+ from €0.99/month. Not end-to-end encrypted, Apple can technically read your emails. US jurisdiction, 5 Eyes. Not open source. Native Mac/iOS app excellent, local search solid, Apple ecosystem integration top. No native aliases. Decent privacy.

Gmail Free (15GB), Workspace from around €7/month. Not end-to-end encrypted, Google actively analyzes your emails. US jurisdiction, 5 Eyes. Not open source. Mature iOS + Android apps, excellent search, many integrations. No native aliases. Poor privacy.

Proton Mail Free (1GB), Plus from €3.99/month (annual). End-to-end encrypted, no one reads your emails (keys with you). Swiss jurisdiction, outside 14 Eyes. Open source (clients + crypto). Mature iOS + Android apps, native desktop app free. Limited search (local only). SimpleLogin aliases included from Unlimited. High privacy.

Alternatives to Know

If you want to explore other options without staying in this trio, two names deserve your attention.

Infomaniak K-Mail: Swiss hoster, real European sovereignty, good option for SMEs wanting to leave Google without depending on an American startup. No native end-to-end encryption, but solid jurisdiction.

Tuta (ex-Tutanota): End-to-end encrypted, open source, German jurisdiction (14 Eyes, note). Similar approach to Proton but lighter ecosystem. Consider if you want a Proton alternative.

Conclusion

Staying in the Apple ecosystem: Apple Mail is the rational choice. Turn on Mail Privacy Protection, go plain text, and be aware that iCloud Mail isn’t end-to-end encrypted. Consider Proton Mail for very sensitive emails.

In Google’s orbit: if you use Google Docs, Calendar, Drive, Meet daily, migrating just your email to Proton doesn’t significantly reduce your Google data surface. The question is broader. Proton Mail is a good first step, not a complete solution on its own.

Wanting to leave: Proton Mail is the most coherent choice. Free plan to test seriously. Plus plan at €3.99/month for a truly replacing Gmail use: that’s the minimum viable. Proton’s desktop and mobile clients are solid and independent. If you prefer to stay in Apple Mail, Bridge (included in the Plus plan) lets you use the native interface with Proton’s encryption underneath.

Realistic strategy: start with sensitive uses (banking, health, administrative services), gradually migrate over six months. Not in a weekend.

Try Proton Mail

You manage a team? The question of complete suites (Google Workspace, Microsoft 365, sovereign alternatives) deserves its own article, coming soon.

Technical terms? Consult the Glossary.