3. 2. 1. Contact. The API has landed
Have you ever been on a web-site that asked you for your Google username and password so that it can import your Gmail contact list? Did you think twice before giving out that information, hoping the web-site would not use it to access …
Context & Ripple Effects
For months before this launch, analysts argued that email and cellphone contacts — not profile pages — were the real social graph, and Google's own ecosystem was already probing the question: a December 2007 piece asked who actually counts as a Gmail contact. The gap was practical: any site wanting to import a Gmail address book had to ask users to type their Google username and password directly into a form, with no way to scope what the site could do afterwards.
The new Contacts Data API closes that hole by letting third-party sites request contact data through Google rather than through the user's raw credentials. It matters because it converts a trust problem — 'will this site abuse my login?' — into a permissions problem Google itself mediates, and because whoever controls sanctioned access to the address book controls a key input to every social feature built on top of email.
First-order effects
- Developers building contact-import features get a legitimate path to Gmail address books today, ending the practice of harvesting Google usernames and passwords from their own users.
- Users importing their Gmail contacts into third-party sites no longer have to surrender full account credentials to do it — the exposure risk Google's announcement explicitly calls out disappears for sites adopting the API.
Second-order effects
- Every site that previously justified its password prompt as 'the only way' now looks careless by comparison, pushing contact-import flows across the industry toward delegated access rather than shared logins.
- Rival webmail operators face the same demand: if Gmail's address book is programmatically accessible and theirs is not, application developers will prioritize the platform that opens first.
Third-order effects
- If each major mail provider follows with its own contacts interface, the email address book hardens from a private file into interoperable social infrastructure — the outcome the December 2007 social-graph argument pointed at.
- Delegated, scoped access replacing credential sharing sets a template for how all sensitive account data gets exposed to third parties, making the API layer — not the password — the security boundary.
The trend: Webmail platforms are converting address books from locked-in files into API-accessible social-graph infrastructure, replacing credential sharing with provider-mediated permission.