Signal's data collection despite privacy-focused advertising

❗Article Status Notice: Inappropriate Tone/Word Usage

This article needs additional work to meet the wiki's Content Guidelines and be in line with our Mission Statement for comprehensive coverage of consumer protection issues. Specifically it uses wording throughout that is non-compliant with the Editorial guidelines of this wiki.

Learn more ▼

How You Can Help: If this is a non-Theme article (See: Article types):

• Persuasive language should not be used in the Wiki's voice. Avoid loaded words, or the causing of unnecessary offense, wherever possible.
• No direct attacks on named individuals or companies. Malice may be attributed to bad and proven offenders, but only through the use of quotation and citation - never in the Wiki's voice.

If this is a Theme article:

• Where argumentation is used make sure it is clear and direct but not inflammatory. Avoid strong language, or causing unnecessary offense.
• No direct attacks on named individuals or companies. Malice may be attributed to bad and proven offenders, in a formal and calm manner.

This notice will be removed once sufficient documentation has been added to establish the systemic nature of these issues. Once you believe the article is ready to have its notice removed, visit either the Moderator's noticeboard, or the Discord (join here) and post to the #appeals channel.

Signal is a privacy-focused, open source encrypted messaging service. In 2020, the company was accused of collecting and storing sensitive user data on their cloud database without user consent.

Background

Despite advertising that Signal can't "read your messages or listen to your calls, and no one else can either," the company has publicly disclosed that they have received legal requests for subscriber's names, telephone numbers, histories, and contacts. Their website states:

"We’ve designed the Signal service to minimize the data we retain about Signal users, so the only information we can produce in response to a request like this is the date and time a user registered with Signal and the last date of a user’s connectivity to the Signal service.

Notably, things we don’t have stored include anything about a user’s contacts (such as the contacts themselves, a hash of the contacts, any other derivative contact information), anything about a user’s groups (such as how many groups a user is in, which groups a user is in, the membership lists of a user’s groups), or any records of who a user has been communicating with."

Incident

In 2019, Signal previewed a feature called "secure value recovery" which would allow users installing the app on a new device to retrieve data from cloud servers. While the data is stored in Signal's cloud, it is stored in a securely encrypted manner. The data collected and stored includes the user's name, photo, phone number, and a list of each Signal user that had been contacted.^{[disputed contact discovery on Signal is private and does not share the phone number as explained later in the cited sources - discuss]} Messages are not saved, however.

Some users objected on philosophical grounds, requesting that Signal instead provide a means to export encrypted backups that could be imported locally which would eliminate dependence on cloud-based servers. Some users also raised technical concerns about the security of the system and doubt it could satisfyingly protect their data. Some of these concerns were also shared by cybersecurity experts, and security researchers demonstrated that the system was vulnerable to attacks which allowed them to access the user data being stored.^{[disputed "In recent weeks, Signal has introduced more features that make it more user friendly to people who may not have extremely paranoid threat models. For example, it’s now possible to migrate all Signal data, including message history, from one phone to another, using a feature that does not rely on cloud servers and is also encrypted, according to Signal. " - discuss]}

Signal's privacy policy remains unaltered from its latest version updated in 2018 and does not reflect the new cloud feature. As a consequence, consumers may not receive adequate clarification as to what data Signal collects.

Signal's response

Signal began to roll out the cloud-based recovery feature in 2020 without clear communication with the public or app users about the new feature. Signal users queried the need for the PIN, and communication from the team suggested it was to ensure messages were not missed or lost by keeping messages logged in a cloud format. A more detailed response from Signal following user backlash explains that cloud backups were encrypted in the same way as messages, and were safe; however, this response was not published prior to the initial rollout.

It resulted in a lot of confusion for users, many of whom only learned about this feature when they were prompted to create a PIN. Years after the feature was implemented, some Signal users are still unsure what data Signal collects or they are convinced that Signal doesn't collect any data at all.

Requests have been made for Signal to update their policy following the change in data collection.

Alternative measures

While some social media posts and articles suggest that opting out of setting a pin would prevent a user's data from being uploaded to the cloud, this has not been proven to be the case. When a user sets a pin, their data is uploaded to the cloud and secured using SVR, and when they choose to opt-out, a pin is created for them anyway and their data is uploaded to Signal's cloud. There is currently no way for a Signal user to prevent their data from being uploaded and stored in the cloud.