> Are these permissions strictly enforced?

Yes, each of those items corresponds to an OAuth scope. If you try to make an API call for data that isn't covered by the OAuth scopes you have access to, you'll just get an error.

Developers can add broader OAuth scopes to their apps at any point, but if they do then all their users will need to re-authenticate and will see that the app now requires additional permissions.

C.f.: https://developers.google.com/gmail/add-ons/concepts/scopes

No. For this app to get access to your email you would have to click through a prompt saying "this app can read all of your email". The profile, email, and OpenID scopes are just profile info. Still sometimes more info than is needed by the relying party (you don't really need to know my gender), but tightly scoped and enforced by any OAuth provider.

Permissions are strictly enforced and third party developers can't read your emails with the ones you mentioned.

I'm pretty sure this is strongly enforced, and it's unfair that the article doesn't highlight this.

The apps that require permission to read your email and ask for it. They generally provide services like

- Act as a desktop mail client

- Backup your SMS messages to Gmail

- Search your email for forgotten registrations and allow you to cancel

Ideally it should be clear from the context that the app requires this permission. But the problems that plague mobile app and browser extension permission systems exist here as well. The stakes may even be higher.