Editing Signal Data Collection (section)

===Signal's response===

Signal was not convinced to abandon this data collection and they began to roll out the change in 2020 without clear communication about the new feature.<ref>{{Cite web |title=Mandatory PIN without clear explanation within the app might cause significant number of users to quit using Signal |url=https://community.signalusers.org/t/mandatory-pin-without-clear-explanation-within-the-app-might-cause-significant-number-of-users-to-quit-using-signal/11597}}</ref><ref name=":6" /><ref name=":5" /><ref>{{Cite web |title=I don’t understand what the new PIN requirement is for |url=https://community.signalusers.org/t/i-don-t-understand-what-the-new-pin-requirement-is-for/13895}}</ref><ref name=":7" />{{DisputedInline|reason=tone|Tone is inappropriate}}{{DisputedInline|Misrepresents PIN feature as it is optional and not properly explained|reason=include the response to the hysteria and a proper explanation of the feature}} It resulted in a lot of confusion for users, many of whom only learned about this feature when they were prompted to create a PIN. There were many social media posts expressing confusion over what the feature was and what it was doing.<ref>{{Cite web |title=What contact info does the Signal PIN functionality actually save? |url=https://community.signalusers.org/t/what-contact-info-does-the-signal-pin-functionality-actually-save/16854}}</ref><ref>{{Cite web |title=Following user backlash, Signal lowers one of its drastic PIN measures |url=https://www.androidpolice.com/2020/05/29/many-signal-users-arent-happy-with-new-pin-requirements/}}</ref> <ref name=":6">{{Cite web |title=What exactly is Signal protecting with the mandatory PIN? |url=https://old.reddit.com/r/signal/comments/hymlfd/what_exactly_is_signal_protecting_with_the/}}</ref> Even years after the change was made some Signal users were/are still unsure about what data Signal collects or were/are convinced that Signal doesn't collect any data at all.<ref>{{Cite web |title=What info does Signal store about it's user? |url=https://old.reddit.com/r/signal/comments/q5tlg1/what_info_does_signal_store_about_its_user/ |archive-url=https://web.archive.org/web/20211011111619/https://old.reddit.com/r/signal/comments/q5tlg1/what_info_does_signal_store_about_its_user/ |archive-date=11 Oct 2021 |access-date=6 Mar 2025}}</ref><ref>{{Cite web |title=About data collection and data delivery |url=https://old.reddit.com/r/signal/comments/1id3xu8/about_data_collection_and_data_delivery/ |archive-url=https://web.archive.org/web/20250201072439/https://old.reddit.com/r/signal/comments/1id3xu8/about_data_collection_and_data_delivery/?ref=readnext |archive-date=1 Feb 2025 |access-date=6 Mar 2025}}</ref> 

This confusion is understandable,{{DisputedInline|reason=tone|Tone is inappropriate}} since Signal's own website continues to state that they do not collect the information they are collecting. The first line of their "Terms & Privacy Policy" page reads: "Signal is designed to never collect or store any sensitive information."<ref>{{Cite web |title=Signal Terms & Privacy Policy |url=https://signal.org/legal/ |archive-url=https://web.archive.org/web/20250302122622/https://signal.org/legal/ |archive-date=2 Mar 2025 |access-date=6 Mar 2025}}</ref>

This lie{{DisputedInline|reason=tone|Tone is inappropriate}} is also repeated on their support page under the heading: How do I know my communication is private<ref>{{Cite web |title=How do I know my communication is private? |url=https://support.signal.org/hc/en-us/articles/360007318911-How-do-I-know-my-communication-is-private |archive-url=https://web.archive.org/web/20250214030028/https://support.signal.org/hc/en-us/articles/360007318911-How-do-I-know-my-communication-is-private |archive-date=14 Feb 2025 |access-date=6 Mar 2025}}</ref>

There is no indication on Signal's older pages, which claim they don't collect this information, that the data collection policy discussed on those pages is now outdated either. Examples include: 

''"Signal is designed to never collect or store any sensitive information. " - https://support.signal.org/hc/en-us/articles/360007059412-Signal-and-the-General-Data-Protection-Regulation-GDPR''

''"The Signal service does not have any knowledge of your contacts. Data is all owned by your phone." - https://support.signal.org/hc/en-us/articles/360007061452-Does-Signal-send-my-number-to-my-contacts''

''"In addition to the end-to-end encryption that protects every Signal message, the Signal service is designed to minimize the data that is retained about Signal users. By design, it does not store a record of your contacts, social graph, conversation list, location, user avatar, user profile name, group memberships, group titles, or group avatars." - https://signal.org/blog/sealed-sender/''

''"Notably, things we don’t have stored include anything about a user’s contacts (such as the contacts themselves, a hash of the contacts, any other derivative contact information), anything about a user’s groups (such as how many groups a user is in, which groups a user is in, the membership lists of a user’s groups), or any records of who a user has been communicating with." - https://signal.org/bigbrother/eastern-virginia-grand-jury/''

''"Because we’ve built Signal to completely avoid storing any sensitive information...." - https://signal.org/blog/looking-back-as-the-world-moves-forward/''

''Requests have been mad''e for Signal to update their policy following the change in data collection.<ref>{{Cite web |title=Can Signal please update its Privacy Policy |url=https://community.signalusers.org/t/can-signal-please-update-its-privacy-policy/15323 |archive-url=https://web.archive.org/web/20230519120053/https://community.signalusers.org/t/can-signal-please-update-its-privacy-policy/15323 |archive-date=19 May 2023 |access-date=6 Mar 2025}}</ref><ref>{{Cite web |title=Signal’s Terms of Use and Privacy Policy are not very user friendly |url=https://community.signalusers.org/t/signals-terms-of-use-and-privacy-policy-are-not-very-user-friendly/11047 |archive-url=https://web.archive.org/web/20250306164621/https://community.signalusers.org/t/signals-terms-of-use-and-privacy-policy-are-not-very-user-friendly/11047 |archive-date=6 Mar 2025 |access-date=6 Mar 2025}}</ref>


'''Workarounds'''

While some social media posts and articles suggested that opting out of setting a pin would prevent a user's data from being uploaded to the cloud, this is not the case. <ref>{{Cite web |title=A few thoughts about Signal’s Secure Value Recovery |url=https://web.archive.org/web/20200712205333/https://blog.cryptographyengineering.com/2020/07/10/a-few-thoughts-about-signals-secure-value-recovery/}}</ref> When a Signal user sets a pin, their data is uploaded to the cloud and secured using SVR, however when a user chooses to "opt-out", a pin is automatically created for them instead, their data is encrypted and then uploaded to Signal's Storage Service. User who "opt-out" won't know the pin that was created for them, will not be able to use SVR to recover their profile and contact info on a new device, but the data is uploaded to the cloud regardless. There is currently no way for a Signal user to prevent their data from being uploaded and stored in the cloud.<ref name=":7">{{Cite web |title=PSA: Disabling PINs will now upload nothing to the server |url=https://old.reddit.com/r/signal/comments/htmzrr/psa_disabling_pins_will_now_upload_nothing_to_the/ |archive-url=https://web.archive.org/web/20230616082821/https://old.reddit.com/r/signal/comments/htmzrr/psa_disabling_pins_will_now_upload_nothing_to_the/ |archive-date=16 Jun 2023 |access-date=6 Mar 2025}}</ref>