signal.org privacy policy — score 72/100 (medium risk)
Senast analyserad
Rapportinnehållet (sammanfattning, fynd, citat) genererades på engelska och är inte lokaliserat.
Signal Messenger LLC · signal.org
Rapportdetaljer
medium riskSignal genuinely collects almost nothing and encrypts everything, but its legal documentation is outdated and missing critical GDPR-mandated disclosures like transfer safeguards, retention periods, and user rights procedures.
Signal's architecture and data practices are among the most privacy-friendly in the industry—end-to-end encryption by default, no data monetization, and minimal collection. However, the privacy policy has not been updated since May 2018 and lacks formal GDPR compliance elements: no description of data subject rights, no legal bases for processing, no retention periods, no DPO contact, and no mention of appropriate safeguards for US transfers. The mandatory California jurisdiction clause is also problematic for EU consumers.
Bedömning per kategori
Uppdelning av policyn över viktiga efterlevnadsområden. Bra = stark, rimlig = blandad, dålig = oroande.
Only the phone number is mandatory; profile data is optional and end-to-end encrypted; technical metadata is limited to the minimum required to operate the service.
The policy is clear about encryption and what is collected, but lacks retention periods, legal bases for processing, and has not been updated since May 2018.
Sharing is limited to verification code providers and optional third-party services like Giphy, but no subprocessor list is provided and no contractual safeguards are described.
Data is explicitly transferred to the US and other countries, but no GDPR-compliant transfer mechanism (SCCs, adequacy decision, BCRs) is mentioned anywhere in the policy.
The policy is silent on AI training, but Signal's firm no-monetization stance and minimal data collection make it unlikely; however, it is not explicitly prohibited.
No explicit description of GDPR rights (access, rectification, deletion, portability, objection, restriction); only a vague reference to managing info in app settings.
Viktiga fynd
Anmärkningsvärda klausuler, problem eller positiva rutiner (kritiska först)
No GDPR transfer safeguards for US data flows
The Terms state users agree to 'the transfer of your encrypted information and metadata to the United States and other countries where we have or use facilities, service providers or partners,' but the policy mentions no Standard Contractual Clauses, adequacy decisions, or Binding Corporate Rules. Post-Schrems II, this is a significant compliance gap for EU users.
GDPR data subject rights are not described
The privacy policy does not enumerate or explain any GDPR rights (Articles 15–22): no right of access, rectification, erasure, restriction, portability, or objection. The only mention is that users can 'manage your personal information in Signal's application Settings,' which is insufficient under GDPR Article 13(2)(b).
No data retention periods specified
The policy states that support data is 'kept only for the purposes of researching the issue' and that technical information is 'limited to the minimum required,' but no specific retention periods are provided for any data category, as required by GDPR Article 13(2)(a).
Mandatory US jurisdiction clause conflicts with EU consumer rights
The Terms require disputes to be resolved exclusively in 'the United States District Court for the Northern District of California or a state court in San Mateo County, California,' which may be unenforceable against EU consumers under the Brussels I Regulation and is inconsistent with GDPR Article 79(2).
Privacy policy outdated — last updated May 2018
The privacy policy has not been updated since May 25, 2018, raising questions about whether it reflects current data practices, third-party relationships, and regulatory requirements that have evolved since then.
No legal basis for processing specified
The policy does not identify the legal basis under GDPR Article 6 for any processing activity (e.g., contract performance for account registration, legitimate interest for security), as required by GDPR Article 13(1)(c).
Third-party providers lack contractual detail
The policy mentions 'Third-Party Providers' that send verification codes and states they 'are bound by their Privacy Policies to safeguard that information,' but does not name them, describe contractual safeguards, or provide a subprocessor list as expected under GDPR accountability principles.
Strong no-monetization commitment
The Terms explicitly state: 'Signal does not sell, rent or monetize your personal data or content in any way – ever.' This is a strong, unqualified commitment that goes beyond typical industry language.
Sammanfattning för användaren
Your messages and calls are genuinely private and encrypted, but if you need to exercise GDPR rights or want clarity on how your data moves to the US, the policy leaves you without clear answers.
Efterlevnadsställning
Strong on technical privacy, weak on legal documentation. The substance is excellent but the formal GDPR compliance framework is incomplete.
EU-överföringar
The Terms explicitly acknowledge transfers to the US and other countries but mention no GDPR transfer mechanism (SCCs, adequacy decision, or BCRs). This is a significant compliance gap post-Schrems II.
Upptäckta signaler
Specifika datapunkter och rutiner identifierade i texten
Bevisutdrag
Direkta citat från policyn som stödjer dessa fynd
Signal does not sell, rent or monetize your personal data or content in any way – ever.
you agree to our data practices as described in our Privacy Policy, as well as the transfer of your encrypted information and metadata to the United States and other countries where we have or use facilities, service providers or partners.
You can manage your personal information in Signal's application Settings. For example, you can update your profile information or choose to enable additional privacy features like a Registration Lock PIN.
Signal limits this additional technical information to the minimum required to operate the Services.
You agree to resolve any Claim you have with us relating to or arising out of our Terms, us, or our Services exclusively in the United States District Court for the Northern District of California or a state court in San Mateo County, California.
These providers are bound by their Privacy Policies to safeguard that information.
Saknas eller otydligt
- No GDPR legal bases for processing
- No data retention periods
- No subprocessor list
- No DPO contact information
- No GDPR transfer mechanism (SCCs, adequacy, BCRs)
- No explicit AI/model training policy
- No cookie or tracking technology disclosure
- No DPIA references
- No data breach notification procedure
- No explicit GDPR rights enumeration
Frågor att ställa
- What Standard Contractual Clauses or other transfer mechanisms does Signal rely on for EU-to-US data transfers, and can you provide the relevant documentation?
- What are the specific retention periods for each category of data you collect (phone numbers, technical metadata, support data)?
- Who are the 'Third-Party Providers' that process verification codes, and what contractual data protection obligations do they have beyond their own privacy policies?
- How can an EU user exercise their GDPR rights (access, erasure, portability, objection) — is there a dedicated process or contact beyond the general privacy@signal.org email?
- Has Signal conducted a Data Protection Impact Assessment for its contact discovery feature, given that it involves hashing and transmitting address book data?
- Why has the privacy policy not been updated since May 2018, and does it accurately reflect all current data processing activities and third-party relationships?
Dela den här analysen
Alla med den här länken kan se resultatet ovan.
Byggd av DentroChat
100 % europeisk AI-chatt för alla
Chatta med AI, arbeta med filer, generera bilder och sök på webben. Data stannar i Europa.