diff --git a/ChangeLog.md b/ChangeLog.md
--- a/ChangeLog.md
+++ b/ChangeLog.md
@@ -1,3 +1,7 @@
+## 1.4.8
+
+* GoogleEmail2: proper error message when permission denied
+
 ## 1.4.7
 
 * add a runHttpRequest function for handling HTTP errors
diff --git a/Yesod/Auth/GoogleEmail2.hs b/Yesod/Auth/GoogleEmail2.hs
--- a/Yesod/Auth/GoogleEmail2.hs
+++ b/Yesod/Auth/GoogleEmail2.hs
@@ -50,14 +50,17 @@
 import           Yesod.Auth               (Auth, AuthPlugin (AuthPlugin),
                                            AuthRoute, Creds (Creds),
                                            Route (PluginR), YesodAuth,
-                                           runHttpRequest, setCredsRedirect)
+                                           runHttpRequest, setCredsRedirect,
+                                           logoutDest)
 import qualified Yesod.Auth.Message       as Msg
 import           Yesod.Core               (HandlerSite, HandlerT, MonadHandler,
                                            TypedContent, getRouteToParent,
                                            getUrlRender, invalidArgs,
                                            lift, liftIO, lookupGetParam,
                                            lookupSession, notFound, redirect,
-                                           setSession, whamlet, (.:))
+                                           setSession, whamlet, (.:),
+                                           setMessage, getYesod, authRoute,
+                                           toHtml)
 
 
 import           Blaze.ByteString.Builder (fromByteString, toByteString)
@@ -187,7 +190,18 @@
         mcode <- lookupGetParam "code"
         code <-
             case mcode of
-                Nothing -> invalidArgs ["Missing code paramter"]
+                Nothing -> do
+                    merr <- lookupGetParam "error"
+                    case merr of
+                        Nothing -> invalidArgs ["Missing code paramter"]
+                        Just err -> do
+                            master <- lift getYesod
+                            let msg =
+                                    case err of
+                                        "access_denied" -> "Access denied"
+                                        _ -> "Unknown error occurred: " `T.append` err
+                            setMessage $ toHtml msg
+                            lift $ redirect $ logoutDest master
                 Just c -> return c
 
         render <- getUrlRender
diff --git a/yesod-auth.cabal b/yesod-auth.cabal
--- a/yesod-auth.cabal
+++ b/yesod-auth.cabal
@@ -1,5 +1,5 @@
 name:            yesod-auth
-version:         1.4.7
+version:         1.4.8
 license:         MIT
 license-file:    LICENSE
 author:          Michael Snoyman, Patrick Brisbin