Fiat Lux
UC Berkeley - where it all started
Let There Be Light

Most people assume the privacy battle is already lost.

It's not.

Your email provider holds the keys to your inbox.

Your carrier keeps years of records on where your phone has been.

Your data is sold by companies you have never heard of.

Governments keep pushing to weaken the encryption that could stop it.

Orion Private is a one-person privacy practice.
I find what's exposed about you and help you fix what matters, at a pace you can live with.

Research & Analysis

Privacy Research

Privacy research and investigative reporting on encryption, jurisdiction, and the surveillance economy that operates between them. Written by David for Orion Private LLC.

11 reports published · Actively maintained · New research in progress
Featured
Field Assessment

What California's new deletion tool removes, and what it leaves behind

Since August, every registered data broker has had to delete the Californians who file one request, and keep deleting them every 45 days. It is the most powerful deletion tool any state has built. It does not reach public records, credit bureaus, or the companies you use every day.

Data BrokersPrivacy LawCalifornia
October 2026 · 13 minRead
Analysis

Why privacy matters, even when you have nothing to hide

The "nothing to hide" argument assumes privacy is about covering up wrongdoing. The people in this piece weren't hiding anything. Their location data made them suspects, and their home addresses were a search away. This is the piece that explains why everything else on this site matters.

Data BrokersLocation DataThird-Party DoctrinePrivacy Law
April 2026 · 16 minRead
Analysis

The government is buying your data because it cannot legally collect it

Federal agencies have bought Americans' phone locations, internet records and flight data from brokers, with no warrant. A gap in the law makes it legal, and in 2026 Congress let its latest chance to close it pass.

Data BrokersLocation DataFourth Amendment
March 2026 · 16 minRead
All research
Analysis

What happens when everything is evidence?

The Fourth Amendment names four things. Persons, houses, papers, effects. Andrew Guthrie Ferguson sorts what our devices record into six arenas of life, and two of them, the watched city and the record of your mind, appear nowhere in that list. That gap is where the law protects you least.

Fourth AmendmentThird-Party DoctrineLaw Enforcement Access
June 2026 · 26 minRead
Analysis

The FTC was never enough: How America's de facto privacy regulator was structurally outmatched long before it lost its independence

For two decades the FTC's consent orders were the closest thing Americans had to enforceable privacy law. In 2025 the President fired its Democratic commissioners, and in 2026 the Supreme Court said he could. The limits that mattered most were there from the start.

FTCPrivacy LawEnforcement
April 2026 · 31 minRead
Technical Brief

Encryption wouldn't have saved the FBI director's Gmail

An Iranian state-linked group published more than 300 emails and photos from FBI Director Kash Patel's personal Gmail. Nothing was decrypted. What exposed him was an old password and a decade of email, and encryption fixes neither.

Account SecurityData BreachesEmail
March 2026 · 7 min Read
Field Assessment

What your notes app knows about you, even when your notes are encrypted

End-to-end encryption protects your note content. It does not protect the metadata your notes generate.

Notes AppsMetadataEncryption
January 2026 · 10 minRead
Field Assessment

Proton Mail vs Tuta Mail: What a privacy advocate looks at

Both encrypt your inbox. But jurisdiction, metadata exposure, encryption scope, and real-world court orders tell a more complicated story.

EmailEncryptionJurisdiction
January 2026 · 15 minRead
Field Assessment

SMS vs iMessage vs WhatsApp vs Telegram vs Signal: What the FBI's own document tells us

In 2021 the FBI produced an internal guide detailing exactly what data it can legally obtain from nine messaging apps. The document was obtained via FOIA. Here is a field-by-field analysis of five of the most common services.

MessagingMetadataLaw Enforcement Access
December 2025 · 26 minRead
Field Assessment

Your photo library knows more about you than you think: Ente vs iCloud vs Google Photos vs OneDrive

Your photos can carry GPS coordinates, device details, and exact timestamps. When you upload them to the cloud, the questions are who can see them, who can be compelled to hand them over, and whether AI is training on them.

PhotosMetadataEncryption
November 2025 · 18 minRead
Technical Brief

How encryption actually works, why it matters, and where it stops protecting you

Symmetric vs asymmetric, AES-256 vs quantum computers, what HTTPS actually protects, and why none of it matters if your phone is compromised. The foundational reference for everything else on this site.

EncryptionQuantum ComputingOPSEC
October 2025 · 16 minRead
Coming soon
Coming soon

Your carrier sees you before any app does: What the cellular network was built to know

Even after encrypting every app, the network underneath still knows who and where you are.

Coming soon

The VPN trust problem: What "No logs" actually means under subpoena

Every VPN claims no logs. Court records tell a different story.

Field Assessment

What California's new deletion tool removes, and what it leaves behind

Since August 1, every data broker registered in California has had to check a state list, delete the people on it, and keep deleting them every 45 days. More than half a million Californians have signed up. DROP is the most powerful deletion tool any state has built, and it is narrower than it sounds. Here is what one request reaches, what it cannot touch, and what is still left for you to do.

D David
October 2026
~13 min read
For years, getting your name off data broker sites meant doing it one site at a time. Find the listing, fill out the form, confirm the email, and check back months later to see whether you came back. When Consumer Reports tested that process in 2024, opting out by hand removed about 70 percent of profiles within a week. The best paid removal services managed about two-thirds after four months, and every participant was still listed somewhere at every checkpoint. [1] California's answer is DROP, the Delete Request and Opt-out Platform. One request goes to every registered data broker in the state, and the law makes them keep honoring it. I went through the statute, the technical guidance the state gave brokers, and the state's own numbers to see what that request actually does. DROP is worth the ten minutes it takes. It is also the tool least likely to touch the part of your profile people actually see, the listing that comes up when someone searches your name.
How One Request Reaches 600 Brokers What Happens After You File What DROP Leaves Behind DROP vs. Doing It Yourself What I Would Do

How One Request Reaches 600 Brokers

DROP comes from the Delete Act, a 2023 California law written by State Senator Josh Becker. [2] It required the California Privacy Protection Agency, which now goes by CalPrivacy, to build a single deletion system for every registered broker. Californians could start filing on January 1, 2026, and 18,000 did in the first 48 hours. [3]

Who Counts as a Data Broker
California defines a data broker as a business that knowingly collects and sells the personal information of people it has no direct relationship with. Brokers have to register with the state every year, and the fee this year is $6,000. [4] The registry listed 459 brokers in June 2025. A year later it listed 581, the most since it began in 2020, and by late August 654 brokers were part of DROP. [2] [3] [5] Not all of them are obscure. Bloomberg Law's review of this year's registry found General Motors, T-Mobile, and LexisNexis on it. [6]
What You Give It
You confirm that you live in California through the state's identity service, then enter your details. The minimum is your name, date of birth, and ZIP code. You can add other names you have gone by, such as a maiden name, along with email addresses, phone numbers, your phone's advertising ID, the ID your smart TV uses for ads, and your car's VIN. [7] It takes most people under ten minutes. [5] You can file for someone else, such as a parent, as long as you verify their residency too. [8] The request stays active until you withdraw it, and it automatically covers brokers that register later. [7] [9]
What Brokers Actually Receive Brokers never see your details in plain text. They see hashes, and they have to produce the same hashes from their own records to find you. A hash only matches an exact copy, so a broker that has you under an old ZIP code or a nickname will not find you through that list.
DROP standardizes each identifier, so names become lowercase, dates become eight digits, and phone numbers become ten, then runs it through SHA-256 and sorts the results into six lists. A broker standardizes and hashes its own records the same way and looks for identical values. [10]
Name, birth date, ZIPYour first name, last name, date of birth, and ZIP code, hashed together. Every request includes this one.
EmailEach address you add, hashed on its own.
PhoneEach number, as ten digits.
Ad IDYour phone's mobile advertising ID, the number apps use to tie your activity together for advertisers.
Name and VINYour name paired with your car's vehicle identification number.
TV IDThe advertising ID your smart TV sends.
That is why the extra names and ZIP codes matter. DROP builds a separate combination for each version of your name and each ZIP code you enter, and every combination is another chance to match. [10] It is also worth being clear about what hashing does here. It is a way to compare lists, not a lock. A ten-digit phone number hashed this way can be reversed by brute force in minutes on ordinary hardware, and any broker that already has your name, birth date, and ZIP code can compute the same value. That is the point. It lets brokers find you without the state handing them your details in plain text.
What Brokers Have to Do This is the part opting out by hand never had.
Since August 1, 2026, every registered broker has had to download the lists at least once every 45 days. For each person it matches, it has to delete all the information it holds that the law does not exempt, including the inferences it drew from that data, and tell its service providers and contractors to do the same. [10] [11] After that, it has to delete that person again on every 45-day cycle, and it cannot sell or share new information about them. [11]

If an identifier matches more than one person, such as a phone number a household shares, the broker cannot delete, so it has to opt everyone tied to it out of sale and sharing instead. A broker that fails to process a request faces a fine of $200 per day, per person. [10] Starting in 2028, every broker also has to pass an independent compliance audit every three years. [11]
Why the 45-day cycle matters Removals by hand have always had a shelf life. Brokers keep buying fresh data, and a listing you removed can quietly come back months later. CalPrivacy calls DROP a first-of-its-kind deletion mechanism, and the 45-day cycle is a big part of why. [12] For registered brokers, it keeps deleting you without you having to file again.

What Happens After You File

Brokers had until September 14 to download the first lists and then 45 days to report back, so the first full round of results should land by the end of October. [10] You can watch it happen on a status page, broker by broker. [2] Each broker reports one of four results, and they do not all mean what most people assume.

The Four Results Until a broker reports, it shows as Pending. Brokers have up to 90 days to post a result. [7]
DeletedThe broker found you and deleted everything the law did not let it keep.
ExemptedThe broker found you, but everything it holds falls under a legal exemption, so it keeps all of it.
Opted outThe broker could not tie the data to you alone. It keeps the data, and it can no longer sell or share it.
Record not foundThe broker has nothing on you, or it could not match what you entered. The status does not tell you which. [7]
The Numbers So Far
More than 520,000 Californians had signed up by mid-September. [13] In late August, before the deadline for the first download had even passed, about a quarter of brokers had reported results. Those brokers had deleted "tens of millions of records," and the typical user's information had been removed by more than 40 of them. [2] Most brokers will never have heard of any one person, so 40 out of more than 600 is not a failure rate. It is a reminder that a request sent to 600 brokers and a profile deleted by 600 brokers are not the same thing.
"Deleted" is not the same as gone California's privacy law does not count publicly available information as personal information at all. [14] A people-search site can delete the phone numbers and emails it bought from marketers, report Deleted, and keep everything it pulled from public records. Your status page can say Deleted while your listing is still up.

What DROP Leaves Behind

None of these are mistakes. They are written into the law, and CalPrivacy lists most of them itself. [7] Together, though, they cover a large share of what people mean when they say they want their information off the internet.

Public Records This is most of what a people-search listing is built on.
Information "lawfully made available from federal, state, or local government records" is not personal information under California law, and CalPrivacy lists publicly available data under what DROP will not delete. [7] [14] For a people-search site, that is much of the product. The address on your deed, the value of your home, court cases with your name on them, and professional licenses all come from government records. As KQED put it in its guide to DROP, publicly available information such as court appearances and property records is not deleted. [13]
Companies You Deal With Directly The companies with the most data on you are not brokers when it comes to you.
A business is only a data broker for people it has no direct relationship with. [4] What you gave Google, Meta, Amazon, your bank, or your phone carrier is what CalPrivacy calls first-party data, and a DROP request does not require any of them to delete it. [7] The same company can be both. T-Mobile is on the broker registry, but if you are a T-Mobile customer, what it knows from your account is first-party data. [6] For these companies, you still have to use your ordinary California deletion rights, one company at a time.
Credit, Banking, and Health Data Exempt by law, so it stays even when a broker finds you.
Data covered by other privacy laws is exempt from deletion. That includes credit reports under the Fair Credit Reporting Act, financial data under the Gramm-Leach-Bliley Act, and medical information under HIPAA. Companies are not treated as brokers at all to the extent their activity falls under those laws. [11] [15] A broker that holds only exempt data about you will report Exempted and keep all of it. [7] Equifax, Experian, and TransUnion are not going to delete your credit file because you filed a DROP request.
Brokers That Never Registered DROP only reaches the brokers the state knows about.
DROP works off the registry, so a broker that never registered never downloads the lists. CalPrivacy has brought more than a dozen enforcement actions against unregistered brokers. In September it fined a Virginia company, SalesIntel, $36,400 and ordered it to start processing DROP requests. [12] Every broker the state has not caught yet is still outside the system. That same month, the agency warned brokers that it will fine them for inaccurate registry filings, after its enforcement staff found errors. [16]
Copies Already Sold A deletion stops the next sale, not the last one.
The Delete Act tells brokers to pass a deletion on to their service providers and contractors. It does not tell them to recall copies they already sold. [11] That matters more than it used to. Brokers now have to disclose in their registry filings who they sold or shared data with in the past year, including the federal government, law enforcement, foreign actors, and AI developers. [16] In this year's filings, 55 brokers reported selling or sharing with the federal government and 28 with law enforcement without a subpoena or court order, according to an analysis of the registry by the DNS company Control D. The figures are self-reported. [17]

Whatever reached a government agency before you filed stays there. I covered what agencies do with that data in my earlier piece on the government buying data it cannot legally collect.
If you do not live in California DROP is only open to verified California residents. [9] Everywhere else, the old process is all there is. Find each listing and opt out one site at a time. The steps at the end of this piece work anywhere, except the first one.

DROP vs. Doing It Yourself

DROP does not replace opting out by hand, and opting out by hand does not replace DROP. They cover different ground, and paid removal services sit somewhere in between.

Which Brokers It Reaches
DROPALL REGISTERED Every broker on the state registry, more than 600 at once. [2] Nothing outside it.
By handWHAT YOU FIND Only the sites you find and work through yourself, registered or not.
Paid servicesTHEIR LIST Whichever sites the service covers.
People-Search Listings Built From Public Records
DROPNOT REQUIRED Brokers can keep anything that came from government records. [7]
By handBEST RESULTS Many sites will take a listing down through their own opt-out form. In Consumer Reports' test, opting out by hand removed about 70 percent of profiles within a week. [1]
Paid servicesMIXED The same forms, filed for you. After four months, the best services in the test had removed about two-thirds of profiles, and the worst had removed under 10 percent. [1]
Staying Removed
DROPAUTOMATIC Brokers have to delete you again every 45 days and cannot sell new data about you. [11]
By handNONE Nothing stops a site from listing you again. You have to keep checking.
Paid servicesVARIES Depends on the service, and it stops when you stop paying.
Cost and Effort
DROPFree. About ten minutes, once. [5]
By handFree, but hours of searching, forms, and follow-up, repeated over time.
Paid services$20 to $250 a year in Consumer Reports' test. [1]
The point is not to pick one DROP is the only option that keeps working after you file. Opting out by hand is the only one that reaches public-record listings and the brokers the state has not found. Most people need both.

What I Would Do

1
File a DROP request, and give it everything
Go to privacy.ca.gov/drop. Enter the names you have gone by, the ZIP codes you have lived in, and the email addresses and phone numbers you have used. Each one is another chance for a broker's hash to match yours. Add your phone's advertising ID before you reset or delete it, because the old ID is the one brokers have on file. CalPrivacy explains how to find it. [5]
2
Read your results like a skeptic
When the first round lands, remember that Deleted means the broker removed what the law required, not that your listing is gone. Search your name on the big people-search sites and see what is still up. If a site that clearly has you reports Record not found, update your request with the details that listing shows. [8] [18]
3
Remove the public-record listings by hand
Use each site's own opt-out form for whatever is still up. In Consumer Reports' test, this removed more profiles, faster, than any paid service. [1] Keep a list of every site you were on, because you will be checking it again.
4
Freeze your credit
The credit bureaus are outside DROP entirely. A freeze at Equifax, Experian, and TransUnion is free, does not affect your score, and makes it much harder for anyone to open new credit in your name. [19] While you are at it, use optoutprescreen.com to stop the bureaus from using your file for prescreened credit and insurance offers. [20]
5
Stop the next copy from being made
Turn on Global Privacy Control in your browser. California businesses have to treat it as a request not to sell or share your data. Firefox, Brave, and DuckDuckGo support it now, and a new California law requires every browser to offer a setting like it starting in January 2027. [21] [22] For the companies you use directly, send deletion requests through their own privacy pages, because DROP will not do it for you.
6
If someone has threatened you, look into Safe at Home
California's Safe at Home program gives people who fear for their safety, including survivors of domestic violence and stalking and some health care workers and patients, a substitute address to use in public records. [23] It is the only tool here that keeps your home address out of the records people-search sites are built from.
7
Check again in three months
DROP keeps working in the background for registered brokers. Nothing watches the rest. Search yourself every few months, and expect to find something.
The real message DROP is the first deletion tool in the country that keeps working after you file, and every Californian should use it. Just do not mistake a status page full of Deleted for being off the internet. The listing a stranger finds when they search your name is built from public records, and removing that part is still up to you.

References

  1. [1] Press Release, Consumer Reports, Consumer Reports Evaluation of People-Search Site Removal Services Finds That They Are Largely Ineffective (Aug. 8, 2024), advocacy.consumerreports.org (manual opt-outs removed about 70% of profiles within a week; after four months the best paid services had removed 65% to 68% and the worst 4% to 6%; every participant still appeared on some sites at every checkpoint; services cost $19.99 to $249 a year).
  2. [2] Press Release, Cal. Privacy Prot. Agency, Half a Million Californians Have Signed Up for DROP to Delete Their Personal Information from Data Brokers (Aug. 25, 2026), privacy.ca.gov (654 brokers in DROP; about 25% had reported processing requests; "tens of millions of records" deleted; the typical user deleted by more than 40 brokers; status page for each broker; quoting Sen. Josh Becker, author of the Delete Act).
  3. [3] CalPrivacy Unpacks DROP Updates on Consumer Participation, Upcoming Enforcement, IAPP (Mar. 2, 2026), iapp.org (DROP launched Jan. 1, 2026, with 18,000 requests in the first 48 hours; registered brokers rose from 459 in June 2025 to more than 575 in February 2026).
  4. [4] Cal. Privacy Prot. Agency, Data Brokers, privacy.ca.gov (definition of a data broker under Cal. Civ. Code § 1798.99.80(c); annual registration and fee).
  5. [5] Press Release, Cal. Privacy Prot. Agency, Privacy Momentum Builds: 300,000+ Californians Sign Up for DROP as Registered Data Brokers Hit a Record High (June 2, 2026), privacy.ca.gov (581 registered brokers, the most since the registry began in 2020; signing up takes under ten minutes; guidance on finding your mobile advertising ID).
  6. [6] Cassandre Coyer, California Reveals Brokers Selling Data to AI Firms and Overseas, Bloomberg Law (Mar. 24, 2026), news.bloomberglaw.com (registry includes General Motors, T-Mobile, and LexisNexis).
  7. [7] Cal. Privacy Prot. Agency, How DROP Works, privacy.ca.gov (identifiers accepted; definitions of Deleted, Exempted, Opted-out, Record not found, and Pending; publicly available data and first-party data not deleted; current and future brokers included).
  8. [8] Cal. Privacy Prot. Agency, Help with DROP, privacy.ca.gov (filing on someone else's behalf; adding information to improve matches; updates may take up to 90 days).
  9. [9] Privacy Rights Clearinghouse, Deletion Obligations Under DROP Are Here! Data Brokers Must Now Delete Californians' Information, and Again Every 45 Days (July 31, 2026), privacyrights.org (a request stays active until withdrawn; DROP is available only to verified California residents).
  10. [10] Cal. Privacy Prot. Agency, DROP Webinar for Data Brokers (June 11, 2026), privacy.ca.gov (PDF) (identifiers standardized and hashed with SHA-256; six deletion lists; separate combinations for each name and ZIP code; deletion includes inferences; shared identifiers opted out; first download due Sept. 14, 2026; $200 per day, per consumer for failing to process).
  11. [11] Cal. Civ. Code § 1798.99.86, california.public.law (deletion within 45 days, passed on to service providers and contractors; continued deletion every 45 days; no sale or sharing of new information; exceptions under §§ 1798.145 and 1798.146; independent audits beginning Jan. 1, 2028).
  12. [12] Press Release, Cal. Privacy Prot. Agency, CalPrivacy Continues Enforcement Blitz with Action Against Virginia Data Broker (Sept. 1, 2026), privacy.ca.gov (SalesIntel Research fined $36,400 and required to process DROP requests; more than a dozen actions against unregistered brokers; describing DROP as "a first-of-its-kind deletion mechanism").
  13. [13] Nisa Khan, Over Half a Million Californians Have Signed Up to Delete Their Info From Data Brokers. Here's How You Can, Too, KQED (Sept. 15, 2026), kqed.org (more than 520,000 sign-ups; court and property records not deleted; quoting CalPrivacy Executive Director Tom Kemp).
  14. [14] Cal. Civ. Code § 1798.140(v)(2), california.public.law (personal information "does not include publicly available information," which includes information "lawfully made available from federal, state, or local government records").
  15. [15] California's Deletion Request and Opt-out Platform (DROP) Is Live, Byte Back (Feb. 2026), bytebacklaw.com (data governed by financial and health privacy laws need not be deleted; businesses covered by the FCRA or HIPAA need not register as brokers).
  16. [16] Cal. Privacy Prot. Agency, Enforcement Advisory No. 2026-01, Accuracy of Data Broker Registration Information (Sept. 3, 2026), cppa.ca.gov (PDF) (brokers must disclose sharing with government entities, law enforcement, foreign actors, and developers of generative AI; $200 per day for inaccurate registry information).
  17. [17] Control D, Data Brokers Received 58.0 Million Requests to Delete Personal Data Last Year and Refused Nearly 900,000, California Filings Show (Oct. 7, 2026), controld.com (analysis of 603 broker registrations; figures are self-reported and not independently verified).
  18. [18] How Californians Can Use a New State Website to Block Hundreds of Data Brokers, The Markup (Jan. 8, 2026), themarkup.org (requests can be updated later with new identifiers).
  19. [19] Fed. Trade Comm'n, Credit Freezes and Fraud Alerts, consumer.ftc.gov (freezes are free to place and lift and do not affect your credit score).
  20. [20] Fed. Trade Comm'n, What To Know About Prescreened Offers for Credit and Insurance, consumer.ftc.gov (opt out at optoutprescreen.com or 1-888-5-OPT-OUT, for five years or permanently).
  21. [21] Global Privacy Control, globalprivacycontrol.org (supported in Firefox, Brave, and DuckDuckGo).
  22. [22] Press Release, Cal. Privacy Prot. Agency, Governor Signs Groundbreaking Privacy Bill Making It Easier for Californians to Protect Their Personal Data (Oct. 8, 2025), cppa.ca.gov (AB 566 requires browsers to offer an opt-out preference signal starting in January 2027).
  23. [23] Press Release, Cal. Sec'y of State, Safe at Home Program Now Accepting Applications from Individuals Seeking and Providing Legally Protected Health Services (Sept. 9, 2026), sos.ca.gov (a substitute mailing address that keeps participants' home addresses out of public records).
Disclaimer: This analysis is for educational and informational purposes only. It is not legal advice. The author is not a licensed attorney. DROP's rules, deadlines, and numbers are described as of October 2026, from the text of the Delete Act, CalPrivacy's published guidance for consumers and brokers, and published reporting. Registry figures are self-reported by brokers. Any of it may change as CalPrivacy updates the system.
Analysis

What happens when everything is evidence?

Andrew Guthrie Ferguson's Your Data Will Be Used Against You sorts what our devices record into six arenas of modern life. Only four of them have a home in the Fourth Amendment's text. The two that don't, the watched city and the recorded mind, are where exposure is worst and the law is thinnest, and the past year of court rulings bears that out. The answers will not come from a courtroom alone.

D David
June 2026
Updated October 2026
~26 min read
The Fourth Amendment protects "persons, houses, papers, and effects." It's a list of four things, ratified in 1791, and for most of American history it covered nearly everything the government might want to search. Ferguson's book organizes its first half around the places self-surveillance now reaches. Our homes, our things, our bodies, our cities, our papers, and our likes. [1] Each gets a chapter, and each makes the same point from a different angle. The conveniences we install in our own lives keep a continuous and intimate record, and police and prosecutors can reach it with very little friction. His point about the smart home applies to all six. If the data exists, there is a legal process for getting it. [2]

I want to ask a question the book doesn't. Which of those six arenas was the Constitution written to cover, and what happens to the two it wasn't?

One limit belongs up front. The Fourth Amendment restrains only the government. It doesn't reach the private collection that produces all this data in the first place. The market that gathers, combines and sells the record of your life sits outside the Amendment entirely, which is the biggest reason the lasting fixes are statutory rather than constitutional.
Four Arenas With a Home in the Text The Two Orphans The Framework, Tested Why Prosecution Raises the Stakes Three Venues for Reform Where the Individual Fits Conclusion

Part I: Four Arenas With a Home in the Text

Ferguson doesn't line his six arenas up against the Constitution's four, and the count isn't his point. When he summarizes, he sometimes lists five and drops cities. [3] But set his arenas beside the text and a pattern appears. Four have a clear match. Bodies are persons, homes are houses, papers are papers, and things are effects. Two have none. There is no "city" in "persons, houses, papers, and effects," and there is no "like." That four-versus-two reading is my framing, not his, and I think it explains the book's two hardest questions.

Four arenas sit on top of the words
The body is the person, and it now gives off data it never did. Wearables record heart rhythm, sleep and fertility cycles. The home is the house, and it narrates itself. A question you ask a smart speaker doesn't stay in the bedroom. It goes to Amazon and is stored with millions of others. [4] The car is an effect that logs where it went, sometimes against you. In one Georgia case, airbag data showed a driver going nearly 100 miles an hour before a crash that killed two people, and the state's highest court required a warrant to download it. [5] The paper is still a paper, except it now lives on a server, copied to the cloud the moment you create it.

For these four, the constitutional task is at least recognizable, because the text already names the category. A lawyer can stand up and say a smart home is a house.
The protected thing was always the information
Ferguson's proposal for this half of the problem is what he calls informational security. The Fourth Amendment has never really protected the suitcase. It protects what the suitcase holds, which is why a closed container needs a warrant whatever the lock. [6] If that's right, routing a device's data through a company doesn't change what the data is. It's still the content of your house or your person. Carpenter v. United States leaned this way for one slice of the problem, requiring a warrant for historical cell-site location data even though a carrier holds it. [7] But the Court has never answered even the simplest version of the question. Is the data from your smartwatch part of the watch, which is an effect, or part of you? [8]
But the third-party doctrine exposes all six Naming the arena buys an argument, not protection.
The easy version of the four-versus-two split is wrong, and Ferguson's own account shows why. The four named arenas aren't safe either. The default rule runs against all six, because the data is shared with the company that runs the device. The Supreme Court has long held that what you share with a third party loses its expectation of privacy. Whether you tell a secret to a friend at a bar or to a smart speaker in your bedroom, the old rule treats the protection as forfeit. [9]

That rule is weaker than it was. Carpenter pulled historical location data out of it, and in June 2026, in Chatrie v. United States, the Court extended that protection to the location history Google kept for its users. [7] [10] But the older cases still stand, so the doctrine still reaches all six arenas by default. The difference is that a litigant who can say "this is my house" or "this is my paper" at least holds a textual handle, the lever from which the next Carpenter gets argued. The two orphans have no such handle. That's their disadvantage, and it's why naming an arena buys an argument, not protection.
Why the textual handle matters
The handle is more than rhetoric, because there are two ways into the Fourth Amendment. Since Katz v. United States in 1967, the Amendment "protects people, not places," and a search happens whenever the government intrudes on a reasonable expectation of privacy. [11] United States v. Jones in 2012 and Florida v. Jardines in 2013 revived an older property test alongside it. A GPS tracker attached to a car, or a drug dog brought onto a front porch, is a search because the government physically intruded on something the Amendment protects. [12] [13] The Georgia airbag case turned on the same test. [5] And that test reaches only the four things the text names.

So the four named arenas have two routes to protection, property and privacy. The city has only privacy, since no one owns the street. Your likes get the property route only when a court treats your data as your property. Colorado's Supreme Court did that for Google searches in 2023, relying on Google's own terms of service. [14] Concurring in Chatrie, Justice Gorsuch began by "asking first whether Location History qualifies as one of Mr. Chatrie's papers or effects," and concluded it was Chatrie's property. [10] No majority has gone that far. Until one does, the two orphans argue with one route while the other four have two.

Part II: The Two Orphans

Ferguson raises two questions and leaves both open. Can a harm spread across a whole city ever be remedied? And is some information too intimate to reach even with a warrant? Both come up for the same reason. They sit in the two arenas the Fourth Amendment never named.

Cities, the collective domain The government owns the cameras, so there isn't even a third party to point at.
A city isn't a house, and Ferguson is explicit that it isn't a third-party problem either. Smart-city surveillance skips that problem, because the government controls the cameras, the sensors and the databases. [15] That's what makes it the hardest case. It's direct government surveillance of public space, and the long-standing rule is that police may see what anyone in public could see. In 2020 Baltimore flew camera planes over the city in daylight, twelve hours a day, recording nearly everyone outdoors in order to solve the occasional crime. The harm fell on the whole city at once. The full Fourth Circuit held that accessing that footage was a search, because it let police deduce the whole of a person's movements. [16] But that recognition has nowhere to live in a doctrine built around the individual search of the individual place.
The harm has no doctrine to live in
Ferguson names the harm directly. Police see facial recognition as a way to catch one bad actor, but it captures everyone else too. Only the suspect pays the cost of getting caught. Everyone else loses a little more privacy. He calls this a "collateral, collective harm," one that is "a community harm, and not one that is easily addressed under existing law." [17]

Standing is the reason. To bring a Fourth Amendment claim, you must first show that your own expectation of privacy was violated. That makes sense for one search and works as a wall in front of a system. [18] In Clapper v. Amnesty International, lawyers, journalists and human rights groups challenged Section 702. Added to the Foreign Intelligence Surveillance Act in 2008, it lets the government collect foreigners' communications abroad without individual warrants, including their calls and emails with Americans. The plaintiffs' own communications were likely swept in. But the targets were secret, so none of them could prove it, and the Court threw the case out for lack of standing without deciding whether the surveillance was lawful. [19] The injury was obvious in the aggregate and invisible at retail.

Baltimore shows where the wall has a door. Those plaintiffs got into court and won, because a program that filmed the whole city plainly covered the people who lived there. [16] So the line that decides who gets a hearing isn't individual versus collective. It's whether you can show you were watched, and secret surveillance is what can't be challenged. That's why community-control laws matter. More than twenty cities and counties have passed laws requiring police to disclose a surveillance tool and get approval from elected officials, in public, before acquiring it. [20] Those laws end the secrecy before anyone needs to sue.
A negative externality
The clearest way to name the problem, and here I'm extending Ferguson rather than restating him, is that collective surveillance is a negative externality. The benefit goes to whoever installs the camera, or to the homeowners' association that wires a neighborhood with a license-plate reader to flag cars that don't belong. [21] Part of the cost, lost anonymity and public space turned into monitored space, lands on everyone who passes through and agreed to nothing. Externalities are the classic case where individual lawsuits fail, because the harm is spread thin and no one is injured enough to sue. We regulate the source instead.

The scholar David Gray finds the city a home in the clause the rest of the doctrine skips. The Amendment opens with "the right of the people" before it reaches persons or houses, and Gray reads that phrase as a collective security against arbitrary search power. That reading gives the city a place in the text. It has simply been left empty, the collective reading largely lost to history. [22]
The externality falls unevenly
The book is candid that the cost isn't shared equally. The Baltimore planes were first tested over Black and Brown neighborhoods. Gunshot sensors cluster in poor communities that are already policed more heavily. And the gap between surveillance imposed on public housing and the same technology sold to luxury buildings as a convenience has been named "luxury surveillance." [23] Any remedy has to reckon with that, and so does any case for self-help. A privacy story that ends with "buy your way out" protects whoever can afford to.
Likes, the domain of the mind The least protected arena is the closest thing we have to a transcript of the inner life.
The second orphan is subtler and more dangerous. By "likes," Ferguson means the record of preference and attention, what we search, read, watch, buy and join. Texts and photos can be revealing, he argues, but search history goes deeper. It's where people reveal fears they would never tell a spouse or a therapist. [24] And it's the least protected arena. That's the exact inversion of what the Founders thought they secured when they wrote "papers" into the text, where for the Amendment's first century protection was nearly absolute. [25]
The consent fiction underneath it
Two doctrines cut likes off from protection. The first is the third-party doctrine again, which treats a query you'd never say aloud as voluntarily shared with the search engine. The second confuses privacy with secrecy, reasoning that a record that isn't secret can't be private. As Ferguson writes, "just because something is not secret does not mean it cannot still be private." [26]

Both rest on the idea that the disclosure was voluntary, and the evidence doesn't support it. In a paper prepared for FTC hearings, Joseph Turow, Chris Hoofnagle and their colleagues reported that 59 percent of people surveyed wrongly believed a website with a "privacy policy" would not share their data. [27] Reading the policies a person actually encounters would take roughly 244 hours a year. [28] A disclosure no one can read and most people misunderstand isn't voluntary in any ordinary sense. Voluntariness isn't the doctrine's only support. It also leans on assumption of risk and on the idea that a company's records are the company's to hand over. But it's the support courts reach for first, and the one doing the moral work. Without it, what holds the doctrine up is much harder to defend in the open.
How exposed the mind is in practice
Consider Ferguson's own gradient. Someone newly diagnosed with cancer might email close friends, post in a closed social media group, or post publicly. Under current law only the email is clearly protected. The closed group is contested, and the public post is treated as exposed. [29] Even that protection is fragile, because privacy depends on "the judgment of your least responsible friend." One false friend, including an officer who sends a friend request under a fake name, can open a private profile entirely. [30]

Much of this never requires a warrant at all. Fog Reveal, a commercial tool built on the advertising IDs in phone apps, lets police search people's location histories, at times without a warrant. [31] One detective said it cut an investigation from six weeks to two days. [32] (I go through how the government buys this data in a separate piece.)

Neil Richards calls the interest at stake intellectual privacy, the freedom to read and think without the government keeping a record of it. [33] Today it rests mostly on a "papers" clause the doctrine has hollowed out. The First Amendment helps at the edges. It protects the privacy of the groups you join, and it requires warrants for books and other expressive material to be written with "scrupulous exactitude." [34] [35] Colorado applied that standard to Google searches in 2023. [14] But the First Amendment doesn't stop the government from getting the record. When police searched a student newspaper's newsroom, the Supreme Court held that a properly specific warrant was all the First Amendment required. [36]
The two orphans A skeptic will say that "papers" and "effects" read broadly, and "the right of the people" read collectively, could absorb all of this. Then there would be no orphans, only categories waiting for a generous reading. The skeptic is right about the ancestry and wrong about the home. These two aren't foundlings with no parents in the text. They're disinherited heirs. Likes descend from "papers," and the city from "the right of the people." But the doctrine cuts off the first the moment data is shared, and it has left the second empty for a century. Orphaned is the right word in the only sense that matters here. Both have ancestors, but neither has a guardian the law currently recognizes. The generous reading is the destination. It isn't the doctrine we have.

Part III: The Framework, Tested

If the framework is right, courts should protect the named arenas more readily than the orphans. The orphans should get protection mainly where a judge can look past the individual search. Rulings from the past year put that to a test, and mostly it holds.

Where you go is protected Even two hours of location data is protected.
In Chatrie v. United States, decided June 29, 2026, the Supreme Court held 6 to 3 that police conducted a search when they used a geofence warrant to get a robbery suspect's Google location history. [10] Justice Kagan's opinion for the Court rejected the government's claim that turning on Location History was voluntary sharing. Google "repeatedly prompts users to enable Location History," the Court noted, without telling them how precise the data is or that police can get it. So it's "hard to see how any user is, in the normal sense, 'sharing'" with third parties. The Court also refused to exempt short searches, writing that "it does not matter if the time period scrutinized was only two hours."

That's close to the consent fiction argument in Part II, now in a majority opinion. Carpenter is no longer one narrow carve-out, though the older third-party cases still stand. The Court didn't decide whether the warrant itself was valid. It sent that question back to the Fourth Circuit, including whether each step of Google's three-step process met the warrant requirements.
What you search is less settled Search history may be the least protected record you make.
Six months earlier, Pennsylvania's Supreme Court let prosecutors use the results of a reverse keyword warrant, which asked Google to identify everyone who had searched a victim's name and address in the week before the crime. [37] Three of the seven justices went further and found no reasonable expectation of privacy in ordinary Google searches. Their reasoning tracked the line between the arenas. The lead opinion said that "unlike smart phones, the internet is not a 'feature of human anatomy,'" so using a search engine is a choice. It also relied on Google's privacy policy, which says Google may share data with law enforcement. Three other justices decided the case without reaching the constitutional question, and one dissented. No majority has settled it, but the pull is plain. Where your phone goes is protected. What you search may not be.

The two opinions also pull in different directions on notice. Chatrie faulted Google's prompts for not telling users that police could get their data. The Pennsylvania lead opinion found that Google's privacy policy did tell them. Whether a disclosure almost no one reads counts as notice is the consent fiction question, and it's still open.

Colorado went the other way. In People v. Seymour in 2023, its Supreme Court found a reasonable expectation of privacy in Google search history under the state constitution, and a property interest under the federal one. [14] It still let the evidence in. But for now, whether your search history is protected depends partly on your state.
The city is still being decided
Norfolk, Virginia, put up 176 Flock license-plate cameras. In January 2026 a federal judge held that police could use them without a warrant, because the network wasn't extensive enough to track anyone's whole movements. [38] That reasoning sits uneasily with Chatrie, which protected even two hours of location data and said that whether something is a search "does not depend on what it finds." The appeal finished briefing in the Fourth Circuit in July, and it's the next real test of the city arena.

A federal judge in Mississippi went the other way on a different tool. In August, Judge Carlton Reeves held that tower dumps, which collect records for every phone near a cell tower, are always unconstitutional general warrants. [39] The question reached him because a magistrate judge had refused to sign the warrants, so none issued and no one was charged. The ruling binds no other court. But it's a court protecting a crowd, thousands of people who could never have sued, at the only moment it could act, before the search.

Part IV: Why Prosecution Raises the Stakes

A catalog of exposure isn't yet a crisis. The second half of the book turns it into one, and three of its points explain why leaving the orphans unprotected does the most damage.

Power, and the missing proportionality
Ferguson argues that digital policing is a different kind of thing from old investigative work. It shifts the balance of power between citizen and state, and he names six new capacities behind the shift. Automation, acceleration, accumulation, aggregation, accuracy and actualization. [40] The Fourth Amendment has almost no proportionality principle to meet that shift. Once the government shows probable cause and particularity, the intimacy of the data drops out of the analysis. With a warrant, police can reach the most intimate records of all, from smart beds to medical devices. [2] A rare case like Winston v. Lee, where surgery to remove a bullet was unreasonable despite probable cause, shows courts can draw a categorical line when they choose. [41] They rarely choose to. And the power doesn't stop with the state. Relying on the technology shifts power again, from police to the companies that own the data and the platforms. [40]
"Criminal" is a shifting category
This is the point I'd press on anyone who thinks surveillance is a partisan issue. One day a protest is lawful, and the next, Ferguson writes, prosecutors are charging conspiracy for the same protest. [42] The infrastructure that can expose someone seeking reproductive care where it's been criminalized can also expose a gun owner who fears a registry. A trans kid's social media, the location data from the car that drove them to an out-of-state clinic, and the app that tracks their medication are all already there, because the infrastructure "was always there." [43]

This already happens. In 2025 a deputy in Johnson County, Texas, searched more than 83,000 Flock license-plate cameras across the country, including networks in Washington and Illinois, where abortion is legal. The search log gave the reason as "had an abortion, search for female." The sheriff and Flock said it was a search for a missing person. Records EFF later obtained describe a "death investigation" of a "non-viable fetus." The woman was not charged. [44]

My own view is that this is the heart of it. The architecture outlives the politics, which is why the orphans, the citywide net and the record of the mind, are what a future government repurposes. The harm runs across time as much as across people.
The six Ps, and the two that bite hardest The system that collects the evidence is built for the prosecution, not for doubt.
Ferguson groups the practical failures of digital evidence into six Ps. They are the pilot, profit, probability, people, pressure and process problems. [45] Two bite hardest in the orphans. The pressure problem is the pull to make the data fit a story. His example is a 65-year-old Chicago grandfather held for about eleven months on a murder charge that rested largely on a gunshot-detection alert. [46] The technology can say a shot was fired and roughly where. It can't say who fired it. The Associated Press later found that the system first classified the sound as a firecracker, until a company employee relabeled it a gunshot. Prosecutors asked a judge to dismiss the case for insufficient evidence. [47]

The process problem is structural and, to my mind, the most damning, because it inverts the protection the system advertises. Rebecca Wexler has shown that the statutes governing data access give law enforcement a route and say nothing about the defense. A defense lawyer who believes a company holds evidence that could clear a client often has no way to compel it. [48] Surveillance often works only as an investigative lead that never reaches trial, which Elizabeth Joh calls the surveillance discretion gap, so the accused may never learn it was used. [49] And when Ferguson asked the engineers who built a prosecutor's intelligence database whether anyone had mentioned Brady, the duty to disclose evidence favorable to the accused, the answer was no. [50]
The same flood sometimes helps the accused More clues in general means more clues for the defense, if the defense can reach them.
It would be one-sided to stop there. In an Arkansas murder case, prosecutors pointed to a smart water meter that showed a spike in water use in the middle of the night. Amazon turned over data from the defendant's Echo once he agreed. Then prosecutors dropped the charges, saying the evidence "could support more than one reasonable explanation." [51] In Ferguson's words, "too much data can create doubt." [52] A Fitbit that recorded only twelve steps during the hours of a murder became an alibi. [53] None of this makes the data harmless. But the more clues exist, the more will help the defense, which is why the process problem, the defense's inability to reach them, is the quiet scandal.
The stakes Put the three together. Power without proportionality, a definition of "criminal" that moves, and an evidence pipeline built to convict. That's why an arena with no constitutional handle isn't a curiosity. It's the part of your life a motivated prosecutor reaches first and explains last.

Part V: Three Venues for Reform

Ferguson proposes reforms for courts, legislatures and individuals. [54] It helps to read them as a spectrum, ordered by the unit each one works on. A court decides one case at a time. A legislature acts for a whole population. An individual changes one person's devices and habits. Each venue is strong where its unit fits the harm and weak where it doesn't.

Courts, one case at a time
Courts are where the idea that "digital is different" lives, the recognition in Riley and Carpenter that a phone or a location trail isn't a wallet. [7] [55] Ferguson's judicial program starts with informational security, adds a tighter test for long-term and aggregated surveillance, and limits digital rummaging through a device once it's lawfully seized. His boldest idea is a substantive Fourth Amendment. A court could refuse a warrant even with probable cause when the data is too intimate, drawing on the near-absolute protection papers once had under Boyd and on Winston v. Lee. [25] [41]

This isn't purely hypothetical. In a Pennsylvania burglary case, a court allowed a warrant for a suspect's flashlight-app location data but refused his photos, health data and texts as an unparticularized fishing expedition. [56] That's a court doing, on overbreadth grounds, something close to the limit Ferguson wants. Of the three responses, the substantive limit is the one I find most compelling and the least likely to happen. It's also the question I most want a court to answer, because it's the only response that puts some part of a person off the table.

The court's weakness is built into its unit. It needs a litigant with standing, it usually acts after the fact, and it can't touch commercial collection at all. Two exceptions soften that. A judge reviewing a warrant application acts before the search and needs no litigant, which is how the Mississippi ruling protected people who could never have sued. [39] And state courts can read their own constitutions more broadly than the federal one, as Colorado did for search history. [14] For likes, a state high court may be a more realistic route than the Supreme Court or Congress. Still, the court is the right venue for the intimate-data question and the wrong one for the city.
Legislatures, a whole population at once The only venue that can stop a system before it is built.
Because the Constitution never reaches private collection, lasting protection has always come from statute, and a statute can bind the state wherever the data sits. Ferguson's legislative menu runs from a wiretap-style law for digital records to community-control ordinances and outright bans on the most dangerous tools. Underneath it is a principle he states plainly. Police have no countervailing right to surveil you.

Legislatures have already protected slices of the mind. After a newspaper obtained a Supreme Court nominee's video-rental records, Congress passed the Video Privacy Protection Act and protected viewing records as a category. [57] After the Court allowed police to search a newsroom with an ordinary warrant, Congress passed the Privacy Protection Act of 1980, which generally bars searches for journalists' materials. [58] Health, education and financial privacy laws do the same for other categories. Protecting intimate data by category is a decades-old idea.

If the city is a negative externality, this is the venue that fits it. Only a legislature can regulate a source before it's built, instead of waiting for an injured plaintiff who may never have standing. My own view is that the right fix for a tool like facial recognition is a ban on its use, decided in public, rather than a suppression motion litigated case by case after the harm is done. The gap that should worry a defense lawyer most is that these laws limit the state's access without giving the defense equal access, and they routinely carve police out of their rules entirely. [59]
Individuals, one person at a time
Ferguson's individual chapter is the most modest of the three, and he says so. His steps amount to seeing the trap, supporting the people resisting it, minimizing and obscuring the data you generate, buying with privacy in mind, and voting for it. He says plainly that self-help can't answer the collective harm, and he's right. One person hardening one phone does nothing about the planes over the city. What individual work can do is act at the one place the other two venues don't reach, the source. The only sure way to keep the government from your home's data is to avoid producing it in the first place. [52] That's a smaller claim than it sounds, and it's also the only lever you actually hold today.
The spectrum, and which orphan each fits
Lay the three side by side and the division of labor is clear. The court is the right instrument for the intimate-data limit, the likes question, because that question is ultimately about what a single warrant may demand of a single person. The legislature is the right instrument for the city, because that harm is an externality, and externalities are governed at the source. The individual can change only their own exposure and touches neither orphan at the structural level. The reform debate keeps asking one venue to do all three jobs. Courts are pushed to invent collective remedies they have no standing doctrine for, and individuals are sold tools as if configuration could answer a constitutional gap. No one venue repairs both orphans, and the two hardest problems, the city and the mind, sit in the venues we lean on least.

Part VI: Where the Individual Fits

I run a privacy practice, so I have an obvious incentive to say the individual response is the answer. It isn't, and I'd rather you trust the rest of this site than have me oversell this part.

What the lever can do
Almost everything above is collective or doctrinal, and none of it is yours to fix by configuring a phone. What individual work changes is your exposure, how much data about you exists in a form that can be subpoenaed, bought or seized. The point is to limit what exists for the legal system to reach. That small lever matters because it works at the source, where the doctrine won't go.

In one place it may even change your legal position. The Pennsylvania lead opinion said its ruling was "limited to general, unprotected internet use." It suggested that someone who uses a virtual private network, or a browser that doesn't collect or share data, "might retain a constitutionally recognizable expectation of privacy." [37] That's one opinion, joined by three justices. But it's a rare case where how you search could affect whether the law protects what you searched.
Where protection actually comes from
It also helps to be clear about where so-called protections come from. Google's much-praised three-step process for geofence warrants was written by its own lawyers, not by any court, and Ferguson observes that it "feels untethered from any constitutional principle." [60] I read it as a liability posture rather than a privacy safeguard. What ended those warrants for Google's location data was a design change. In July 2025 Google finished moving Timeline data off its servers and onto users' devices, with optional backups encrypted end to end. [61] It can't hand over what it no longer holds. The protection that lasted came from where the data lives. That's the difference between a promise and a constraint, which I go through in my piece on the FTC.
Two limits
First, the lever is partial. Ferguson is right that even the most sophisticated technologist can't fully escape, and that securing only one side of a conversation secures none of it. [62] But total anonymity is the wrong standard for most people. Reasonable protection matched to a realistic threat model is achievable, and it's usually the difference that matters. A burner phone protects a person right up until the police learn he bought one. Most of the failures in the book are failures of operational security rather than of cryptography.

Second, the lever isn't evenly available. City surveillance falls hardest on the people least able to pay anyone to shrink their footprint, and a plan that ends with "minimize what you generate" quietly makes privacy a function of money. I don't have a fix for that. I won't pretend the private market solves a problem that is, at bottom, about who gets watched and who can afford to step out of frame.
What this practice does, within those limits
Within those limits the work is concrete. It maps the specific ways a person's information is exposed, field by field. It weighs that exposure against the threats that are real for that particular life, because the right answer for a clinician, a journalist, a person leaving an abusive relationship and a public figure isn't the same. It produces a plan that says what to address, in what order, and why. It doesn't substitute for protections the law hasn't built. The larger repairs are statutory and judicial, and I'd rather tell you that than sell you a feeling of safety the law doesn't back.

Conclusion

If the argument here is right, the reform debate goes wrong when it treats the open questions as separate technical puzzles. They're two faces of one problem. A body of law built around the individual search of the individual thing now faces two arenas where the harm is neither individual nor a thing, the city and the mind. Behind both sits a commercial collection layer the Constitution never touches.

For the city
Stop expecting litigation to do the work, and treat surveillance infrastructure as the externality it is. The remedy belongs at the front end, in the public decision whether to build and in the judge who reviews a warrant before it issues. Waiting for an injured plaintiff means waiting for the next standing dismissal. The question that remains is what we owe the people a system watches but never prosecutes. Suppression requires a defendant, damages require a provable injury, and the collective harm has neither.
For the mind
The most promising route is the statutory one that already exists. Extend the logic of the video-records law to search, reading and purchase histories, their modern equivalents. Then require any warrant that reaches intimate data to carry written findings that the value of the evidence justifies the intrusion. Ferguson frames the deepest version of the question this way. Even with a warrant, we might want to claim some place of privacy the government cannot reach, and defining privacy in relation to police power could let us. [63] Whether such a zone exists is, to me, the hardest question the book leaves open, and the one most worth pressing, because no one has drawn that line yet. The warrant question and the data-market question have to be solved together, because a limit a warrant respects means nothing while the same data is for sale.
The choice
Ferguson puts the underlying choice in two questions. Is it worth tracking every car in a city to recover a stolen one? Is it worth losing all anonymity in public to catch one bad actor? In a given case the answer might be yes. Right now we aren't answering at all, because the default is no limit, and the architecture keeps getting built while the doctrine catches up one case at a time. "Criminal" is a shifting category. The data doesn't shift with it. That's the danger, and it's why the question in the title isn't rhetorical.

References

  1. [1] Andrew Guthrie Ferguson, Your Data Will Be Used Against You: Policing in the Age of Self-Surveillance (NYU Press 2026). The four-versus-two reading in this essay is the author's framing, not Ferguson's.
  2. [2] Ferguson, supra note 1, at 19 (any data that exists can be reached by warrant or other legal process, including data from smart beds and medical devices).
  3. [3] Ferguson, supra note 1, at 127 (listing five arenas, without cities).
  4. [4] Ferguson, supra note 1, at 18 (smart-speaker queries are stored on the company's servers).
  5. [5] Mobley v. State, No. S18G1546 (Ga. Oct. 21, 2019) (warrantless download of airbag data was an unreasonable search because it physically intruded on the car, an "effect"); Ferguson, supra note 1, at 36.
  6. [6] United States v. Chadwick, 433 U.S. 1 (1977).
  7. [7] Carpenter v. United States, 585 U.S. 296 (2018) (leaving Smith and Miller in place).
  8. [8] Ferguson, supra note 1, at 39 (whether a smartwatch's data belongs to the "effect" or the "person" is unresolved).
  9. [9] Smith v. Maryland, 442 U.S. 735, 743-44 (1979); see also United States v. Miller, 425 U.S. 435 (1976); Ferguson, supra note 1, at 18.
  10. [10] Chatrie v. United States, No. 25-112 (U.S. June 29, 2026), supremecourt.gov (opinion of the Court by Kagan, J.) (remanding without deciding the warrant's validity or good faith); id. (Gorsuch, J., concurring in the judgment).
  11. [11] Katz v. United States, 389 U.S. 347, 351 (1967); id. at 361 (Harlan, J., concurring).
  12. [12] United States v. Jones, 565 U.S. 400 (2012).
  13. [13] Florida v. Jardines, 569 U.S. 1 (2013).
  14. [14] People v. Seymour, 2023 CO 53, coloradojudicial.gov (privacy interest under the Colorado Constitution; possessory interest under Google's terms of service; "scrupulous exactitude" applied; evidence not suppressed).
  15. [15] Ferguson, supra note 1, at 80 (the government controls smart-city cameras, sensors and databases).
  16. [16] Leaders of a Beautiful Struggle v. Baltimore Police Dep't, 2 F.4th 330 (4th Cir. 2021) (en banc); Federal Appeals Court Rules Baltimore Aerial Surveillance Program Is Unconstitutional, ACLU (June 24, 2021), aclu.org; Ferguson, supra note 1, at 76-77.
  17. [17] Ferguson, supra note 1, at 63.
  18. [18] Rakas v. Illinois, 439 U.S. 128 (1978).
  19. [19] Clapper v. Amnesty Int'l USA, 568 U.S. 398 (2013) (challenge to Section 702 of FISA, 50 U.S.C. § 1881a); Ferguson, supra note 1, at 147.
  20. [20] Chad Marlow, The People, Not the Police, Should Decide If and How Surveillance Technologies Are Used in Their Communities, ACLU (May 25, 2021), aclu.org (Dayton and Detroit became the 20th and 21st jurisdictions with such laws).
  21. [21] Ferguson, supra note 1, at 29 (a homeowners' association installed a license-plate reader).
  22. [22] David Gray, The Fourth Amendment in an Age of Surveillance (2017); Ferguson, supra note 1, at 148-49.
  23. [23] Ferguson, supra note 1, at 24, 77, 131 ("luxury surveillance" is a phrase coined by Chris Gilliard).
  24. [24] Ferguson, supra note 1, at 94 (search history as the most revealing record).
  25. [25] Boyd v. United States, 116 U.S. 616 (1886); Ferguson, supra note 1, at 97.
  26. [26] Ferguson, supra note 1, at 145.
  27. [27] Joseph Turow, Chris Jay Hoofnagle, Deirdre K. Mulligan, Nathaniel Good & Jens Grossklags, The Federal Trade Commission and Consumer Privacy in the Coming Decade, 3 I/S: J.L. & Pol'y for Info. Soc'y 723 (2007), lawcat.berkeley.edu.
  28. [28] Aleecia M. McDonald & Lorrie Faith Cranor, The Cost of Reading Privacy Policies, 4 I/S: J.L. & Pol'y for Info. Soc'y 543 (2008) (point estimate of 244 hours a year).
  29. [29] Ferguson, supra note 1, at 111 (the cancer-diagnosis gradient).
  30. [30] Ferguson, supra note 1, at 112.
  31. [31] Garance Burke & Jason Dearen, Tech Tool Offers Police "Mass Surveillance on a Budget", Associated Press (Aug. 31, 2022), ktvz.com (as republished).
  32. [32] Ferguson, supra note 1, at 119 (Fog Reveal).
  33. [33] Neil Richards, Intellectual Privacy: Rethinking Civil Liberties in the Digital Age (2015); see Helen Nissenbaum, Privacy in Context (2009).
  34. [34] NAACP v. Alabama ex rel. Patterson, 357 U.S. 449 (1958).
  35. [35] Stanford v. Texas, 379 U.S. 476, 485 (1965).
  36. [36] Zurcher v. Stanford Daily, 436 U.S. 547, 564-65 (1978).
  37. [37] Commonwealth v. Kurtz, Nos. 98-100 MAP 2023 (Pa. Dec. 16, 2025), pacourts.us (opinion announcing the judgment of the court) (Wecht, J., joined by Dougherty & Brobson, JJ.); id. (Todd, C.J., concurring) (not reaching the constitutional question); id. (Donohue, J., dissenting).
  38. [38] Schmidt v. City of Norfolk, No. 2:24-cv-621 (E.D. Va. Jan. 27, 2026), appeal docketed, No. 26-1227 (4th Cir. Feb. 26, 2026), dockets.justia.com; Suzanne Smalley, Judge Dismisses Case Alleging Use of Flock Cameras in Virginia City Is Unconstitutional, The Record (Jan. 27, 2026), therecord.media.
  39. [39] In re Four Applications for Search Warrants Seeking Info. Associated with Particular Cellular Towers, No. 3:25-CR-38 (S.D. Miss. Aug. 5, 2026) (applying United States v. Smith, 110 F.4th 817 (5th Cir. 2024)); Ryan T. Fenn & Lee M. Cortes, Jr., Signal Lost: Mississippi Federal Court Declares Tower Dump Warrants Unconstitutional, Arnold & Porter (Aug. 11, 2026), arnoldporter.com.
  40. [40] Ferguson, supra note 1, at 126-28 (six new capacities; power shifting to the companies that hold the data).
  41. [41] Winston v. Lee, 470 U.S. 753 (1985).
  42. [42] Ferguson, supra note 1, at 30 (protest one day, conspiracy charge the next).
  43. [43] Ferguson, supra note 1, at 130.
  44. [44] Rindala Alajaji, She Got an Abortion. So a Texas Cop Used 83,000 Cameras to Track Her Down, Electronic Frontier Found. (May 30, 2025), eff.org; Dave Maass & Rindala Alajaji, Flock Safety and Texas Sheriff Claimed License Plate Search Was for a Missing Person. It Was an Abortion Investigation., Electronic Frontier Found. (Oct. 7, 2025), eff.org.
  45. [45] Ferguson, supra note 1, at 151 (the six Ps).
  46. [46] Ferguson, supra note 1, at 161-62 (the gunshot-detection case).
  47. [47] Garance Burke, Martha Mendoza, Juliet Linderman & Michael Tarm, How AI-Powered Tech Landed Man in Jail with Scant Evidence, Associated Press (Aug. 18, 2021), kvia.com (as republished).
  48. [48] Rebecca Wexler, Privacy Asymmetries: Access to Data in Criminal Defense Investigations, 68 UCLA L. Rev. 212 (2021); Ferguson, supra note 1, at 163-64.
  49. [49] Ferguson, supra note 1, at 165 (Elizabeth Joh's "surveillance discretion" gap).
  50. [50] Brady v. Maryland, 373 U.S. 83 (1963); Ferguson, supra note 1, at 169.
  51. [51] Arkansas Prosecutors Drop Murder Case That Hinged on Evidence from Amazon Echo, NPR (Nov. 29, 2017), npr.org.
  52. [52] Ferguson, supra note 1, at 20 (the only sure protection is not producing the data).
  53. [53] Ferguson, supra note 1, at 50 (the Fitbit alibi).
  54. [54] Ferguson, supra note 1, at pt. III.
  55. [55] Riley v. California, 573 U.S. 373, 385 (2014).
  56. [56] Ferguson, supra note 1, at 101-02 (the Pennsylvania flashlight-app warrant).
  57. [57] Video Privacy Protection Act, 18 U.S.C. § 2710 (enacted in 1988 after a newspaper obtained Judge Robert Bork's video-rental records).
  58. [58] Privacy Protection Act of 1980, 42 U.S.C. § 2000aa, law.cornell.edu.
  59. [59] Ferguson, supra note 1, at 47 (state data laws exempt or accommodate law enforcement).
  60. [60] Ferguson, supra note 1, at 44-45.
  61. [61] Google, Updates to Location History and New Controls Coming Soon to Maps, The Keyword (Dec. 2023), blog.google; Danny Bradbury, Supreme Court to Decide Whether Geofence Warrants Are Constitutional, Malwarebytes (Mar. 5, 2026), malwarebytes.com.
  62. [62] Ferguson, supra note 1, at 102 (no one fully escapes, and securing one side of a conversation secures none of it).
  63. [63] Ferguson, supra note 1, at 144 (a place of privacy even a warrant cannot reach).

Updated October 2026. This revision adds the Supreme Court's decision in Chatrie v. United States, the Pennsylvania and Colorado search-history rulings, the Mississippi tower-dump ruling, the Norfolk license-plate case and Google's move of Timeline data onto users' devices. It adds the property route from Jones and Jardines, refines the standing and First Amendment points, corrects the descriptions of Clapper and the Arkansas Echo case, marks Ferguson's exact words as quotations and cites primary sources where they exist. The argument is the same, stated more precisely where the new rulings required it.

Disclaimer: This analysis is for educational and informational purposes only. It is not legal advice. The author is not a licensed attorney. It engages with Andrew Guthrie Ferguson's Your Data Will Be Used Against You: Policing in the Age of Self-Surveillance (2026) and with court opinions, statutes, legal scholarship and news reporting, cited accordingly. The four-versus-two reading of the Fourth Amendment is the author's own argument and is not attributed to Ferguson. Pending matters, including the Norfolk appeal and the remand in Chatrie, reflect publicly available information as of October 2026 and may have developed further.
Analysis

Why privacy matters, even when you have nothing to hide

The "nothing to hide" argument assumes privacy is about covering up wrongdoing. The people in this piece weren't hiding anything. Their own location data made them suspects, and their home addresses were a search away. Privacy is about who gets to learn what about you and what they can do with it, and American law leaves most of that to the market.

D David
April 2026
Updated October 2026
~16 min read
In December 2018, police in Avondale, Arizona, arrested Jorge Molina at the Macy's warehouse where he worked, on suspicion of murder. Google location data had tracked his phone to the place where a man was shot nine months earlier, and a security camera had caught someone firing from a white Honda Civic, the same model Molina owned. "I just kept thinking, You're innocent, so you're going to get out," he told the New York Times. After almost a week in jail, the case fell apart. A friend said she'd been with him at home, and texts and Uber receipts backed her up. Police later arrested his mother's ex-boyfriend, who sometimes used Molina's car. By then Molina had lost his job, and his car had been impounded and repossessed. [1]

Molina had nothing to hide, and it didn't protect him. He never thought about what his phone was recording, so he had no idea what it said about him until the police read it their way. That's what the "nothing to hide" argument misses. It treats privacy as cover for wrongdoing, so only people with something to hide would need it. But privacy was never mainly about secrets. The risk comes from ordinary information in the hands of someone who reads it their own way.

This is the piece behind everything else on this site. It covers what the argument gets wrong, what's out there about you, why the law allows it, what it all adds up to and what you can do. The other articles go deeper into particular tools and laws. This one explains why any of them matter.
What the Argument Gets Wrong What's Out There Why the Law Allows It What It Adds Up To What You Can Do Conclusion

Part I: What the Argument Gets Wrong

The argument goes like this. If you aren't doing anything wrong, you have nothing to fear from being watched. It sounds reasonable, but it rests on three assumptions, and none of them holds up.

It assumes only the guilty get caught
Zachary McCoy found out from an email that police wanted his data. In January 2020 Google told him that police in Gainesville, Florida, had demanded information tied to his account, and that it would release it in seven days unless he went to court. A fitness app had been logging his bike rides, and on the day a 97-year-old woman's home was burglarized, his route had passed her house three times within an hour. It was one of his usual loops. His parents paid for a lawyer, prosecutors withdrew the warrant, and police dropped him as a suspect. [2]

Like Molina, McCoy had done nothing wrong. His data pointed at him anyway, because data doesn't explain itself. Someone else decides what it means.
It assumes the only one watching is the government
In July 2020 a gunman found Judge Esther Salas's home through personal information posted online, came to her house in North Brunswick, New Jersey, and opened fire. He killed her 20-year-old son, Daniel Anderl, and wounded her husband. [3] In June 2025, after Minnesota state Representative Melissa Hortman and her husband were killed at home and another lawmaker and his wife were shot, police found a list of 11 data broker sites in the suspect's car, with notes on which ones were free. Hortman's address was written next to her name. [4]

The argument usually pictures a government agent reading your files. The people who came for these families didn't need one, because the information was online. Neither family was hiding anything. What put them in danger was an address that was easy to find.
It assumes privacy means secrecy
The legal scholar Daniel Solove has written one of the best-known answers to the argument. Its "deeper problem," he says, is that it "myopically views privacy as a form of secrecy." Most of what's collected about you isn't secret. Your address, your commute and the clinic you visit are ordinary facts. The harm comes from what Solove calls aggregation, "the fusion of small bits of seemingly innocuous data" into something revealing, and from exclusion, when you can't know how information about you is being used. [5]

So the better question isn't whether you have something to hide. It's who gets to know what about you, and what they can do with it.

Part II: What's Out There

Almost none of this involves anyone breaking the law. Most of it is collected, combined and sold as a normal part of doing business.

Three facts can identify most Americans
In 2000 Latanya Sweeney, then at Carnegie Mellon, showed that 87 percent of Americans could be singled out by three facts, a five-digit ZIP code, a birth date and sex. [6] Three years earlier, as a graduate student at MIT, she had found Massachusetts Governor William Weld's medical records in hospital data the state released with names removed, by matching it against a Cambridge voter list she bought for $20. The demonstration shaped how HIPAA, the federal health privacy law, defines de-identified data. Weld was easier to find than most people, since his hospital stay had been in the news, but the point held. [7] Facts that mean nothing alone can identify you once someone combines them.
Your address is for sale
People-search sites sell profiles of ordinary people. A listing can show your current and past addresses, phone numbers and relatives, and anyone can look you up. [4] California has required data brokers to register since 2020, and in June 2026 its registry listed 581 of them, a record. Those are only the ones that registered. [8] There's no federal registry at all. The Consumer Financial Protection Bureau proposed a rule in December 2024 that would have brought some brokers under the federal credit reporting law, then withdrew it in May 2025. [9]

The sites say the information is public, and piece by piece much of it is. A deed sits in a county office. A phone number leaks in a breach. A birth date sits on a voter roll. Gathered onto one page anyone can search, it becomes something new, a way to find a person. The privacy scholar Helen Nissenbaum explains why that matters. Information carries the norms of the setting it came from, and moving it into a different one can violate them, even when every piece was technically public. [10]
Brokers have long sold to the government
In 2004 Chris Hoofnagle, now at Berkeley Law, used more than 1,500 documents from nine federal agencies to show how ChoicePoint and other brokers built files on Americans for law enforcement. He argued that the Privacy Act, which limits the government's own databases, should cover the brokers too. [11] Congress never made that change, and agencies still buy from brokers what they would need a warrant to collect, which I go through in my piece on government data purchases.
Your phone keeps a record of your days
Your phone reports where it is to its operating system, to the apps you install and to the advertising code inside those apps, and much of that ends up with brokers. In 2024 the FTC acted against brokers whose data could reveal visits to medical and reproductive health clinics, places of worship and domestic abuse shelters, and its order against X-Mode was the first-ever ban on selling sensitive location data. [12] The bans have gaps. The order against Gravy Analytics and its subsidiary Venntel makes exceptions for national security and law enforcement. [13]

Private buyers use the data too. Senator Ron Wyden found that an anti-abortion group, the Veritas Society, used location data from a broker called Near to target people who visited 600 Planned Parenthood clinics in 48 states. In Wisconsin alone, it sent 14.3 million ads. Near's chief privacy officer told Wyden's staff that the company had no technical controls against that kind of targeting until the summer of 2022. [14]
"Anonymous" location data isn't
Brokers call the data anonymous because it's tied to an advertising ID instead of a name. Research says otherwise. A 2013 study of 15 months of phone data on 1.5 million people found that four points in time and place were enough to single out 95 percent of them. [15] A 2021 follow-up estimated that in a dataset of 60 million people, four points would still single out 93 percent. Even the authors' most cautious figure, a lower bound, was 22 percent with four points and 87 percent with five. [16] Four points could be your home at night, your office in the morning, your gym after work and a restaurant on Saturday.
Your email is a record, and your accounts are a chain
Email you leave on a provider's servers can sit there for years. In a lawsuit, the other side can demand whatever in it is relevant to the case, and police with a warrant can get the messages themselves. [17] [18]

Most people also use one email address, and often one password, for their bank, their doctor's portal and every store they've bought from. When one of those sites is breached, attackers try the same email and password everywhere else. It's called credential stuffing, and an old password is the most likely way someone got into the FBI director's personal Gmail, which I go through in my brief on that breach. Have I Been Pwned, a free breach-lookup service, now counts almost 18 billion breached email addresses. [19]

Part III: Why the Law Allows It

Most of this is legal. American privacy law is a patchwork of court rulings and narrow statutes built for phone lines and filing cabinets, and much of it still rests on ideas from the 1970s.

Share it, and you give it up
In 1976, in United States v. Miller, the Supreme Court held that the Fourth Amendment doesn't protect the records your bank keeps about you, because you gave the information to the bank. In 1979, in Smith v. Maryland, it said the same about the phone numbers you dial. [20] [21] That's the third-party doctrine. What you share with a company, the government can get from the company without a warrant. It made more sense for a bank slip or a phone log. Today you can't hold a job, see a doctor or carry a phone without leaving records with someone else, so the same rule reaches most of the record of a modern life.
The Court has started to pull back
In 2018, in Carpenter v. United States, the Court refused to apply that rule to the location records phone companies keep, because tracking a phone's location gives the government "near perfect surveillance." [22] In June 2026, in Chatrie v. United States, it extended that protection to the location history Google kept for its users, and said it was "hard to see how any user is, in the normal sense, 'sharing'" that data. [23] Both rulings were narrow, and the older cases still stand, so most of what companies hold about you is still treated as shared. (I go through these cases in a separate piece.)
Your email runs on a 1986 law
The Electronic Communications Privacy Act was written in 1986, before the web existed. Its text still lets the government get email more than 180 days old with a subpoena instead of a warrant. [18] A federal appeals court held in 2010 that the Fourth Amendment protects email content however old it is, and a bill to update the law passed the House 419 to 0 in 2016, but it never passed the Senate. [24] [25] The records around your email, like who you wrote to, when and from where, get even less protection than what you wrote. That's the metadata problem I come back to in my comparisons of messaging apps and notes apps.
The FTC enforces privacy with a 1938 clause
Congress created the Federal Trade Commission in 1914 to fight monopolies, and gave it its consumer protection power, a ban on "unfair or deceptive acts or practices," in 1938. [26] With no federal privacy law, that one clause has become the country's main privacy tool, and it reaches more than you might think. The 2024 location cases were brought as unfairness cases, which don't require catching a company in a lie. [12]

But the FTC has no general power to fine a company for a privacy violation, its orders mostly govern what a company does next, and in 2025 the President fired its Democratic commissioners. In June 2026 the Supreme Court said he could. [27] [28] [29] (I go through what the agency can and can't do in my piece on the FTC.)
Consent no one can give
Underneath all of this is the idea that you agreed. You clicked "I agree," so what happens next is on you. But in national surveys, most people online believed that a site with a privacy policy wouldn't share their information, which gets it backwards. [30] Reading every privacy policy you encounter would take about 244 hours a year, roughly 40 minutes a day. [31] Solove calls the whole approach privacy self-management. It asks each person to weigh every company's practices one at a time, which no one can actually do, so the consent it produces "is often not meaningful." [32]
The legal picture A doctrine from the 1970s decides whether your records are protected. A law from 1986 governs your email. An agency founded in 1914 polices privacy with a clause added in 1938. And all of it assumes you read and understood policies no one has time to read. Most of this law wasn't written with the data economy in mind, and the parts that try to address it are still catching up.

Part IV: What It Adds Up To

Each piece on its own looks small. The risk comes from putting them together, and courts have started to see it.

The whole reveals more than the parts
For most of its history, Fourth Amendment law judged each piece of information on its own. In 1983, in United States v. Knotts, the Supreme Court held that a person driving on public roads has no reasonable expectation of privacy in where they go. [33] In the 2012 GPS tracking case United States v. Jones, Justice Sotomayor pushed back. Weeks of tracking, she wrote, can reflect "a wealth of detail about her familial, political, professional, religious, and sexual associations." She added, "Awareness that the Government may be watching chills associational and expressive freedoms." [34]

That's the answer to the nothing-to-hide argument in two sentences. One location point is trivial, but a month of them shows where you sleep, who you see and which doctor you visit, and knowing you're watched changes what you do. Six years later, in Carpenter, the Court quoted the first of those lines. [22]
What one person's file can hold
Put the sources in this piece together and a stranger can learn your name, address, phone number and relatives from a broker, your daily routine from location data, years of conversations from an old email account and working passwords from past breaches. None of it takes special skills or much money.

An address plus someone with a reason to find you, an abusive ex or a person with a grudge, becomes a safety problem, which is what happened to Judge Salas's family. A location history plus a detective becomes evidence, even against someone who did nothing, as Jorge Molina learned. An email archive plus a lawsuit becomes material you can't take back.
When it goes wrong, there's little you can do
There's no federal privacy law and no general right to sue over how your data is used. About 20 states have consumer privacy laws in force, and four more take effect by 2028, but only California's lets you sue, and only after certain data breaches. The rest are enforced by the state. [35] In most places you can't sue a people-search site for listing your address. New Jersey's Daniel's Law, named for Judge Salas's son, is a rare exception, and it covers only judges, prosecutors, police officers and a few others. [36] The FTC's location cases ended in orders about what the companies do next, not payments to the people whose data was sold. [12]

So for most people, the protection that works is prevention, keeping the data from being collected or from being easy to find.

Part V: What You Can Do

You can't opt out of the data economy, but you can shrink your part of it. None of these steps is dramatic, and together they close off a lot of what this piece describes.

Limit what your phone shares
Turn off location for apps that don't need it, and precise location for apps that only need your city. Cut off your advertising ID, the tag that lets brokers connect your location from one app to the next, and delete the free apps you don't use. I go through the settings for iPhone and Android in my piece on the government buying data.
Take your address off people-search sites
If you live in California, one request through DROP tells every registered broker to delete you and keep deleting you. Everywhere else, you opt out one site at a time. Either way, listings built from public records stay up until you remove them yourself, and they come back, so search for yourself again every few months. (I go through what DROP removes and what it leaves behind in my piece on DROP.)
Break the chain between your accounts
Give every account its own long password, which a password manager makes practical, and add a passkey or a security key wherever you can. Check every email address you use at Have I Been Pwned, and replace any password you used with an address that shows up there. [19] The FBI director's case shows what happens when this gets skipped.
Keep less, and keep it encrypted
Delete old email you don't need, since what isn't stored can't be demanded, bought or leaked. When you choose tools, pick ones that collect less and encrypt more. I compare email providers, messaging apps, notes apps and photo services, and explain how encryption works, in other pieces.
Look yourself up first
Search your name, your address and your phone number the way a stranger would, and see what comes up. It's the quickest way to learn which of these steps matter most for you.

Conclusion

None of the people in this piece was hiding anything. What hurt them was information about them in someone else's hands.

Who decides what your data means
Privacy protects ordinary people from ordinary information used against them. Right now, for most Americans, companies collect by default, brokers sell what they gather and the government can buy what it would need a warrant to take. The law is starting to move, with Chatrie, California's DROP and new state laws, but slowly. Until it catches up, the information that can't be used against you is the information that was never collected, or that you've already cleaned up. Most people have never seen the whole picture of what's out there about them, and that picture is where any real fix begins.

References

  1. [1] Jennifer Valentino-DeVries, Tracking Phones, Google Is a Dragnet for the Police, N.Y. Times (Apr. 13, 2019), reprinted in Boston Globe, bostonglobe.com ("after he spent nearly a week in jail, the case against Molina fell apart").
  2. [2] Jon Schuppe, Google Tracked His Bike Ride Past a Burglarized Home. That Made Him a Suspect., NBC News (Mar. 2020), nbcnews.com.
  3. [3] Gov. Murphy Signs Daniel's Law After Son of Judge Esther Salas Killed in Home Ambush, CBS New York (Nov. 20, 2020), cbsnews.com (authorities said the gunman found the judge's home through personal information posted online).
  4. [4] Suzanne Smalley, Minnesota Lawmaker's Alleged Killer Had List of Data Broker Websites in Car, FBI Says, The Record (June 17, 2025), therecord.media (the sites on the list provide residential addresses and relatives' names).
  5. [5] Daniel J. Solove, Why Privacy Matters Even if You Have "Nothing to Hide", Chron. Higher Educ. (May 2011), chronicle.com; see also Daniel J. Solove, "I've Got Nothing to Hide" and Other Misunderstandings of Privacy, 44 San Diego L. Rev. 745 (2007), digital.sandiego.edu.
  6. [6] Latanya Sweeney, Simple Demographics Often Identify People Uniquely 2 (Carnegie Mellon Univ., Data Privacy Working Paper No. 3, 2000), dataprivacylab.org (87% of the U.S. population could be uniquely identified by ZIP code, date of birth and sex, using 1990 Census data).
  7. [7] Daniel C. Barth-Jones, The "Re-Identification" of Governor William Weld's Medical Information: A Critical Re-Examination of Health Data Identification Risks and Privacy Protections, Then and Now (July 2012), fpf.org (the 1997 re-identification "has had a profound impact on the development of de-identification provisions" in the HIPAA Privacy Rule).
  8. [8] Press Release, Cal. Privacy Prot. Agency, Privacy Momentum Builds: 300,000+ Californians Sign Up for DROP as Registered Data Brokers Hit a Record High (June 2, 2026), privacy.ca.gov (581 registered brokers, the most since the registry began in 2020).
  9. [9] Protecting Americans from Harmful Data Broker Practices (Regulation V), 89 Fed. Reg. 101,402 (proposed Dec. 13, 2024), withdrawn May 15, 2025 (the Bureau said the rule was "not necessary at this time").
  10. [10] Helen Nissenbaum, Privacy as Contextual Integrity, 79 Wash. L. Rev. 119 (2004), digitalcommons.law.uw.edu ("Contextual integrity ties adequate protection for privacy to norms of specific contexts").
  11. [11] Chris Jay Hoofnagle, Big Brother's Little Helpers: How ChoicePoint and Other Commercial Data Brokers Collect and Package Your Data for Law Enforcement, 29 N.C. J. Int'l L. & Com. Reg. 595 (2004), ssrn.com (based on more than 1,500 pages obtained from nine federal agencies under the Freedom of Information Act; arguing that the Privacy Act should cover commercial data brokers).
  12. [12] Press Release, Fed. Trade Comm'n, FTC Order Prohibits Data Broker X-Mode Social and Outlogic from Selling Sensitive Location Data (Jan. 9, 2024), ftc.gov (a "first-ever ban on the use and sale of sensitive location data"); Mobilewalla, Inc.; Analysis of Proposed Consent Order to Aid Public Comment, Fed. Reg. (Dec. 6, 2024), federalregister.gov.
  13. [13] Press Release, Fed. Trade Comm'n, FTC Finalizes Order Prohibiting Gravy Analytics, Venntel from Selling Sensitive Location Data (Jan. 14, 2025), ftc.gov (exceptions "in limited circumstances involving national security or law enforcement").
  14. [14] Suzanne Smalley, Broker Sold Planned Parenthood Visitor Location Data to Pro-Life Group, Senator Says, The Record (Feb. 13, 2024), therecord.media (Sen. Wyden's letter to the FTC and SEC).
  15. [15] Yves-Alexandre de Montjoye et al., Unique in the Crowd: The Privacy Bounds of Human Mobility, 3 Sci. Reps. 1376 (2013), nature.com (15 months of data on 1.5 million people; four points in time and place were enough to single out 95% of them).
  16. [16] Ali Farzanehfar, Florimond Houssiau & Yves-Alexandre de Montjoye, The Risk of Re-identification Remains High Even in Country-Scale Location Datasets, 2 Patterns 100204 (2021), ncbi.nlm.nih.gov (estimating that four points would single out 93% of people in a 60-million-person dataset, with a lower bound of 22%, rising to 87% with five points).
  17. [17] Fed. R. Civ. P. 26(b)(1), law.cornell.edu (discovery reaches "any nonprivileged matter that is relevant to any party's claim or defense," proportional to the needs of the case).
  18. [18] 18 U.S.C. § 2703(a)-(d), law.cornell.edu (Stored Communications Act, part of the Electronic Communications Privacy Act of 1986).
  19. [19] Troy Hunt, Have I Been Pwned, haveibeenpwned.com (17,846,363,019 pwned addresses from 1,045 breached websites, as of Oct. 2026).
  20. [20] United States v. Miller, 425 U.S. 435 (1976) (no Fourth Amendment protection for bank records, which the depositor conveyed to the bank).
  21. [21] Smith v. Maryland, 442 U.S. 735, 743-44 (1979) (no reasonable expectation of privacy in the numbers dialed, because they are voluntarily conveyed to the phone company).
  22. [22] Carpenter v. United States, 585 U.S. 296 (2018), supremecourt.gov (when the government tracks a phone's location "it achieves near perfect surveillance"; at trial, an FBI agent "produced maps that placed Carpenter's phone near four of the charged robberies").
  23. [23] Chatrie v. United States, No. 25-112 (U.S. June 29, 2026), supremecourt.gov (opinion of the Court by Kagan, J.).
  24. [24] United States v. Warshak, 631 F.3d 266, 288 (6th Cir. 2010) (email content is protected by the Fourth Amendment regardless of how long it has been stored).
  25. [25] Email Privacy Bill Unanimously Passes U.S. House, Fortune (Reuters) (Apr. 27, 2016), fortune.com (the Email Privacy Act passed 419 to 0 and would have required a warrant for email more than 180 days old; it never passed the Senate).
  26. [26] Chris Jay Hoofnagle, Federal Trade Commission Privacy Law and Policy (Cambridge Univ. Press 2016), cambridge.org (the FTC's founding in 1914 and the Wheeler-Lea Amendments of 1938, which added "unfair or deceptive acts or practices").
  27. [27] 15 U.S.C. § 45, law.cornell.edu (civil penalties under § 45(m) generally depend on a prior rule or order; the unfairness standard is codified at § 45(n)).
  28. [28] Trump Admin's Removal of FTC Commissioners Could Shift Privacy Efforts, The Record (Mar. 2025), therecord.media.
  29. [29] Trump v. Slaughter, No. 25-332 (U.S. June 29, 2026), oyez.org (overruling Humphrey's Executor v. United States, 295 U.S. 602 (1935), as applied to the FTC).
  30. [30] Joseph Turow, Deirdre K. Mulligan & Chris Jay Hoofnagle, Research Report: Consumers Fundamentally Misunderstand the Online Advertising Marketplace (Annenberg Sch. for Commc'n & Samuelson L., Tech. & Pub. Pol'y Clinic, Oct. 2007), law.berkeley.edu (57% of adults online in 2003 and 59% in 2005 believed a site with a privacy policy would not share their information).
  31. [31] Aleecia M. McDonald & Lorrie Faith Cranor, The Cost of Reading Privacy Policies, 4 I/S: J.L. & Pol'y for Info. Soc'y 543 (2008) (point estimate of 244 hours a year to read the privacy policies a person encounters, about 40 minutes a day).
  32. [32] Daniel J. Solove, Privacy Self-Management and the Consent Dilemma, 126 Harv. L. Rev. 1880 (2013), ssrn.com ("Consent to collection, use, and disclosure of personal data is often not meaningful").
  33. [33] United States v. Knotts, 460 U.S. 276, 281 (1983) (a person traveling on public roads "has no reasonable expectation of privacy in his movements from one place to another").
  34. [34] United States v. Jones, 565 U.S. 400, 415-18 (2012) (Sotomayor, J., concurring), law.cornell.edu.
  35. [35] How Many States Have Data Privacy Laws?, Privacy Law Map (updated Oct. 12, 2026), privacylawmap.com (20 state laws in force and 4 not yet effective; only California's allows private suits, for certain breaches).
  36. [36] Nikita Biryukov, NJ Supreme Court Opinion on Privacy Law Seen as Win for Data Brokers, N.J. Monitor (Aug. 12, 2026), newjerseymonitor.com (who Daniel's Law covers, the right to sue when an address isn't removed within 10 days, and the pending federal challenge).

Updated October 2026. This revision answers the nothing-to-hide argument directly, through the cases of Jorge Molina, Zachary McCoy, Judge Esther Salas's family and the 2025 Minnesota shootings, and adds a section on what you can do. It adds the Supreme Court's decision in Chatrie v. United States, the 2026 ruling on the FTC's commissioners, California's DROP and the state privacy laws now in force. It corrects how the FTC's authority works, the source of Chris Hoofnagle's argument about brokers, where the third-party doctrine began, how email discovery works and several figures, cites a source for every claim and links to related pieces on this site.

Disclaimer: This analysis is for educational and informational purposes only. It is not legal advice. The author is not a licensed attorney. It draws on court opinions, statutes, peer-reviewed research, government enforcement actions and news reporting, cited accordingly. Pending matters, including the federal challenge to New Jersey's Daniel's Law, reflect publicly available information as of October 2026.
Field Assessment

Proton Mail vs Tuta Mail: What a privacy advocate looks at

Both encrypt your inbox and market themselves as the antidote to Gmail. But jurisdiction, metadata exposure, encryption scope, and real world court orders tell a more complicated story. This is a field by field comparison.

D David
January 2026
Updated October 2026
~15 min read
Both providers promise the same thing: end-to-end encryption, open source code with independent audits, European jurisdiction, and a guarantee that not even the company itself can read your email. Proton Mail (established in Switzerland, 2014) and Tuta Mail (established in Germany, 2011) are the two most recommended encrypted email providers on virtually every privacy list. But recommendation lists rarely examine the differences that matter under legal pressure, specifically what metadata, or transactional data, each provider can see, what a court can compel them to hand over, how their encryption protocols actually differ at a technical level, and what has happened in the real cases where governments came knocking. This analysis attempts to cover all of that. Sources include official privacy policies, published transparency reports, court records, open source code repositories, and the companies' own security documentation.
Company & Jurisdiction Encryption Protocols What Gets Encrypted What Can Be Handed Over Real Cases Features & Pricing Per-Provider Summary Recommendations
PROTON MAIL (Switzerland)
TUTA MAIL (Germany)
ADVANTAGE / ENCRYPTED
PARTIAL / CONDITIONAL
EXPOSED / RISK

Company & Jurisdiction

Jurisdiction determines what a government can legally force a provider to do. It is arguably more important than the encryption itself, because encryption protects content, but jurisdiction determines what happens to everything around it.

Legal Entity
Proton MailProton AG, Geneva, Switzerland
Tuta MailTutao GmbH, Hanover, Germany
Governing Privacy Law The primary legislation that determines what data can be compelled
Proton MailSwiss Federal Act on Data Protection (FADP) + BÜPF (telecom surveillance law) [1]
Tuta MailGerman BDSG + EU GDPR + StPO (criminal procedure code) [2]
Intelligence Alliance Membership Whether the country participates in multinational intelligence sharing Shared intelligence increases the pool of agencies that may request your data.
Proton MailNOT A MEMBER of Five, Nine, or Fourteen Eyes
Tuta MailFOURTEEN EYES member
Foreign Data Request Process How a foreign government (e.g. FBI, Europol) obtains your data
Proton MailMust go through Mutual Legal Assistance Treaty (MLAT), then Swiss court approval required [3]
Tuta MailMust obtain a German court order. German companies cannot hand data directly to foreign agencies [2]
Data Retention Law for Email Mandatory retention creates data that exists solely for law enforcement access.
Proton MailNO Swiss court ruled (Oct 2021) email providers are not telecoms and not subject to retention [4]
Tuta MailNO No data retention law applies to email in Germany. Two courts affirmed Tuta is not subject to ISP retention rules [5]
Gag Order Risk Whether authorities can prevent the provider from telling you about a data request
Proton MailPOSSIBLE Temporary delay, but Swiss law requires eventual notification [3]
Tuta MailNO German law does not permit forcing companies to submit to a gag order (per Tuta's transparency report) [6]
Encryption Backdoor Risk Whether a law exists or is proposed that could compel weakening of encryption
Proton MailUNCLEAR No current law, but Switzerland is not bound by ECHR encryption ruling
Tuta MailPROTECTED ECHR (2024) ruled EU nations cannot mandate weakening of E2EE. Germany is bound by this. [2]
Legal Orders Received (latest available) Volume indicates how often the provider's data is targeted.
Proton Mail~11,000+ in 2024, compliance rate ~94% [7]
Tuta MailSignificantly lower volume (exact figures in semi-annual transparency report) [6]
User Base
Proton Mail100+ million accounts
Tuta Mail~10 million accounts
Note Everyone points to Switzerland and the Five Eyes when comparing Proton to US-based providers. And yes, Switzerland is not in the alliance. But that does not mean Swiss data is untouchable. Foreign agencies request Swiss data through mutual legal assistance treaties all the time. We saw Proton received over 11,000 legal orders in 2024 and complied with roughly 94% of them. Think about that for a second. What Switzerland gives you is due process and not immunity. A warrant has to clear more hurdles to reach your inbox. But the hurdles are not walls. And lately, they seem to be getting shorter. In early 2025, the Swiss Federal Council proposed changes to surveillance law that would require services with over 5,000 users to identify their customers, retain data for six months, and decrypt communications on request when the provider holds the keys. Proton's CEO called the proposal "extreme" and said it would make Swiss services less private than Google. As a company who built much of their reputation on Swiss privacy, Proton responded by starting to move physical infrastructure out of Switzerland, starting with its AI assistant Lumo, which launched on German servers in July 2025. So when the company that built its brand on Swiss jurisdiction starts relocating away from Swiss jurisdiction, that tells you everything about how much weight to put on location alone.

Encryption Protocols - The Technical Layer

Both providers use end-to-end encryption. The difference is in what standard they chose, what that standard can and cannot encrypt, and how far ahead each has moved on post-quantum readiness. These are not cosmetic differences, they determine the scope of what the server can never see.

Encryption Standard The foundational protocol governing how messages are encrypted
Proton MailOpenPGP (public standard) [8]
Tuta MailTutaCrypt (proprietary hybrid protocol) [9]
Symmetric Encryption
Proton MailAES-256
Tuta MailAES-256 (CBC mode + HMAC-SHA-256) [9]
Asymmetric Encryption (classical)
Proton MailElliptic-curve keys on Curve25519 by default. Accounts created before 2021 may still have RSA keys [19]
Tuta MailX25519 (ECDH), replaced RSA-2048 in 2024 [9]
Post-Quantum Encryption Protection against "harvest now, decrypt later" attacks by future quantum computers Data encrypted today with only classical algorithms may be decryptable within 10 to 15 years.
Proton MailIN DEVELOPMENT No production deployment for email yet
Tuta MailLIVE since March 2024, CRYSTALS-Kyber (Kyber-1024) + X25519 hybrid [10]
Key Derivation Function How your password is converted into encryption keys
Proton Mailbcrypt
Tuta MailArgon2 (more resistant to GPU/ASIC attacks) [9]
PGP Interoperability Whether you can exchange encrypted mail with any PGP user worldwide
Proton MailYES Full PGP/MIME and PGP/Inline support [8]
Tuta MailNO Proprietary protocol, no PGP support [11]
Open Source
Proton MailYES All client apps + encryption libraries
Tuta MailYES All client apps + encryption libraries
Note Proton chose OpenPGP for interoperability which means any PGP user worldwide can exchange encrypted mail with a Proton user. Tuta chose a proprietary protocol for encryption scope meaning they can encrypt subject lines, sender names, and more metadata that PGP structurally cannot. This is a genuine trade-off with no objectively correct answer. It depends on your threat model.

What Gets Encrypted - Field by Field

This is where the choice of encryption protocol creates real, measurable differences. Proton's adherence to OpenPGP means that certain email headers are structurally excluded from end-to-end encryption which can be revealing. Tuta's proprietary protocol lets it encrypt fields that PGP cannot. Thus every field listed here as "not E2EE" is a field the provider can theoretically read or hand over under court order.

Email Body + Attachments Core content, encrypted by both.
Proton MailE2EE
Tuta MailE2EE
Subject Line Subject lines reveal what you're writing about without reading the body. "Meeting with attorney re: whistleblower complaint" is devastating metadata.
Proton MailZERO-ACCESS encrypted at rest, NOT end-to-end encrypted. Proton can technically access it under court order. [12]
Tuta MailE2EE Encrypted on device before transmission. Tuta cannot read it. [11]
Sender & Recipient Names The display name associated with the sender/recipient, not the email address itself
Proton MailZERO-ACCESS only, not E2EE
Tuta MailE2EE [11]
Sender & Recipient Email Addresses Structurally required by SMTP, no provider can E2EE this Reveals who is communicating with whom.
Proton MailPLAINTEXT required by email protocol
Tuta MailPLAINTEXT required by email protocol
Timestamps (sent/received) Reveals when you communicate and how often.
Proton MailPLAINTEXT
Tuta MailPLAINTEXT
Contacts / Address Book
Proton MailPARTIAL Some fields E2EE, email addresses and names NOT encrypted [13]
Tuta MailFULLY E2EE All fields including name, phone, address, birthday [11]
Attachment Names A file named "whistleblower_evidence_final.pdf" is informative even without reading it.
Proton MailACCESSIBLE to Proton per privacy policy [14]
Tuta MailE2EE
Key difference Proton Mail's privacy policy explicitly states it has access to: sender and recipient email addresses, the IP address incoming messages originated from, attachment names, message subjects, and message sent/received times. [14] Tuta encrypts subject lines, sender/recipient names, and attachment data end-to-end. The only metadata Tuta cannot encrypt is email addresses and timestamps, because the email protocol itself requires them to route messages. [11]
Under a court order
What Can Actually Be Handed Over
This is the section that addresses courts and warrants. Again, encryption protects content. But when a court order arrives, the question becomes: what does the provider actually have? What exists on their servers in a form they can read?
Email Content (body + attachments)
ProtonCANNOT HAND OVER E2EE, no keys
TutaCANNOT HAND OVER E2EE, no keys
Email Subject Lines The single biggest practical difference between these two providers.
ProtonCAN HAND OVER Not E2EE. Proton confirms this explicitly. [12]
TutaCANNOT HAND OVER E2EE
Sender/Recipient Email Addresses + Timestamps
ProtonCAN HAND OVER
TutaCAN HAND OVER
IP Address Your IP address reveals your physical location and ISP.
ProtonNOT logged by default. CAN be compelled to start logging for a specific account going forward. [4]
TutaNOT logged by default. CAN be compelled via TKÜ order. Session IPs encrypted and auto-deleted after 1 week. [6]
Recovery Email Address If you used a personal email as recovery, this single field can deanonymize you entirely.
ProtonCAN HAND OVER (if user provided one, it is optional) [15]
TutaNOT APPLICABLE Tuta does not use recovery emails. Uses recovery code instead.
Payment Data Credit card info links directly to your real identity.
ProtonCAN HAND OVER if paid by credit card. Accepts crypto and cash as alternatives. [16]
TutaCAN HAND OVER if paid by credit card. Crypto via gift card partner (Proxystore). No direct crypto.
Unencrypted Incoming Emails (future, real-time surveillance) This is a live surveillance capability, not historical data.
ProtonUNCLEAR Swiss law allows interception orders. Proton's architecture encrypts incoming mail immediately with zero-access.
TutaYES German BGH ruled (2021) Tuta must provide unencrypted copies of future non-E2EE mail for specific accounts under TKÜ orders. E2EE mail remains protected. [17]
Attachment Names
ProtonCAN HAND OVER [14]
TutaCANNOT E2EE
Critical Tuta's 2021 German Federal Court ruling is the most significant jurisdiction test either provider has faced. Tuta was ordered to build a function that copies unencrypted incoming and outgoing emails from a specific account before they are encrypted. This only affects non-E2EE mail (mail to/from external providers). Emails between Tuta users remain fully E2EE and were explicitly excluded from the court's reach. Tuta carried the fight to the Federal Court of Justice and lost. The court held that providers like Tuta count as telecommunications operators and must build the monitoring function. The end-to-end encrypted mail stayed out of reach, but not because the court protected it. It stayed out of reach because Tuta cannot decrypt what only the user holds the key to, so there was nothing for the order to take. The law reached exactly as far as the architecture allowed, and no further. That is the lesson worth keeping. A constraint the provider cannot lift is the only promise a court cannot override. [17]

Jurisdiction Under Pressure - Real Cases

These are the documented cases where each provider's jurisdiction was tested by law enforcement, listed chronologically. Every case here is drawn from court records, official company statements, or investigative journalism.

2021 PROTON French Climate Activist (Youth for Climate)

French authorities, working through Europol and Swiss MLAT channels, obtained a Swiss court order that compelled Proton to begin logging the IP address of a specific Proton Mail account associated with the Youth for Climate movement in Paris. The activist was involved in occupying buildings in the Place Sainte Marthe area. Proton complied, as it had no legal mechanism to refuse. [4]

Data handed over: IP address (prospective logging) + recovery email address + device type information.
Result: Activist was identified and arrested by French police.
Aftermath: Proton was forced to remove "we do not keep any IP logs" from its website. They updated their privacy policy to state that IP logging can be compelled by Swiss court order. In the process a Swiss court ruled (Oct 2021) that email providers are not telecoms and limited any future data retention obligations.
2020-2021 TUTA Cologne Blackmail Case (Bundesgerichtshof ruling)

A blackmail email was sent from a Tuta account to an auto supplier. The Cologne Regional Court ordered Tuta to develop a monitoring function for the specific account, copying unencrypted incoming and outgoing emails before they were encrypted. Tuta argued it was not a telecommunications provider and should not be subject to telecom interception laws. The Hanover Regional Court had previously agreed with this position. But the German Federal Court of Justice (BGH) ruled against Tuta, finding that "over the top" email services qualify as telecoms under German criminal procedure law. [17]

Data handed over: Tuta was compelled to build a forward looking monitoring capability for non-E2EE mail on specific accounts.
Protected: All previously stored encrypted email remained inaccessible. E2EE emails between Tuta users were explicitly excluded from the court order. The court could not compel decryption.
Aftermath: Tuta publicly stated this proves why E2EE matters, as only non-encrypted mail was exposed. Tuta continues to fight the classification of email providers as telecoms.
2024 PROTON Catalan Independence Activist (Democratic Tsunami)

Spanish police (Guardia Civil) sought to identify a pseudonymous member of the Catalan pro-independence movement known as "Xuxo Rondinaire," who was suspected of planning protest actions related to King Felipe VI's visit. The request went through the appropriate Europol to Swiss authorities, who issued a binding order to Proton. Proton was forced to hand over the only user-identifiable information it had: the recovery email address on the account, which was an Apple iCloud address. Apple then provided Spanish authorities with the individual's full name, two home addresses, and a linked Gmail account. [15]

Data handed over: Recovery email address (iCloud).
Result: Full identification and arrest via Apple's data linked to the recovery email.
Key lesson: Proton's encryption held, no email content was exposed. The deanonymization came entirely from a user-provided recovery email. Proton's CEO noted: "Proton provides privacy by default, not anonymity by default."
2025-2026 PROTON Stop Cop City / Defend the Atlanta Forest (FBI)

The FBI was investigating arson, vandalism, and doxxing linked to the Stop Cop City movement in Atlanta, used the MLAT process to compel Proton through Swiss authorities to hand over payment data associated with a specific Proton Mail account affiliated with Defend the Atlanta Forest. The payment data, a credit card transaction, was sufficient to identify the account holder. The individual does not appear to have been charged with a crime at the time of the disclosure. [16]

Data handed over: Payment/credit card transaction data linked to the account.
Result: FBI identified the account holder. Search warrant was prepared for execution at Atlanta's airport.
Key lesson: Payment metadata is not protected by E2EE. Proton accepts cryptocurrency and cash payments as alternatives. If this user had paid with Monero or cash, the FBI would have had nothing.

The pattern across all four cases is consistent: end-to-end encryption held every time. No government obtained the contents of a single encrypted email from either provider. What was obtained in every case was metadata, including IP addresses, recovery emails, payment data, and non-E2EE message copies. The lesson is not that these providers failed but that encryption protects content, and only content. Everything around it, every data point you provide at signup, every payment method you choose, every field that falls outside the encryption envelope, is fair game under a court order.

Features, Ecosystem & Pricing

Security architecture is the priority. But people also need to use these products daily to garner maximum value and utlity. This section covers the practical differences that affect everyday use.

Free Plan Storage
Proton Mail1 GB (shared with Drive)
Tuta Mail1 GB
Paid Plan Starting Price
Proton Mail€3.99/month (Mail Plus), 15 GB
Tuta Mail€3/month (Revolutionary), 20 GB
Bundled Ecosystem
Proton Mail MORE EXTENSIVE VPN + Drive + Calendar + Pass (password manager) + Wallet, all under one account
Tuta MailLIMITED Calendar only. Tuta Drive planned (€1.5M German gov grant), no release date.
Desktop Clients
Proton MailDesktop app (paid only) + Bridge for IMAP/SMTP (paid only)
Tuta MailNative desktop clients for Linux, Windows, macOS (free)
IMAP / SMTP Support Needed for third party email client integration (Thunderbird, Outlook, Apple Mail)
Proton MailYES via Proton Bridge (paid plans only)
Tuta MailNO Proprietary protocol only
Anonymous Signup
Proton MailPARTIAL May require phone/email verification in some cases
Tuta MailYES No personal info required. No recovery email concept. [6]
F-Droid Availability (no Google dependencies)
Proton MailAvailable on F-Droid
Tuta MailAvailable since 2018 First email provider on F-Droid. Zero Google dependencies, no Google Push. [18]
Encrypted Full-Text Search
Proton MailSubject/metadata only on web. Content search on desktop/mobile.
Tuta MailYES Encrypted full-text search on all platforms
Note Proton's ecosystem is substantially broader, with VPN, Drive, Calendar, Pass, and Wallet all under one account. If you want a single provider replacing Google's entire suite, Proton is the only realistic option. Tuta's focus is narrower but deeper on the email specific encryption front.

Per-Provider Summary

Proton Mail

BESTEcosystem breadth. VPN, Drive, Calendar, Pass, and Wallet under one account, the closest thing to a privacy respecting Google replacement that exists.

BESTPGP interoperability. You can exchange encrypted email with any PGP user on Earth, not just other Proton users. This matters for journalists and researchers who correspond with varied sources.

PROSwiss jurisdiction requires MLAT for foreign requests, creating meaningful procedural friction. Switzerland is not in any intelligence sharing alliance.

PROTor onion site for IP anonymous access. Combined with Proton VPN, the IP logging risk is fully mitigable by the user.

CONSubject lines are NOT end-to-end encrypted. Under a valid Swiss court order, Proton can hand over the subject lines of every email in your inbox. This is a PGP limitation, not a Proton decision, but it is a real exposure.

CONRecovery email is a deanonymization vector. The 2024 Catalan case proved this. Recovery email is optional, but Proton prompts users to add one.

CONPayment data exposure. The 2026 Stop Cop City case showed that credit card payment metadata alone was sufficient for the FBI to identify a user.

WARN~11,000 legal orders in 2024 with a ~94% compliance rate. Partly a function of scale, but volume matters.

Tuta Mail

BESTEncryption scope. Subject lines, sender names, recipient names, attachment data, and the entire address book are E2EE. Tuta encrypts more fields than any other email provider on the market.

BESTPost-quantum encryption, live since March 2024. TutaCrypt's hybrid protocol (CRYSTALS-Kyber + X25519) is the first production deployment of quantum resistant email encryption.

BESTNo recovery email concept. Uses a recovery code instead. The Catalan case deanonymization vector does not exist in Tuta's architecture.

PROArgon2 key derivation, more resistant to GPU/ASIC brute force attacks than Proton's bcrypt.

PROECHR encryption protection. As an EU based provider, Tuta is protected by the 2024 European Court of Human Rights ruling banning laws that weaken E2EE.

CONGermany is a Fourteen Eyes member. Intelligence sharing between allied nations means German agencies could theoretically receive and act on foreign intelligence.

CONBGH ruling created a real-time monitoring precedent. Tuta can be ordered to copy future non-E2EE mail before encryption for specific accounts.

CONNo PGP support. You cannot exchange encrypted email with PGP users outside the Tuta ecosystem.

WARNNarrower ecosystem. Email + Calendar only. No VPN, no file storage (yet), no password manager.

Recommendations by Threat Model

Choose Tuta Mail if:
Your primary threat is the content of your communications being subpoenaed or surveilled. So if you're a journalist protecting sources, a lawyer handling sensitive cases, a whistleblower, an activist operating under government scrutiny, etc. Tuta's encryption scope is objectively wider. Subject line encryption alone could be the difference between a subpoena that reveals plans and intentions, and one that reveals nothing. The absence of a recovery email field eliminates the single most damaging deanonymization vector demonstrated in real cases. Post-quantum encryption means data intercepted today cannot be decrypted by future quantum computers. So if maximum encryption scope is your priority, Tuta is the stronger choice.
Choose Proton Mail if:
You need a comprehensive privacy ecosystem that replaces Google Workspace, you want a more streamlined experience, or your threat model prioritizes jurisdictional friction over encryption scope. Proton's VPN, Drive, Calendar, Pass, and Wallet under a single account is unmatched. PGP interoperability means you can receive encrypted mail from any security conscious sender, not just Proton users. Switzerland's non-membership in intelligence alliances and its MLAT process create real procedural barriers, not immunity, but friction that matters. If you need a fully private daily driver ecosystem and communicate with diverse contacts, Proton is the more practical choice.
Regardless of which you choose:
Never add a personal recovery email. The Catalan case proved this is the single most dangerous field on any account. Use a recovery code or if you must add a recovery email, create a separate anonymous email for that sole purpose.

Never pay with a credit card if anonymity matters. The Stop Cop City case proved payment metadata alone can identify you. Use cryptocurrency (Proton accepts it directly; Tuta accepts it via gift cards) or cash.

Access via Tor or a trustworthy VPN. Both providers can be compelled to log IP addresses for specific accounts under court order. The only way to neutralize this is to never connect from your real IP in the first place.

Understand that E2EE only protects E2EE traffic. Emails to and from Gmail, Outlook, or Yahoo are not end-to-end encrypted. Tuta's BGH ruling demonstrated that non-E2EE mail can be intercepted before encryption. If your correspondent is on Gmail, the email content is visible to Google regardless of what you use.

Both providers are excellent and light years ahead of Gmail, Outlook, or Yahoo. The differences between them matter for high threat users. For the vast majority of people, switching from Gmail to either Proton or Tuta is the single biggest privacy improvement available in email today.

References

  1. [1] Proton, Information for Law Enforcement, proton.me/legal/law-enforcement.
  2. [2] Tuta, EU Data Privacy Protections: Why Tuta Is Based in Germany, tuta.com/blog/data-privacy-germany.
  3. [3] Proton, Transparency Report, proton.me/legal/transparency.
  4. [4] Proton, Important Clarifications Regarding Arrest of Climate Activist (2021), proton.me/blog/climate-activist-arrest (Proton logged an account's IP address after a binding Swiss legal order).
  5. [5] Court Rules Encrypted Email Provider Tutanota Must Monitor Messages, CyberScoop (2021), cyberscoop.com.
  6. [6] Tuta, Transparency Report & Warrant Canary, tuta.com/blog/transparency-report.
  7. [7] Proton, Transparency Report, supra note 3 (aggregate legal-order statistics, 2017-2024).
  8. [8] Proton, How Proton Mail Messages Are Encrypted, proton.me/support/proton-mail-encryption-explained.
  9. [9] Tuta, Everything You Need to Know About Tuta's Encryption, tuta.com/encryption.
  10. [10] Tuta, Tuta Launches Post-Quantum Cryptography for Email (Mar. 2024), tuta.com/blog/post-quantum-cryptography.
  11. [11] Tuta, Security at Tuta, tuta.com/security.
  12. [12] Proton, Does Proton Mail Encrypt Email Subjects?, proton.me/support/does-protonmail-encrypt-email-subjects.
  13. [13] Proton, Proton's End-to-End Encryption, proton.me/security/end-to-end-encryption.
  14. [14] Proton, Proton Mail Privacy Policy, proton.me/mail/privacy-policy.
  15. [15] Lorenzo Franceschi-Bicchierai, Encrypted Services Apple, Proton, and Wire Helped Spanish Police Identify Activist, TechCrunch (May 8, 2024), techcrunch.com (Swiss legal process compelled Wire and Proton to disclose the account's recovery email, which led Apple to provide the user's name and address; message content stayed encrypted).
  16. [16] Joseph Cox, Proton Mail Helped FBI Unmask Anonymous "Stop Cop City" Protester, 404 Media (Mar. 5, 2026), 404media.co (Proton provided account payment data to Swiss authorities, who passed it to the FBI; encryption protected message content, not the account metadata).
  17. [17] Zack Whittaker, German Secure Email Provider Tutanota Forced to Monitor an Account After Regional Court Ruling, TechCrunch (Dec. 8, 2020), techcrunch.com (order required monitoring of one account's future, unencrypted mail; it did not break existing end-to-end encryption). The 2021 appellate ruling is covered at note 5.
  18. [18] Tuta (email), Wikipedia, en.wikipedia.org.
  19. [19] Proton, Elliptic Curve Cryptography, proton.me/support/elliptic-curve-cryptography ("By default, Proton Mail uses Elliptic Curve Cryptography (ECC) keys defined on Curve25519"; accounts created before 2021 may still have RSA keys).

Updated October 2026 to correct Proton Mail's default key type and a typo.

Disclaimer: This blog post is for educational and informational purposes only. It is not legal advice. The author is not a licensed attorney. Consult a qualified legal professional in your jurisdiction for guidance specific to your situation. Pricing accurate as of March 2026. This analysis covers email specific comparisons only. VPN, cloud storage, and other ecosystem products are referenced for context but not independently reviewed here.
Field Assessment

What your notes app knows about you, even when your notes are encrypted

End-to-end encryption protects your note content. It does not protect the metadata your notes generate. Here is a field-by-field breakdown of the metadata collected by Standard Notes, Notesnook, Cryptee, and Joplin, and what it reveals.

D David
January 2026
Updated October 2026
~10 min read
The common assumption when using end-to-end encrypted note's app is that the service cannot see what you write. That is true. But every note you create, modify, or delete still leaves a trail of metadata your notes app can see clearly. Timestamps, file sizes, sync patterns, structural relationships, and in Joplin's case, GPS coordinates.[11] This analysis covers that data trail field by field, across four of the most privacy-focused notes apps available, and one's I personally use. Sources include official documentation, published privacy policies, sync API specifications, and open-source code repositories.
Timestamps Item Identifiers & Structure Note Content Fields Structural & Size Metadata Revision History Joplin-Specific Fields Sync & Operational Metadata Per-Product Summary Final Ranking
STORED PLAINTEXT on server
PARTIALLY EXPOSED or conditional
ENCRYPTED - server sees ciphertext only
NOT STORED / NOT APPLICABLE
CLIENT-SIDE ONLY - never synced

Timestamps

Timestamps are the metadata that matters most operationally. Again, while they do not reveal what you wrote, they do reveal when, how often, and for how long. We have seen in investigative context that is enough to piecemeal networks.

Field Standard Notes Notesnook Cryptee
created_at Exact timestamp when a note was first created [3][11] Reveals when you began writing about a topic. STORED STORED NOT STORED STORED
updated_at / user_updated_time Every modification timestamp, used for sync conflict resolution [3][11] Reveals editing cadence and co-editing patterns. STORED STORED VERSION IDs only STORED
user_created_time vs. server_created_time SN and Joplin store both client-reported AND server-recorded timestamps as two separate records [1][11] The discrepancy between the two can reveal offline editing periods. BOTH STORED BOTH STORED N/A BOTH STORED
deleted_at When a note was trashed. The item is marked deleted, not immediately purged. [3][12] Reveals when you removed sensitive material. STORED STORED NOT CONFIRMED STORED
sync_token / cursor_token SN's internal sync clock that increments on every create or update event, acting as a proxy for edit frequency even without readable timestamps [4] Editing frequency is inferable from token progression. STORED (SN only) N/A N/A N/A
Note Cryptee uses sequential version IDs for conflict resolution rather than human-readable ISO timestamps. That good as it's less revealing. The server cannot tell when a note was written, only that one version followed another. [8]

Item Identifiers & Structure

Identifiers are low-risk in isolation. Their value to an adversary comes from correlation, mapping UUIDs across requests, sessions, and time to build a behavioral profile without reading a single word.

Field Standard Notes Notesnook Cryptee
UUID / Item ID Unique identifier per note, tag, and notebook. Stored in plaintext as a database key. [1][11] Meaningless without content, but correlatable across requests. STORED STORED STORED STORED
content_type Whether an item is a Note, Tag, Component, or Preference. Stored in plaintext for server-side routing. [3][5] The server knows you have X notes, Y tags and Z preferences without reading any of them. STORED ENCRYPTED PARTIAL STORED
items_key_id (SN only) Associates each encrypted note payload with the Items Key UUID that encrypted it [1] Only reveals which key encrypted which note. Useful for key rotation, not revealing. STORED N/A N/A N/A
parent_id / notebook relationship The structural link between a note UUID and its notebook UUID [5][11] Reveals organizational grouping even when folder names are encrypted. ENCRYPTED ENCRYPTED FOLDER COUNT VISIBLE STORED (E2EE off) / ENCRYPTED (E2EE on)
tag relationships UUID-to-UUID associations between notes and tags [5][11] If tag names are encrypted, the count is inferable but the meaning is not. ENCRYPTED ENCRYPTED ENCRYPTED STORED (E2EE off) / ENCRYPTED (E2EE on)
is_deleted flag Soft-delete marker. The item remains in the database as a tombstone until a hard purge runs. [3][12] Deleted notes persist server-side. Standard Notes keeps them 14 days. The others don't say. 14-day tombstone Window unstated NOT CONFIRMED Window unstated

Note Content Fields

This is where all four products perform equally well, and allows them to market some sort of end-to-end encryption. The title, body, tags, and folder names are encrypted in every product when E2EE is properly active. The server holds ciphertext and cannot read any of it. [1][5][8][13]

Field Standard Notes Notesnook Cryptee
Note titleThe visible title of the noteEncrypted in all four when E2EE is active. ENCRYPTED ENCRYPTED ENCRYPTED ENCRYPTED (E2EE on)
Note body / contentFull note textEncrypted in all four when E2EE is active. ENCRYPTED ENCRYPTED ENCRYPTED ENCRYPTED (E2EE on)
Tag namesHuman-readable labels applied to notesThe server sees UUIDs only, and names are encrypted. ENCRYPTED ENCRYPTED ENCRYPTED ENCRYPTED (E2EE on)
Notebook / folder namesNames of organizational containersThe server sees UUIDs only, and names are encrypted. ENCRYPTED ENCRYPTED ENCRYPTED ENCRYPTED (E2EE on)
Note Content protection is consistent across all four products. The privacy differences live in the metadata layers above and below this table, not in the content encryption itself.

Structural & Size Metadata

Remember that even encrypted blob sizes correlate with content length even after encryption. A 200KB blob versus a 2KB blob reveals the notes relative length. Attachment types also reveal what kind of material you work with. Again, noe of this requires decrypting anything.

Field Standard Notes Notesnook Cryptee
Encrypted payload byte size Size of the encrypted blob on the server, which correlates with note length even after encryption Short vs. long writing is inferable from blob size. VISIBLE VISIBLE EXPLICITLY STORED VISIBLE
Total note count Number of items stored under the account, inferable from item listings Reveals productivity habits but not topics. INFERABLE INFERABLE STORED PER FOLDER INFERABLE
Attachment MIME types File type of attachments (PDF, image, audio, etc.) known before encryption wrapping Knowing "this note has an audio attachment" or "a scanned document" is contextually revealing. NOT CONFIRMED NOT CONFIRMED EXPLICITLY STORED STORED
Attachment count per note How many files are attached to a given note Minor alone, but correlatable with other behavioral patterns. INFERABLE INFERABLE VISIBLE STORED
Folder color / archive status (Cryptee) Whether a folder is archived and its color, structural decoration metadata Cosmetic only. N/A N/A STORED (stated in policy) N/A

Revision History Metadata

Revision history is one of the easiest metadata risks to overlook. But remember that every saved version carries its own timestamp which creates a detailed editing timeline that persists on the server independently of the note's content.

Field Standard Notes Notesnook Cryptee
Revision history stored server-side Whether previous versions of a note are held on the server Each revision carries a timestamp, creating a full editing timeline server-side. 1yr (Productivity) / Unlimited (Professional) Limited history NOT STATED LOCAL ONLY
Timestamp per revision Every stored version carries the modification time of that specific edit For a journalist, this shows exactly when a draft was touched relative to external events. YES, per revision YES, per revision N/A LOCAL ONLY
Revision content encrypted Whether stored past versions are encrypted on the server YES, encrypted blobs YES, encrypted blobs N/A N/A, local only
Nightly email backup (SN paid, opt-in) SN paid plans can send an encrypted nightly backup to your email. This creates a second metadata trail at the email provider. Timing, recipient address, and volume are visible to your email provider even if content is encrypted. OPT-IN, paid only NO NO NO
Note Joplin stores revision history locally only, so no server-side edit history exists. Standard Notes Professional stores an unlimited, timestamped edit history of every note indefinitely on Proton's servers. The content is encrypted. The timeline is not.

Joplin-Specific Note Fields

Joplin's data model was inherited partly from Evernote's ENEX format and carries more metadata fields per note than any other product here. Several of these fields are unique to Joplin and have no equivalent in the other three apps.

Field Standard Notes Notesnook Cryptee
latitude / longitude / altitude GPS coordinates embedded directly into note properties. On by default in the mobile app. Exact location at note creation, embedded in the note body itself, not just a server log. It travels with exports and must be disabled manually in Settings, then Note, then Geolocation. NOT COLLECTED NOT COLLECTED NOT COLLECTED DEFAULT ON (mobile)
source / source_application Which Joplin client created the note, for example "joplin-desktop" or "net.cozic.joplin-mobile". Stored in note properties. Device-type fingerprinting at the note level. It syncs in plaintext if E2EE is off. NOT COLLECTED NOT COLLECTED NOT COLLECTED EMBEDDED IN NOTE
source_url When a note is created from a web clip, the source URL is embedded in note properties If E2EE is off, syncing a web-clipped note exposes the exact URL in plaintext, which directly reveals research activity. NOT COLLECTED NOT COLLECTED NOT COLLECTED EMBEDDED IN NOTE
author field Optional text field on each note. Evernote imports carry it over, and it is one of the note fields Joplin's API exposes [14] [15] An imported note can carry the author name recorded by the app it came from. NOT COLLECTED NOT COLLECTED NOT COLLECTED SET ON IMPORT
is_todo / todo_due / todo_completed Todo status, due date, and completion flag Reveals task patterns if not encrypted. N/A ENCRYPTED N/A STORED (E2EE off) / ENCRYPTED (E2EE on)
markup_language Whether a note uses Markdown or HTML. Stored in note JSON properties. Cosmetic formatting preference only. N/A N/A N/A STORED in note JSON
Critical It's important to recognize that With E2EE properly enabled, Joplin's dangerous fields (GPS, source_url, source_application) are encrypted in sync and at rest on the server. But they remain present in the local SQLite database in plaintext regardless of E2EE state. So anyone with physical access to the device can read them.

Sync & Operational Metadata

Sync events are visible at the API level regardless of content encryption. Active editing bursts, multi-device conflicts, and session counts paint a behavioral picture even when nothing is readable.

Field Standard Notes Notesnook Cryptee
Sync frequency / timing How often notes are pushed to the server, inferable from API request logs even when content is encrypted Active editing bursts are visible as sync events, with no content required. INFERABLE INFERABLE INFERABLE INFERABLE
Conflict records Created when two devices edit the same note simultaneously, linking two item versions server-side Reveals multi-device use patterns, not content. STORED STORED NOT STATED STORED
Active session count How many concurrent device sessions are authenticated to the account Reveals device count, not content. STORED STORED STORED STORED

Per-Product Summary

Standard Notes

BESTMost transparent documentation. The sync API spec is publicly available and explicit about every stored field.

BESTPrivate username mode orphans all timestamps from a real identity. The data still exists, but it is linked to a meaningless hash, not a person.

WARNRevision history timestamps are the biggest note-level risk. The Professional plan stores an unlimited timestamped edit history indefinitely on Proton's servers.

WARNSync token progression is unique to SN, a proxy clock that reveals editing frequency independently of timestamps.

WARNNightly email backup (opt-in, paid) creates a second metadata trail at your email provider. Timing, volume, and recipient are visible to them even if content is encrypted.

Notesnook

BESTcontent_type is fully encrypted. The server cannot distinguish a note from a tag from a preference. More thorough than SN and Joplin on this field.

PROPer-note sync toggle. Notes kept local-only generate zero server-side metadata at all.

WARNTimestamps are tied to your email address at registration. No private username equivalent means modification times are always attributable to an identifiable account.

CONDevice fingerprint metadata captured at the network level makes sync events more attributable than any other product here. Notesnook collects device IDs, OS type, and IP address in its own systems, the only app here that does all three.

Cryptee

BESTNo ISO timestamps on notes. Sequential version IDs are used for conflict resolution, readable as "this came after that," not as a datetime.

BESTNo server-side revision history. Previous versions of notes are not retained on the server at all.

WARNFolder count and file sizes explicitly stored. The number of documents per folder and attachment MIME types are visible to the server, per the published privacy policy.

WARNGhost Folders partly mitigates the folder count exposure, since hidden folders are excluded from visible metadata, but the overall structure is still known to the server.

Final Ranking, Most to Least Minimal Note Metadata

1
Cryptee
No real timestamps. No server-side revision history. No GPS or source fields. Folder count and MIME types are visible, but the per-note metadata footprint is the lightest of the four. There is one caveat. The backend is closed source, so these claims cannot be independently verified through server-side code review.
2
Joplin (E2EE on + geolocation disabled)
No server-side revision history is a meaningful advantage, and with E2EE enabled and geolocation disabled, the most dangerous Joplin-specific fields are neutralized. What remains is basic timestamps and UUIDs. If either condition is not met, Joplin becomes the worst of the four. The gap between best and worst configuration is larger here than in any other product.
3
Standard Notes (private username mode)
Timestamps and revision history are more extensive than Joplin's, but private username mode orphans all of it from a real identity. Timestamps linked to a hash with no associated PII are far less actionable than timestamps linked to an email address. Best transparency of the four on what is actually stored. The sync token mechanism is a unique risk not present in the other products.
4
Notesnook
The content_type encryption is better than SN's and Joplin's, and the per-note sync toggle is a useful mitigation. But timestamps are tied to a required email address with no anonymization equivalent, IP addresses are stored in Notesnook's own systems, and device identifiers make sync events more attributable than any other product here. It has the richest note-level metadata profile of the four once account-level data is included.

References

  1. [1] Standard Notes, Encryption, standardnotes.com/help/security/encryption (the open Standard Notes protocol specification, version 004; defines items keys and the encrypted item-payload format, treating the server as a "dumb data-store").
  2. [2] Standard Notes, Security, standardnotes.com/help/security (each account carries an encryption version; current protocol is 004).
  3. [3] Standard Notes, What Information Does Standard Notes Collect About Me?, standardnotes.com/help/5 (the server cannot read note contents but "can…read the date the item was created and modified and the content type"; after account deletion, data persists in 14-day database backups).
  4. [4] Standard Notes, Server (source code), github.com/standardnotes/server (sync API; sync-token progression and item records).
  5. [5] Notesnook, Open Source & Zero-Knowledge Private Note Taking App, notesnook.com (end-to-end encryption is always on and covers note titles, notebook structure, and tag names before anything reaches the server).
  6. [6] Notesnook, notesnook (source code), github.com/streetwriters/notesnook (client-side encryption of all items using XChaCha20-Poly1305 and Argon2).
  7. [7] Notesnook, Privacy Policy, notesnook.com/privacy.
  8. [8] Cryptee, Security Details, crypt.ee/security (client-side AES-256; "we can't see the contents or names of your files"; based in Estonia, outside the 14-eyes jurisdictions, and able to disclose only limited, encrypted data under an Estonian court order).
  9. [9] Cryptee, Threat Model, crypt.ee/threat-model.
  10. [10] Cryptee, Frequently Asked Questions, crypt.ee/faq (the front end is open source and independently verifiable).
  11. [11] Joplin, Data API, joplinapp.org/help/api/references/rest_api (note objects expose latitude, longitude, altitude, source_url, created_time, updated_time, user_created_time, and user_updated_time fields); see also readme/api.md, github.com/laurent22/joplin.
  12. [12] Joplin, Joplin Terminal Application, joplinapp.org/help/apps/terminal (full note property list, including the geolocation fields and the encryption_applied and encryption_cipher_text fields).
  13. [13] Joplin, End-To-End Encryption, joplinapp.org/help/apps/sync/e2ee (E2EE is opt-in; the encryption_applied flag governs whether an item is encrypted before syncing, which is why fields read as plaintext with E2EE off and as ciphertext with it on).
  14. [14] Joplin, Import and Export, joplinapp.org/help/apps/import_export (Evernote imports keep "note metadata (such as author, geo-location, etc.)").
  15. [15] Joplin, Joplin Data API, joplinapp.org/help/api/references/rest_api (lists author as a text property of every note).

Updated October 2026 to correct how Joplin's author field gets filled in.

Sources: Official privacy policies, published sync API documentation, open-source code repositories on GitHub, and app data models for each product. This analysis covers note-level metadata only. Account-level data collection, network-level identifiers, payment metadata, and jurisdiction risk are covered separately.
Analysis

The government is buying your data because it cannot legally collect it

Federal agencies buy Americans' location histories, internet records and travel data from brokers, with no warrant and no judge. In March 2026 the FBI director declined to rule out buying Americans' location data. A gap in the law makes these purchases legal, a Supreme Court ruling in June weakened the government's main argument for them, and Congress let its latest chance to close the gap pass.

D David
March 2026
Updated October 2026
~16 min read
In 2018 the Supreme Court decided that the location records your phone leaves behind deserve a warrant. Police had collected months of a robbery suspect's location history from his carrier without one, and in Carpenter v. United States the Court held that getting even seven days of those records is a search, because they give "an intimate window into a person's life." [1]

The ruling covered records the government forces a phone company to hand over. It said nothing about records the government pays for, and agencies were already paying. Apps collect your location through advertising code built into them, the data flows to brokers, and the brokers sell it to whoever pays, including the IRS, ICE and the military. [2] [3] [4] No warrant, no judge and no notice to you.

In March 2026 Senator Ron Wyden asked FBI Director Kash Patel to commit to not buying Americans' location data. Patel wouldn't. The bureau does "purchase commercially available information that's consistent with the Constitution and the laws under the Electronic Communications Privacy Act," he said, and it "has led to some valuable intelligence." [5] He's probably right that it's legal. The reason is a gap in the law most people have never heard of, and the reason it's still open is that Congress keeps choosing not to close it.
What the Government Buys Why It's Legal What AI Changes Where the Fight Stands What You Can Do Conclusion

Part I: What the Government Buys

What's public came out a piece at a time, through reporters, inspectors general and a few senators who kept asking. Put together, it shows that the buying is routine, that it reaches well past location, and that it has grown from single contracts into a marketplace. The data is usually sold without names, tied to an advertising ID instead. That protects less than it sounds. A study of 1.5 million phone users found that four points in time and place were enough to single out 95 percent of them. [6]

2017 to 2020: The first contracts
IRS Criminal Investigation paid for access to a broker's phone location data in 2017 and 2018. It said the tool never located a single target. [2] In February 2020 the Wall Street Journal reported that ICE had used location data from ordinary apps, including games and weather apps, to help identify immigrants who were later arrested, and that CBP used it to look for phones in remote stretches of the border. [3]
2020: A prayer app and the military
Motherboard found that Muslim Pro, a prayer app with more than 98 million downloads, was sending granular location data to a broker called X-Mode, along with the name of the user's Wi-Fi network and a timestamp. X-Mode's lawyers confirmed to Senator Wyden's office that the company sold location data from American phones to U.S. military customers through defense contractors. Separately, U.S. Special Operations Command had bought access to Locate X, a tool for tracking phones. [4]
2020: Watching a protest
After George Floyd was killed, a broker called Mobilewalla analyzed 16,902 devices at protests in four cities and published what it learned about the crowds. [7] The FTC later alleged that the company built a marketing segment of protesters that included their race and where they lived. [8] A panel advising the Director of National Intelligence would warn that commercial data "could be used, for example, to identify every person who attended a protest or rally." [9]
2021: The legal theory, in writing
In a memo prepared for Senator Wyden's office, the Defense Intelligence Agency said its analysts had searched commercial phone location data for Americans' movements five times in two and a half years. It also put the government's position in one sentence. DIA "does not construe the Carpenter decision to require a judicial warrant endorsing purchase or use" of commercial data. [10]
2023: The government looks at itself
In March, FBI Director Christopher Wray told senators the bureau had bought some location data in the past "for a specific national security pilot project," but "to my knowledge" wasn't buying it anymore. [11] In June, the intelligence advisers' report came out. Commercial data "includes information on nearly everyone," it found, and what can be learned from it "could facilitate blackmail, stalking, harassment, and public shaming." [9] In September, the inspector general for Homeland Security found that CBP, ICE and the Secret Service had bought and used phone location data without following the department's privacy rules, and recommended that ICE stop using it until its privacy reviews were approved. [12]
2024: Internet records too
Location is only part of it. In January 2024 Wyden released a letter from the director of the NSA confirming that the agency "does buy and use commercially available netflow data," the records of which internet addresses connect to which, including data on "wholly domestic internet communications." Records like that can show which sites a person visits. [13]
January 2025: An order with an exception
The FTC finalized an order against Gravy Analytics and its subsidiary Venntel, which say they collect more than 17 billion location signals from about a billion phones a day. Venntel's data went to law enforcement and other agencies. The order bans selling sensitive location data, with exceptions for national security and law enforcement. [8] [14] The same month, hackers took Gravy's files, which showed location data tied to thousands of apps, including Candy Crush, Tinder and MyFitnessPal. Much of it appears to have been skimmed from the auctions that sell ad space inside those apps, likely without even the app makers knowing. [15]
2025: From contracts to a marketplace
In May, The Intercept reported that the Office of the Director of National Intelligence was building a single portal where the intelligence agencies could buy commercial data, including phone location data from mobile ads. [16] In June, 404 Media revealed that a broker owned by major airlines had sold CBP access to Americans' domestic flight records, with names, itineraries and payment details, under a contract that asked CBP not to name the source. [17] ICE signed a contract that year for Webloc, a tool that tracks phone movements. [18]
March 2026: The FBI won't rule it out
At the Senate Intelligence Committee's worldwide threats hearing on March 18, Wyden read Wray's 2023 answer back to Patel and asked him to commit to not buying Americans' location data. Patel gave the answer quoted above, and Wyden called buying that data without a warrant "an end run around the Fourth Amendment." [5] [19] The FBI hasn't said which commercial data it buys. Earlier that year, ICE had asked companies for information on "commercial Big Data and Ad Tech" for its investigations. [18]

Part II: Why It's Legal

If the Constitution requires a warrant for seven days of location records, it seems strange that an agency can buy years of them. The answer is a set of gaps that line up, and a ruling this year has started to narrow one of them.

The privacy law covers the phone company, not the broker
The Electronic Communications Privacy Act, the law Patel cited, bars phone and internet companies from voluntarily handing customer records "to any governmental entity." The same section lets them hand those records "to any person other than a governmental entity." [20] So a company can't give your records to the FBI, but it can sell them to a broker, and the broker can sell them to the FBI. Many apps aren't covered by that section at all. That's the data broker loophole. Nobody invented it as a trick. The law was written in 1986, long before phones reported where they were.
A purchase isn't a search
The Fourth Amendment limits what the government does, not what companies do. Under current doctrine, an agency that buys data a company already collected looks like a customer in a market, not an officer conducting a search. A 2023 note in the Yale Law & Policy Review traced the problem to exactly that. You can keep a reasonable expectation of privacy in your location history, it concluded, and still "Fourth Amendment doctrine does not regulate a government purchase of sensitive geolocation data." [21]
Carpenter called itself narrow
The Court left room on purpose. "Our decision today is a narrow one," it wrote, and it set aside "other business records that might incidentally reveal location information" and "collection techniques involving foreign affairs or national security." [1] A 2022 note in the Columbia Law Review argued that buying location data still violates Carpenter, because the government ends up with the same kind of record the Court protected. [22] Jake Laperruque of the Center for Democracy and Technology compares it to police paying your landlord for a spare key instead of getting a warrant. "That's just not what they're allowed to do," he said. [18] [23]
Chatrie weakened the main argument
The government's strongest claim has been that you share your location voluntarily when you turn on an app. In June 2026 the Supreme Court rejected that idea for Google's location history. In Chatrie v. United States it held that police conducted a search when they used a geofence warrant to get the data, and said it was "hard to see how any user is, in the normal sense, 'sharing'" it. [24] Matthew Tokson, a Fourth Amendment scholar at the University of Utah, told Bloomberg Law the ruling "knocks out one of the big pillars of the government's argument that this is lawful." But Chatrie was about data police forced Google to hand over, and no court has squarely decided whether buying the same data is a search. [25] (I go through Chatrie and the doctrine around it in a separate piece.)
Even the broker rules exempt the government
The FTC has done more about location brokers than anyone else in Washington, and its orders against Gravy Analytics, Venntel and Mobilewalla limit what those companies can sell. [8] But the order against Gravy and Venntel, the brokers selling to agencies, makes exceptions for national security and law enforcement. [14] The commission was never built to police the government's side of the market, which I cover in my piece on the FTC.

Part III: What AI Changes

For years the practical limit on bulk data was attention. Someone had to sift it, and there was always more than anyone could read. That limit is going away.

From records to profiles
Representative Warren Davidson, an Ohio Republican, told NPR that artificial intelligence "can harvest and collect the data in a way that humans never could and do it amazingly fast." Laperruque asked what "new Pandora's box" opens "when we not only have these huge quantities of data, but we have tools that can start to scan and analyze patterns in unprecedented ways and at an unprecedented scale." [18] The intelligence advisers had already warned that commercial data could identify everyone at a protest. [9] With software doing the sifting, that goes from a project to a search query.
A one-stop shop
The agencies are building the plumbing to match. The portal the intelligence community planned in 2025, the Intelligence Community Data Consortium, would let agencies shop for commercial data in one marketplace instead of signing separate contracts. [16] In March 2026 about 130 civil society groups told Congress the data broker loophole could be used "to supercharge AI-powered surveillance." [18] [26]
The AI companies are in the fight now
Anthropic's chief executive, Dario Amodei, warned that AI could take purchased records and assemble "a comprehensive picture of any person's life," "automatically and at massive scale." His refusal to let the company's technology be used for domestic mass surveillance or autonomous weapons set off "a major fight with the Pentagon," which says a private company can't set terms for how the government lawfully uses its technology. Laperruque told NPR the falling out shows how powerful the combination of AI and purchased data has become. [18]

Part IV: Where the Fight Stands

The gap can be closed in three places. Congress, the courts and the statehouses. So far, the statehouses have moved fastest.

Congress has had the fix for years
The House passed the Fourth Amendment Is Not For Sale Act in April 2024, 219 to 199, and it stalled in the Senate. [27] [28] In March 2026 Wyden and Mike Lee in the Senate, and Zoe Lofgren and Warren Davidson in the House, introduced the Government Surveillance Reform Act. It would require a warrant before agencies buy Americans' data, and a warrant before they search Americans' communications collected under Section 702 of the foreign intelligence law. [29] Advocates hoped to attach the fix to the renewal of Section 702, which was due to expire in April. [18]
Section 702 lapsed, and the loophole stayed open
Congress never agreed on a full renewal. It passed a ten-day extension in April and a 45-day one at the end of the month, neither with any reforms. [30] [31] On June 5 a longer renewal fell short in the Senate, 47 to 52, with seven Republicans joining most Democrats against it. [32] The law lapsed on June 12. Collection continues anyway, because the court approvals issued in March 2026 run until March 17, 2027. [33] [34] Nothing that became law touched the data broker loophole, and the next deadline that matters is that March date.
Pressure works, one contract at a time
In June 2026 the ATF canceled its contract for Webloc, the same tool ICE bought, after a House Oversight hearing revealed that it was buying location data drawn from ad systems. It had run 341 searches with the tool, and a prosecutor and a judge had objected to using the data in one investigation. Wyden, who pressed for the cancellation with Representative Michael Cloud, a Texas Republican, called the purchases "an unacceptable end-run around the Fourth Amendment" and said "Americans' privacy shouldn't depend on ad hoc congressional interventions." [35]
The courts move one case at a time
Chatrie gives the next defendant a stronger argument when purchased data shows up in a case. But agencies rarely say when they used it, and a judge can only rule on what reaches a courtroom. "So much of this is hidden from view," Emile Ayoub of the Brennan Center told Bloomberg Law. [25]
Montana went first
In May 2025 Montana became the first state to require a warrant or an investigative subpoena before state and local agencies can buy electronic communications, precise location data and other sensitive data. [36] The Center for Democracy and Technology notes that the subpoena option is a lower bar than a warrant, and that similar bills in Colorado and Rhode Island haven't passed. [28] Maryland and Oregon went after the supply instead, by banning the sale of precise location data. [37] A state law can't bind federal agencies, but these show the rules are workable.

Part V: What You Can Do

You may be thinking you have nothing to hide. I've written about why that misses the point. Here it's simpler. The Fourth Amendment was written so the government would have to ask a judge first, and buying your data skips that step. Until the law changes, the only data that can't be sold is data that never gets made.

Turn off location for apps that don't need it
On an iPhone, open Settings, then Privacy & Security, then Location Services, and check every app. Set most to Never or While Using the App, and turn off Precise Location for any app that only needs to know your city. [38] On Android, open Settings, then Location, then App location permissions, and turn off Use precise location for apps that don't need it. [39] A weather app doesn't need your exact coordinates, and a game doesn't need them at all. This is the step that matters most, because an app that can't read your location can't pass it on.
Cut off the ad ID
Your advertising ID is the tag that lets brokers connect your location from one app to the next. Homeland Security's inspector general described the location data its agencies bought as data drawn from these IDs. [12] On an iPhone, open Settings, then Privacy & Security, then Tracking, and turn off Allow Apps to Request to Track, so apps can't read it. [40] On Android, open Settings, then Privacy, then Ads, and tap Delete advertising ID. Apps that ask for it get a string of zeros. [41]
Delete the free apps you don't use
Location also leaks through the ads themselves. When an app shows an ad, details about you and your phone go out to an auction, and brokers can collect them there. That's likely how location data tied to Candy Crush and Tinder ended up in Gravy's files. [15] Every free, ad-supported app you don't use is a leak you don't need.
Get out of the broker files
Brokers also hold your address, phone number and relatives. If you live in California, one request through DROP reaches every registered broker and makes them keep deleting you. (I go through what it removes and what it leaves behind in a separate piece.) Everywhere else, you opt out one site at a time, and listings come back, so it's something you keep up, not a box you check once. Deleting your records won't pull back what an agency already bought, but it shrinks what's left to sell.
Use tools that keep less
What a company keeps is what can be bought, subpoenaed or leaked. A messaging app that keeps almost no metadata has little to hand over, and end-to-end encrypted photos and email can't be read by the company storing them. I compare messaging apps and photo services, and explain how the encryption works, in other pieces. A paid VPN from a reputable provider hides your IP address, which ad networks use to guess where you are, but it does nothing about an app that already has your location.

Conclusion

The government doesn't need to break into your phone or break your encryption to learn where you've been. It can buy the answer, and under current law that's a purchase, not a search.

What would fix it
Everything in the last section shrinks what exists to be sold. It's worth doing, but it puts the work on you, and it can't recall data that's already out there. The fix that lasts is the one Congress keeps passing over, a warrant requirement for purchases. Chatrie has weakened the government's argument, Montana has shown the rule can work, and the March 2027 deadline gives Congress another chance to write it into law. Until it does, agencies will keep buying what they would need a warrant to take.

References

  1. [1] Carpenter v. United States, 585 U.S. 296 (2018), supremecourt.gov (accessing seven days of historical cell-site records is a search; "Our decision today is a narrow one").
  2. [2] Byron Tau, IRS Used Cellphone Location Data to Try to Find Suspects, Wall St. J. (June 19, 2020) (IRS Criminal Investigation paid for Venntel access in 2017 and 2018 and said it located no targets).
  3. [3] Byron Tau & Michelle Hackman, Federal Agencies Use Cellphone Location Data for Immigration Enforcement, Wall St. J. (Feb. 7, 2020) (data drawn from ordinary apps, including games and weather apps).
  4. [4] Joseph Cox, How the U.S. Military Buys Location Data from Ordinary Apps, Motherboard (Nov. 16, 2020), vice.com (Muslim Pro sent location data to X-Mode; X-Mode confirmed sales to U.S. military customers through defense contractors; Special Operations Command bought access to Locate X).
  5. [5] Brandon Vigliarolo, FBI Director Leaves Open the Possibility That It's Buying Location Data Again, The Register (Mar. 19, 2026), theregister.com (Director Patel's answer in full, Sen. Wyden's question quoting former Director Wray, and Wyden's response).
  6. [6] Yves-Alexandre de Montjoye et al., Unique in the Crowd: The Privacy Bounds of Human Mobility, 3 Sci. Reps. 1376 (2013), nature.com (four points in time and place were enough to single out 95% of 1.5 million phone users).
  7. [7] Caroline Haskins, Protesters Marching Across the Country Had No Idea That a Tech Company Was Spying on Them, BuzzFeed News (June 2020), buzzfeednews.com (Mobilewalla analyzed 16,902 devices at protests in four cities).
  8. [8] Suzanne Smalley, FTC Targets Companies That Collected and Sold Sensitive Location Data, The Record (Dec. 3, 2024), therecord.media (Gravy Analytics and Venntel; Venntel data sold to law enforcement and other agencies; Mobilewalla's alleged segment of protesters by race and home location).
  9. [9] Senior Advisory Grp. Panel on Commercially Available Info., Report to the Director of National Intelligence (Jan. 27, 2022) (declassified June 2023), dni.gov (commercial data "includes information on nearly everyone"; it "could be used, for example, to identify every person who attended a protest or rally").
  10. [10] Shannon Vavra, DIA Uses Purchased Phone Location Data Without Warrants, CyberScoop (Jan. 22, 2021), cyberscoop.com (quoting a Jan. 15, 2021 Defense Intelligence Agency memo prepared for Sen. Wyden's office).
  11. [11] FBI Latest to Admit to Bypassing Warrant Requirements by Purchasing Location Info from Data Brokers, Techdirt (Mar. 16, 2023), techdirt.com (quoting Director Wray's Mar. 8, 2023 testimony to the Senate Intelligence Committee, first reported by Dell Cameron in Wired).
  12. [12] Off. of Inspector Gen., U.S. Dep't of Homeland Sec., OIG-23-61, CBP, ICE, and Secret Service Did Not Adhere to Privacy Policies or Develop Sufficient Policies Before Procuring and Using Commercial Telemetry Data (Sept. 28, 2023), oversight.gov (defining the data as phone geolocation derived from advertising IDs; recommending that ICE stop using it until its privacy reviews were approved).
  13. [13] Zack Whittaker, NSA Is Buying Americans' Internet Browsing Records Without a Warrant, TechCrunch (Jan. 26, 2024), techcrunch.com (quoting NSA Director Paul Nakasone's letter to Sen. Wyden).
  14. [14] Press Release, Fed. Trade Comm'n, FTC Finalizes Order Prohibiting Gravy Analytics, Venntel from Selling Sensitive Location Data (Jan. 14, 2025), ftc.gov (exceptions "in limited circumstances involving national security or law enforcement").
  15. [15] Joseph Cox, Candy Crush, Tinder, MyFitnessPal: See the Thousands of Apps Hijacked to Spy on Your Location, 404 Media (Jan. 9, 2025), 404media.co (produced with support from Wired; the broker "appears to be acquiring their data from the online advertising 'bid stream'").
  16. [16] Sam Biddle, U.S. Spy Agencies Are Getting a One-Stop Shop to Buy Your Most Sensitive Personal Data, The Intercept (May 22, 2025), theintercept.com (the Intelligence Community Data Consortium).
  17. [17] Joseph Cox, Airlines Don't Want You to Know They Sold Your Flight Data to DHS, 404 Media (June 10, 2025), 404media.co.
  18. [18] Jude Joffe-Block, Your Data Is Everywhere. The Government Is Buying It Without a Warrant, NPR (Mar. 25, 2026), npr.org (interviews with Rep. Warren Davidson and Jake Laperruque; ICE's Webloc contract and its request for "commercial Big Data and Ad Tech"; the FBI's refusal to say what it buys).
  19. [19] Open Hearing: Worldwide Threats, S. Select Comm. on Intelligence (Mar. 18, 2026), intelligence.senate.gov (witnesses including FBI Director Kash Patel).
  20. [20] 18 U.S.C. § 2702(a)(3), (c)(6), law.cornell.edu (Stored Communications Act, part of the Electronic Communications Privacy Act of 1986).
  21. [21] Aaron X. Sobel, Note, End-Running Warrants: Purchasing Data Under the Fourth Amendment and the State Action Problem, 42 Yale L. & Pol'y Rev. (2023), yalelawandpolicy.org.
  22. [22] Dori H. Rahbar, Note, Laundering Data: How the Government's Purchase of Commercial Location Data Violates Carpenter and Evades the Fourth Amendment, 122 Colum. L. Rev. 713 (2022), columbialawreview.org.
  23. [23] Lindsey Wilkinson, Privacy Advocates Sound Alarm on "Data Broker Loophole" Used by FBI, Other Federal Agencies, FedScoop (Mar. 20, 2026), fedscoop.com.
  24. [24] Chatrie v. United States, No. 25-112 (U.S. June 29, 2026), supremecourt.gov (opinion of the Court by Kagan, J.).
  25. [25] Christopher Brown, Government Data Buys Put at Risk by High Court's Geofence Ruling, Bloomberg Law (Sept. 10, 2026), news.bloomberglaw.com (quoting Matthew Tokson of the University of Utah).
  26. [26] Letter from Demand Progress et al. to Speaker Mike Johnson et al. (Mar. 19, 2026), demandprogress.org (coalition opposing reauthorization of Section 702 until the data broker loophole is closed).
  27. [27] Derek B. Johnson, House Passes Bill to Limit Personal Data Purchases by Law Enforcement, Intelligence Agencies, CyberScoop (Apr. 17, 2024), cyberscoop.com (the Fourth Amendment Is Not For Sale Act passed 219 to 199).
  28. [28] Ctr. for Democracy & Tech., The Data Broker Loophole (July 2026), cdt.org (the federal bill "has stalled in the Senate"; Montana's law is the only one enacted, and its subpoena option is a lower standard than a warrant).
  29. [29] Press Release, Rep. Zoe Lofgren, Lofgren, Davidson, Wyden, and Lee Introduce Bipartisan FISA Reform Bill to Protect Americans' Constitutional Rights (Mar. 13, 2026), lofgren.house.gov (the Government Surveillance Reform Act, introduced Mar. 12, 2026).
  30. [30] Congress Passes Short-Term FISA Extension, Gray News (Apr. 17, 2026), wbtv.com (a ten-day extension to April 30).
  31. [31] Martin Matishak, Congress Punts FISA Renewal to June, The Record (Apr. 30, 2026), therecord.media (a 45-day extension to June 12; House vote 261 to 111).
  32. [32] Senate Fails to Extend FISA Surveillance Program as Deadline Nears, with 7 Republicans Joining Democrats, CBS News (June 5, 2026), cbsnews.com (47 to 52).
  33. [33] Eric McDaniel, FISA 702, a Key U.S. Spy Tool, Has Lapsed. Now What?, NPR (June 12, 2026), npr.org.
  34. [34] Brennan Ctr. for Just., Section 702 Surveillance Authority Will Not Lapse if Reauthorized by March 2027 (Sept. 2026), brennancenter.org (certifications approved March 17, 2026 run to March 17, 2027).
  35. [35] Press Release, Sen. Ron Wyden, Wyden, Cloud Secure Major Privacy Victory as ATF Cancels Warrantless Location Data Contract (June 26, 2026), wyden.senate.gov (the ATF ran 341 searches with Webloc and canceled the contract after a House Oversight hearing).
  36. [36] Joe Lancaster, New Montana Law Blocks the State from Buying Private Data to Skirt the Fourth Amendment, Reason (May 16, 2025), reason.com (S.B. 282).
  37. [37] Press Release, Consumer Reports, Consumer Reports Praises Oregon Governor for Signing Landmark Geolocation and Children's Privacy Bill into Law (June 5, 2025), advocacy.consumerreports.org (Oregon's H.B. 2008 bans the sale of precise geolocation data; Maryland's 2024 law bans the sale of all sensitive data).
  38. [38] Apple, Turn Location Services and GPS On or Off on Your iPhone, iPad, or iPod Touch, support.apple.com.
  39. [39] Google, Manage Location Permissions for Apps, Android Help, support.google.com.
  40. [40] Apple, If an App Asks to Track Your Activity, support.apple.com (apps that request to track are "unable to access the advertising identifier").
  41. [41] Google, Advertising ID, Play Console Help, support.google.com (after deletion, apps "will receive a string of zeros instead of the identifier").

Updated October 2026. This revision adds the lapse of Section 702 in June 2026, the Supreme Court's decision in Chatrie v. United States, the national security and law enforcement exception in the FTC's order against Gravy Analytics and Venntel, the NSA's purchases of internet records, newer purchases by ICE and CBP, the intelligence agencies' planned data marketplace, the ATF's canceled location data contract and new state laws in Montana, Maryland and Oregon. It corrects several dates and attributions, including what the FBI director did and didn't say in March, cites a source for every claim and links to related pieces on this site. The argument is the same.

Disclaimer: This analysis is for educational and informational purposes only. It is not legal advice. The author is not a licensed attorney. It draws on court opinions, statutes, government reports, congressional testimony, academic legal analysis and news reporting, cited accordingly. Pending matters, including the reauthorization of Section 702, the Government Surveillance Reform Act and challenges to purchased data in court, reflect publicly available information as of October 2026 and may have developed further.
Field Assessment

SMS vs iMessage vs WhatsApp vs Telegram vs Signal: What the FBI's own document tells us

In January 2021, the FBI produced an internal guide titled "Lawful Access" detailing exactly what data it can legally obtain from nine messaging apps. The document was obtained via FOIA by the nonprofit Property of the People and published by Rolling Stone. It is the single most useful primary source available for evaluating messaging privacy, even if it might be outdated. Here is a field-by-field analysis of five of the most common services, based on that document, official privacy policies, court records, and published law enforcement capabilities.

D David
December 2025
Updated October 2026
~26 min read
The FBI does not need to break your encryption. In January 2021, the FBI circulated an internal document that a nonprofit later obtained through a FOIA request. [1] It was prepared by the Bureau's Science and Technology Branch and Operational Technology Division, and it answered a question most people never think to ask. What can the FBI actually get from each messaging app with a court order? [2] The answer depends entirely on which app you use. Encryption protects message content on most platforms now. But metadata, who you talk to, when, how often, from where, and on what device, is a different story. WhatsApp hands it over in near real time. Signal gives up almost nothing. SMS exposes everything by design. And in March 2026, the FBI director told the Senate the bureau buys "commercially available information" and wouldn't commit to not buying Americans' location data, which takes no warrant at all. [3] This analysis goes through all five services field by field, then looks at the threats that exist outside the app itself.
Encryption Architecture What the FBI Can Get Metadata Collection Beyond Encryption The Data Broker Loophole Per-Service Summary Recommendations
EXPOSED: plaintext or accessible to provider/carrier
CONDITIONAL: depends on configuration or legal process type
PROTECTED: E2EE or not collected
NOT APPLICABLE
Primary source FBI "Lawful Access" document, dated Jan. 7, 2021, obtained via FOIA by Property of the People. Published by Rolling Stone, Nov. 29, 2021. Analysis supplemented by Just Security (Riana Pfefferkorn, Stanford Internet Observatory), the ACLU, the Center for Democracy and Technology, and official privacy policies from each service. [1] [2] [4]

Encryption Architecture

Whether your messages can be read by anyone other than you and your recipient depends entirely on the encryption model. These five services use fundamentally different approaches, and the differences determine everything that follows.

End-to-End Encryption (E2EE) by Default Whether message content is encrypted on your device and only decryptable by the recipient, with no access by the provider This is the single most important privacy property of any messaging service.
SMSNO ENCRYPTION Your carrier can read every message, and so can anyone who intercepts it, including cell-site simulators and intelligence agencies. [5] [6]
iMessageYES E2EE between Apple devices (blue bubbles). Chats with Android phones fall back to RCS or SMS (green bubbles). Since iOS 26.5 in May 2026, RCS chats with Android can be end-to-end encrypted too, in beta and on supported carriers, and they show a lock icon. SMS never is. [7]
End-to-End Encryption (continued)
WhatsAppYES Signal Protocol. All messages, calls, photos, and videos are E2EE by default. [8] However, metadata is extensively collected and available to law enforcement. [9]
TelegramNO, NOT BY DEFAULT Only "Secret Chats" are E2EE, and they work only one-on-one and only on the device where they started. All other chats, including every group, use client-server encryption. Telegram holds the keys and can read them. [10] [11]
End-to-End Encryption (continued)
SignalYES Signal Protocol (the gold standard). All messages, calls, group chats, voice notes, and file transfers are E2EE by default. No exceptions. No fallback to unencrypted modes. [12]
Encryption Protocol
SMSNone. Carried over SS7, a signaling system standardized in the late 1970s and early 1980s and built without authentication or encryption. [13]
iMessageApple's proprietary protocol. Since iOS 17.4 in 2024 it has used PQ3, which pairs post-quantum and elliptic curve cryptography. [14] Closed source. [15]
Encryption Protocol (continued)
WhatsAppSignal Protocol, fully in place since 2016. Open source protocol, closed source app. [8]
TelegramMTProto 2.0 (proprietary, home-grown). Criticized by cryptographers including Matthew Green (Johns Hopkins) for its custom, non-standard design. [10]
Encryption Protocol (continued)
SignalSignal Protocol. Open source. Also used by WhatsApp [8] and by Facebook Messenger, which began making end-to-end encryption the default for personal chats in December 2023. [16]
Open Source
SMSN/A Carrier infrastructure, not an app.
iMessageNO Fully closed source. Apple publishes a platform security guide, but the code is not auditable. [15]
Open Source (continued)
WhatsAppPROTOCOL ONLY Uses open-source Signal Protocol but the WhatsApp app itself is closed source. [8]
TelegramCLIENT ONLY Client apps are open source. Server code is closed source, meaning the server-side behavior cannot be independently verified. [17]
Open Source (continued)
SignalFULL Client apps AND server code are open source. The only service on this list where both sides are independently auditable. [18]
Key point Telegram's marketing as a "secure messenger" has been directly challenged by cryptographer Matthew Green (Johns Hopkins University), who wrote in August 2024 that "Telegram really has no legs to stand on in this particular discussion." He wrote that most one-on-one Telegram conversations, and "literally every single group chat," are probably visible on Telegram's servers. The same month, Telegram CEO Pavel Durov was arrested in France on charges tied to the platform's failure to cooperate with law enforcement. [10]
FBI lawful access: what each service hands over
Under a Court Order or Search Warrant
This section is derived directly from the FBI's January 2021 "Lawful Access" document. The legal instruments referenced are subpoenas, court orders (18 U.S.C. §2703(d)), search warrants, and pen register/trap-and-trace orders. What follows is what the FBI says it can obtain from each service with the appropriate legal process. [1] [9] As Mallory Knodel of the Center for Democracy and Technology told Rolling Stone, "the most popular encrypted messaging apps iMessage and WhatsApp are also the most permissive." [2]
Message Content This is what you actually wrote.
SMSFULLY ACCESSIBLE Carriers can read and store message content, and law enforcement can request it with a subpoena. [5] In a 2010 Justice Department chart, only Verizon kept text content, for three to five days, but every carrier kept records of who texted whom for a year or more. [19] Forensic tools can also recover "deleted" messages from the phone itself. [20]
iMessageLIMITED E2EE protects content in transit. But if iCloud backup is enabled, Apple stores iMessage content with the encryption key and will hand both over under a search warrant, unless Advanced Data Protection is turned on. [4] [9] [21]
Message Content (continued)
WhatsAppLIMITED E2EE protects content. But if the target uses an iPhone with iCloud backup enabled, iCloud returns may contain WhatsApp data including message content. [9] WhatsApp introduced optional encrypted backups after the FBI document was prepared. [22]
TelegramCLOUD CHATS: ACCESSIBLE The FBI document says Telegram provides no message content. [9] But Telegram holds the decryption keys for all cloud chats, so that content is readable on its servers. [11] Only Secret Chats are E2EE, and most users never turn them on. [10]
Message Content (continued)
SignalNONE Signal cannot access message content. [12] Its optional backups, added in 2025, are end-to-end encrypted with a recovery key that is never shared with Signal. [23] The FBI document confirms that no message content is available. [9]
Who You Talk To (Contact/Address Book Data) Reveals your social graph, which is often more valuable than content.
SMSFULLY EXPOSED Every sender/recipient pair is logged by the carrier with timestamps. Retained for a year or more. [19]
iMessageEXPOSED A subpoena gets basic subscriber information. A court order gets 25 days of iMessage lookups to and from your number, which can show who you looked up and who looked you up, even if no message was ever sent. [4] [9]
Who You Talk To (continued)
WhatsAppEXPOSED A court order gets subscriber records plus information like blocked users. A search warrant returns your address book contacts and the WhatsApp users who have you in theirs. A pen register returns the source and destination of every message. [9]
TelegramMINIMAL The FBI document says "no contact information" is provided. [9] At the time, Telegram's policy allowed sharing IP addresses and phone numbers only in confirmed terrorism cases. In September 2024 it widened that to valid court orders in any criminal case that breaks its rules. [24]
Who You Talk To (continued)
SignalNONE Signal does not store contact lists on its servers. The FBI document lists no contact information. [9] Signal responded to a 2021 grand jury subpoena by providing only the account's creation date and last connection date. Nothing else, because nothing else exists. [25]
Real-Time Surveillance (Pen Register / Trap-and-Trace) This is live, forward-looking surveillance, not historical records.
SMSFULLY CAPABLE Police can capture messages with cell-site simulators, often called stingrays. [5] Documents leaked by Edward Snowden showed the NSA collecting almost 200 million texts a day worldwide. [6]
iMessageNO PEN REGISTER CAPABILITY per the FBI document. Apple does not provide real-time metadata feeds. [9]
Real-Time Surveillance (continued)
WhatsAppNEAR REAL-TIME WhatsApp is the only service in the FBI document that returns pen register data in near real time, with the source and destination of every message delivered every 15 minutes. [2] [9] No content, but a full communication graph. Daniel Kahn Gillmor of the ACLU called this "devastating to a reporter communicating with a confidential source." [2]
TelegramNONE LISTED The FBI document lists no real-time data for Telegram. [9]
Real-Time Surveillance (continued)
SignalNO CAPABILITY Signal does not have the data to provide. The FBI document lists only two things Signal can hand over, the date and time an account registered and the last date it connected, and real-time data isn't one of them. [9]
IP Address
SMSN/A Cell tower location data serves the same purpose. Your carrier knows your physical location and keeps those records for months or years. [19]
iMessageLIKELY A 2016 report found Apple's iMessage lookup logs include your IP address, along with the numbers you looked up and when. [26] Apple says it keeps those logs up to 30 days. [27]
IP Address (continued)
WhatsAppCOLLECTED WhatsApp's privacy policy lists your IP address among the connection data it collects. [28]
TelegramCONDITIONAL Telegram keeps IP addresses for up to 12 months. [11] Since September 2024, it says it may hand IP addresses and phone numbers to authorities in response to a valid court order in a criminal case, not just terrorism cases. [24]
IP Address (continued)
SignalNOT RETAINED Signal's response to the 2021 grand jury subpoena included no IP addresses, only two timestamps, because that is all it keeps. [25]
Registration / Account Data
SMSFULL IDENTITY Your phone number is tied to your legal identity, billing address, and payment method at the carrier.
iMessageFULL IDENTITY Tied to your Apple Account, and Apple can provide the name, physical address, email address and phone number behind it. [27]
Registration / Account Data (continued)
WhatsAppPHONE NUMBER Required at registration. A subpoena returns basic subscriber records. [9]
TelegramPHONE NUMBER Required at registration. Telegram retains this. [11]
Registration / Account Data (continued)
SignalPHONE NUMBER Required at registration. This is Signal's one identifiable data point. Signal keeps nothing else it can read, and your profile name and photo are end-to-end encrypted. [12]
The Natalie Edwards case In 2020, former senior FinCEN adviser Natalie Edwards pled guilty to leaking Suspicious Activity Reports to a BuzzFeed reporter. Edwards and the reporter exchanged hundreds of messages over WhatsApp, which she believed was secure. [2] [29] The FBI used a pen register on WhatsApp, which records who messaged whom and when, and ProPublica reported that the metadata "was pivotal in the arrest and conviction" of Edwards. She was sentenced to six months in prison. [29] As Daniel Kahn Gillmor of the ACLU put it, "WhatsApp offering all of this information is devastating to a reporter communicating with a confidential source." [2] The message content was encrypted. The metadata gave her away.

Metadata Collection: What Each Service Knows About You

Even when message content is encrypted, every service collects operational metadata to function, and encryption can't always hide it. [30] The critical question is how much each one keeps.

Metadata Retained by Provider What the service knows about your usage patterns, independent of message content
SMSEVERYTHING Sender, recipient, timestamp and cell tower location. A 2010 Justice Department chart showed carriers keeping records of who texted whom for one to seven years, depending on the carrier, and only Verizon keeping message content, for three to five days. [19]
iMessageMODERATE Apple keeps iMessage lookup logs for up to 30 days. [27] They record the numbers your phone checked, which shows who you were about to message, and a 2016 report found they also include your IP address. [26] The FBI document says 25 days of these lookups are available with a court order. [9]
Metadata Retained (continued)
WhatsAppEXTENSIVE WhatsApp's privacy policy covers your activity and when you were last online, your device model and operating system, battery level, signal strength, IP address, phone number and location, estimated from your IP address and area code if you don't share it. [28] The FBI document shows it can also produce your contacts and who you message and when. [9] ProPublica reported in 2021 that Facebook "has also downplayed how much data it collects from WhatsApp users." [29]
TelegramMODERATE (cloud chats) Phone number, IP address, device details and login data, with IP data kept up to 12 months. For cloud chats, the full message content sits on Telegram's servers. [11] Telegram says it splits the decryption keys across data centers in different countries, so it would take court orders from several jurisdictions to get them, but its server code isn't public, so no one can check. [17]
Metadata Retained (continued)
SignalNEAR ZERO Phone number (registration). Date of account creation. Date of last connection. That is the complete list, confirmed by Signal's response to a 2021 grand jury subpoena in the Central District of California. "It's impossible to turn over data that we never had access to in the first place." [25]
Cloud Backups: The Encryption Bypass Cloud backups are the most common way E2EE is defeated in practice If your encrypted messages are backed up unencrypted to iCloud or Google Drive, a warrant gets the content.
iMessageDEFAULT: UNENCRYPTED iCloud backup stores iMessage content with the encryption key. Apple can and does hand this over under warrant. [9] Apple introduced Advanced Data Protection (opt-in E2EE for iCloud) in late 2022, but it is not on by default. [21]
WhatsAppDEFAULT: UNENCRYPTED WhatsApp backups to iCloud/Google Drive were unencrypted until late 2021 when WhatsApp introduced optional encrypted backups. [22] If the target has unencrypted backups enabled, the FBI can obtain message content via Apple or Google, bypassing WhatsApp's E2EE entirely. [4] [9]
Cloud Backups (continued)
SignalOPT-IN, ENCRYPTED Signal does not integrate with iCloud or Google Drive backup systems. Its own Secure Backups, added in 2025, are opt-in and end-to-end encrypted with a 64-character recovery key that is never shared with Signal's servers. [23] Signal can't open them, so there is still nothing useful to subpoena.

The Uncomfortable Truth: Encryption Is Not the Ceiling

Everything above analyzes what happens when law enforcement works within the system: subpoenas, warrants, pen registers, data requests to providers. That is the normal case. But if you are individually targeted by a government, the analysis changes fundamentally. Encryption protects data in transit and at rest. It does not protect data on a compromised device. And governments do not need to break your encryption when they can simply hack your phone.

Pegasus: The Encryption Bypass That Costs $0 in Warrants Once Pegasus is on your device, every messaging app is compromised, including Signal.
NSO Group's Pegasus spyware can be installed on iOS and Android devices using zero-click exploits, meaning the target does not need to click anything, open a link, or interact with the phone at all. In 2019, Pegasus was deployed via a WhatsApp voice call vulnerability; the phone was compromised even if the call was never answered. [31] [32] By 2021, NSO was using an iMessage zero-click exploit, called FORCEDENTRY, that got around Apple's BlastDoor security sandbox. [33] Google's Project Zero called it "one of the most technically sophisticated exploits we've ever seen." [34] Once installed, Pegasus reads every message in every app (Signal, WhatsApp, iMessage, Telegram) because it reads the screen and memory after decryption. It can also turn on the microphone and camera, and it gives whoever is running it complete control of the phone. [35] E2EE is irrelevant once the device is compromised. The encryption protects the transmission. Pegasus reads the message after it arrives.
Who Has Access to Pegasus
NSO Group says it licenses Pegasus only to government and law enforcement agencies. In 2018, Citizen Lab (University of Toronto) traced suspected Pegasus infections to 45 countries. [36] Documented targets include journalists such as Ben Hubbard of the NYT, human rights activists in Bahrain, the UAE and Mexico, political dissidents, and lawyers. [37] [38] In the 2021 Pegasus Project investigation by Forbidden Stories and Amnesty International, a leaked list contained over 50,000 phone numbers selected for possible surveillance, including those of heads of state. [35] In May 2025, a US federal jury ordered NSO Group to pay Meta more than $167 million in damages for hacking approximately 1,400 WhatsApp users' devices. [32] In October 2025 the judge cut the punitive award to $4 million but permanently barred NSO from targeting WhatsApp users. [39] In 2022 NSO said it would refocus on NATO member countries, but independent verification is not possible. [40]
Cellebrite, GrayKey, and Physical Extraction If law enforcement has physical access to your device, encryption may not matter.
Cellebrite and GrayKey are forensic extraction tools used by law enforcement agencies worldwide to unlock and extract data from seized phones. In the US alone, the nonprofit Upturn found at least 2,000 agencies with tools like these. [20] Cellebrite's UFED products are available to US federal agencies under streamlined procurement contracts (NASA SEWP, NIH CIO-CS). [41] These tools can bypass screen locks, extract "deleted" messages, and recover data from encrypted applications, in many cases without the device's passcode. [20] The EFF notes that even with E2EE messaging, "police have several tools to try to unlock your phone and read your encrypted messages, including Cellebrite and Greykey devices." [5] The constraint is physical access. If law enforcement has your phone (at a border crossing, during an arrest, or via a search warrant for your residence) device-level encryption is the last barrier, not app-level E2EE.
What This Means for Your Threat Model
The messaging app comparison in this article matters for the normal case: protecting against network-level surveillance, provider-side data requests, and routine legal process. This is the threat model for 99% of users. But if you are a journalist working on a story that threatens a government, an activist under state surveillance, a lawyer handling politically sensitive cases, or a dissident in an authoritarian country, your threat model includes device compromise. In that scenario, the messaging app is not the weak link. Your phone is. The mitigations are keeping your OS updated at all times (most Pegasus exploits target unpatched vulnerabilities), enabling Apple's Lockdown Mode (iOS 16+), which significantly reduces the attack surface for zero-click exploits, using a dedicated device for sensitive communications that is not used for anything else, rebooting your phone regularly (some Pegasus implants are non-persistent and do not survive a reboot), and using disappearing messages aggressively so that even a compromised device holds less readable history. [42] [43]
The Jamal Khashoggi connection Saudi journalist Jamal Khashoggi was killed in the Saudi consulate in Istanbul in October 2018. Six months earlier, while UAE authorities held his wife Hanan Elatr's phones, someone opened a Pegasus infection link on one of them, according to a forensic analysis for The Washington Post that tied the attempt to a UAE government agency. The analyst couldn't confirm the spyware took hold. [44] The encryption on her messaging apps was irrelevant because the device itself was the access point. Ben Hubbard, a New York Times Middle East correspondent who was writing about Saudi Crown Prince Mohammed bin Salman, was targeted with Pegasus repeatedly over three years (2018 to 2021). [37] The lesson is not that encrypted messaging failed. The lesson is that device compromise bypasses encryption entirely.

The Data Broker Loophole: Buying What a Warrant Would Require

In 2018, the Supreme Court ruled in Carpenter v. United States that law enforcement must obtain a warrant to access cell phone location data from carriers. [45] That ruling was supposed to be a privacy landmark. Eight years later, federal agencies buy the same kind of data, and more, from commercial data brokers, with no warrant required. [46] [47] (I go through how that works in a separate piece.)

FBI Director Won't Rule Out Buying Location Data (March 2026)
On March 18, 2026, at a Senate Intelligence Committee hearing, Senator Ron Wyden asked FBI Director Kash Patel to commit to not buying Americans' location data. Patel declined. [48] The bureau does "purchase commercially available information that's consistent with the Constitution and the laws under the Electronic Communications Privacy Act," he said, and "it has led to some valuable intelligence for us." [3] [49] In 2023, former FBI Director Christopher Wray had told the same committee that, to his knowledge, the bureau wasn't currently buying location data derived from internet advertising. [50]
How the Loophole Works
The apps on your phone (weather apps, games, fitness trackers, social media, ad-supported free apps) collect location data through advertising SDKs embedded in the app code. This data flows to advertising exchanges and data aggregators. [51] Companies like Gravy Analytics and its subsidiary Venntel collect and sell this data, tied to mobile advertising IDs that can be mapped back to individual devices. [52] Federal agencies, including ICE and the Department of Defense, purchase this data from commercial brokers. [46] [47] Because the data is "commercially available," agencies argue it falls outside the Fourth Amendment's warrant requirement. [53] The CDT's Jake Laperruque offered a more accurate analogy, comparing it to the FBI giving a landlord a hefty sum for the key to someone's apartment rather than getting a search warrant. "We wouldn't say, 'Oh, well, they bought the access,'" he said. [49]
The Scale of the Data
In December 2024, the FTC took action against Gravy Analytics and its subsidiary Venntel, which claimed to collect more than 17 billion location signals from around a billion mobile devices a day. Its order, final in January 2025, bars them from selling data on visits to sensitive places such as medical facilities, places of worship, domestic abuse shelters, and military installations. [52] [54] The same month, a breach at Gravy Analytics (reported by 404 Media with Wired) exposed location records tied to popular apps including Candy Crush, Tinder, and MyFitnessPal, much of it apparently skimmed from the ad auctions inside those apps. [51] The data broker market is vast, fragmented, and largely unregulated at the federal level. There is no comprehensive federal data privacy statute in the United States.
Why This Matters for Messaging Privacy Your messaging app's encryption is irrelevant if the government can buy your location from an ad broker.
You can use Signal with disappearing messages and a VPN. But if a weather app on your phone is feeding your GPS coordinates to an advertising exchange every 30 seconds, and an agency can buy that data from a broker like Venntel, they know where you are, where you have been, and by extension, who you met with physically. They do not need to know what you said. Location data at the resolution these brokers sell (often within meters) can reveal your home address, your workplace, your doctor's office, your attorney's office, your place of worship, and every meeting you attend. Senator Wyden has called these purchases "an end run around the Fourth Amendment." [3] The bipartisan Government Surveillance Reform Act, introduced March 12, 2026 by Senators Wyden and Mike Lee, would close this loophole by requiring a warrant for data broker purchases. [55] It hasn't passed. Advocates hoped to attach it to the renewal of Section 702 of the foreign intelligence law, but that law lapsed in June 2026 with no fix. [56] [57]
What You Can Do About It
The data broker pipeline starts on your device. Audit every app's location permissions (Settings → Privacy & Security → Location Services on iOS; Settings → Location on Android). Revoke location access for every app that does not absolutely require it. Disable advertising ID tracking (iOS: Settings → Privacy & Security → Tracking → toggle off "Allow Apps to Request to Track"; Android: Settings → Privacy → Ads → Delete advertising ID). Uninstall free, ad-supported apps that you do not actively use, because each one is a potential data source for brokers. Use a VPN to mask your IP address. And understand that the messaging app is one layer of a much larger surveillance surface. Choosing Signal over WhatsApp is meaningful. But if you are carrying a phone full of ad-supported apps with location permissions enabled, the messaging app is not your biggest exposure.

Per-Service Summary

SMS / MMS

CONNo encryption whatsoever. Carriers can read every message. Content is transmitted in plaintext over SS7.

CONFull identity tied to every message. Your phone number, legal name, billing address, and location are attached to every text.

CONStingray interception. Law enforcement can intercept SMS content in real time without carrier involvement using cell-site simulators.

CONMetadata retained for years. Sender, recipient, timestamp, cell tower location are all retained by the carrier and available under routine subpoena.

CONForensic recovery. "Deleted" SMS messages are recoverable from the device using tools like Cellebrite until overwritten by new data.

WARNRCS is replacing SMS. End-to-end encrypted RCS between iPhone and Android started rolling out in beta in May 2026, but it depends on your carrier and app version, so look for the lock icon.

iMessage

PROE2EE by default between Apple devices. Strong encryption in transit.

CONiCloud backup defeats E2EE. If iCloud backup is on and Advanced Data Protection is off, Apple stores message content with the encryption key and hands it over under warrant.

CONGreen bubbles aren't always encrypted. Chats with Android phones use SMS or RCS, and only RCS chats with the lock icon are end-to-end encrypted.

CON25 days of iMessage lookup data available to law enforcement, showing who you looked up and who looked you up in iMessage.

CONClosed source. Apple's encryption implementation cannot be independently audited.

WARNAdvanced Data Protection (launched Dec 2022) enables E2EE for iCloud backups, but it is opt-in, and you have to turn it on yourself.

WhatsApp

PROE2EE by default using the Signal Protocol. Message content is protected in transit and at rest on WhatsApp's servers.

CONNear real-time metadata to the FBI. WhatsApp is the only service in the FBI document that provides pen register data in near real time, with the source and destination of every message every 15 minutes. This is live surveillance.

CONExtensive metadata collection. Meta collects your contacts, usage patterns, device info, IP address, location, and behavioral data.

CONCloud backup bypass. Unencrypted iCloud/Google Drive backups can expose message content. Encrypted backup is opt-in.

CONOwned by Meta. WhatsApp's privacy policy lets it share information with other Meta companies.

WARNThe Natalie Edwards case showed how WhatsApp metadata alone, without any message content, helped convict a federal employee who leaked confidential bank reports.

Telegram

PROSecret Chats are E2EE with self-destructing messages and no server-side storage.

PROMinimal FBI access. The FBI document shows no message content and no contact info available under standard legal process.

CONDefault chats are NOT end-to-end encrypted. Telegram holds decryption keys for all cloud chats. Every group chat, every channel, and every default one-on-one conversation is readable by Telegram.

CONClosed-source server. Server code isn't public, so Telegram's claims about distributed key storage cannot be verified.

CONMTProto protocol criticized by Johns Hopkins cryptographer Matthew Green and others for its custom, non-standard design.

WARNPost-Durov arrest policy change. After Pavel Durov's arrest in France (Aug 2024), Telegram began handing IP addresses and phone numbers to authorities under valid court orders in criminal cases, not just terrorism cases.

Signal

BESTThe FBI's own document confirms it. Signal can provide the date and time an account registered and the last date it connected. That is the entire list. No message content. No contacts. No other metadata. No IP addresses. No pen register capability.

BESTE2EE on everything, no exceptions. All messages, group chats, calls, voice notes, file transfers. Backups are optional and end-to-end encrypted. No fallback to unencrypted modes.

BESTFull open source. Client AND server. The only service on this list where both are auditable.

BESTOperated by a nonprofit. Signal Foundation. No advertising business model. No incentive to collect data.

PRODisappearing messages, sealed sender, screen security. Advanced privacy features enabled at the user's discretion.

CONRequires a phone number to register. This is Signal's one identifiable data point. It is a real limitation for users who need full anonymity.

CONSmaller user base. Most of your contacts are probably on WhatsApp or iMessage. Network effects work against Signal's adoption.

WARNSignal does not protect against device compromise. If Pegasus or Cellebrite gains access to your phone, Signal's encryption is irrelevant. Signal protects the pipe. It cannot protect the endpoints.

Recommendations by Threat Model

If your communications could be subpoenaed, surveilled, or used against you:
Use Signal. No equivocation. The FBI's own internal document confirms that Signal provides the least data of any messaging service they analyzed. If you are a journalist protecting sources, a lawyer communicating with clients about sensitive matters, a whistleblower, an activist, or anyone whose communications could be compelled by legal process, Signal is the only service on this list where the provider genuinely cannot comply with a data request, because the data does not exist. Enable disappearing messages. Verify safety numbers with your contacts. Use a PIN for registration lock.
If you need broad compatibility and your contacts will not switch:
WhatsApp with encrypted backups enabled is a reasonable compromise, but understand the metadata exposure. WhatsApp's E2EE is real and uses the Signal Protocol. Your message content is protected. But Meta collects extensive metadata, provides pen register data to the FBI every 15 minutes, and the Natalie Edwards case showed that metadata alone can be enough to expose a source. If you use WhatsApp: enable encrypted backups, disable iCloud/Google Drive unencrypted backups, and understand that who you talk to and when is visible to Meta and obtainable by law enforcement.
If you face state-level targeting or device compromise threats:
The messaging app is not your primary concern. Your phone is. Use Signal, yes. But also: keep iOS and Android fully updated at all times, because most zero-click exploits target unpatched vulnerabilities. Enable Apple Lockdown Mode (iOS 16+), which dramatically reduces the attack surface. Use a dedicated device for sensitive communications that has no other apps installed. Reboot your phone daily, because some spyware implants (including certain Pegasus variants) do not survive a reboot. Set disappearing messages to the shortest practical interval. Do not carry a phone full of ad-supported apps with location permissions enabled. Audit every app on your device and remove anything you do not actively need. The strongest encryption in the world protects nothing if the device reading the decrypted messages is already compromised.
Regardless of which service you use:
Stop using SMS for anything sensitive. SMS has no encryption, no privacy protections, and full carrier visibility into content and metadata. Every text you send is attached to your legal identity, your physical location, and a timestamp, all retained for months to years and available under routine subpoena.

Turn off iCloud backup if you use iMessage. Or enable Advanced Data Protection (Settings → your name → iCloud → Advanced Data Protection). Without this, your "encrypted" iMessages are sitting on Apple's servers with the decryption key, waiting for a warrant.

Do not trust Telegram's default encryption. Telegram's default chats are client-server encrypted, meaning Telegram holds the keys. Only Secret Chats are E2EE, and they don't work in groups, stay on the device where you started them, and have to be turned on for each chat. Cryptographer Matthew Green wrote that most one-on-one Telegram conversations, and "literally every single group chat," are "probably visible on Telegram's servers."

Understand that encryption protects content, not metadata. The FBI does not need to break encryption. Metadata (who you talk to, when, how often, from where, on what device) is available from most services under routine legal process. Signal is the only service here that protects both content and metadata by design. Everything else leaks metadata to varying degrees.

Audit your phone's data broker exposure. Disable location permissions for every app that does not require them. Delete your advertising ID. Uninstall free apps you do not use. Apps like these are where brokers get the location data that federal agencies buy without a warrant, and in March 2026 the FBI director wouldn't rule out buying it. Your encrypted Signal messages are meaningless if a weather app on the same phone is reporting your GPS coordinates to an advertising exchange every 30 seconds.

The best service is the one your contacts will actually use. Signal is objectively the most private messaging service available. But privacy is a two-way street. If your contact is backing up WhatsApp to unencrypted iCloud, your messages are exposed on their end regardless of what you use. Have the conversation. Move your sensitive contacts to Signal. Accept that not everyone will switch, and compartmentalize accordingly.

References

  1. [1] Fed. Bureau of Investigation, Lawful Access (Jan. 7, 2021) (obtained via public-records request by Property of the People), propertyofthepeople.org.
  2. [2] Andy Kroll, FBI Document Says the Feds Can Get Your WhatsApp Data, in Real Time, Rolling Stone (Nov. 29, 2021), rollingstone.com (the document was prepared by the FBI's Science and Technology Branch and Operational Technology Division; quoting Daniel Kahn Gillmor of the ACLU and Mallory Knodel of the Center for Democracy and Technology).
  3. [3] Brandon Vigliarolo, FBI Director Leaves Open the Possibility That It's Buying Location Data Again, The Register (Mar. 19, 2026), theregister.com (Director Patel's answer in full, Sen. Wyden's question quoting former Director Wray, and Wyden's response).
  4. [4] Riana Pfefferkorn, We Now Know What Information the FBI Can Obtain from Encrypted Messaging Apps, Just Security (Dec. 14, 2021), justsecurity.org.
  5. [5] Can the Government Read My Text Messages?, Digital Rights Bytes (Elec. Frontier Found.), digitalrightsbytes.org.
  6. [6] James Ball, NSA Collects Millions of Text Messages Daily in "Untargeted" Global Sweep, The Guardian (Jan. 16, 2014), theguardian.com (the DISHFIRE program; documents disclosed by Edward Snowden).
  7. [7] Apple, End-to-End Encrypted RCS Messaging Begins Rolling Out Today in Beta (May 11, 2026), apple.com (iPhone users on iOS 26.5 with supported carriers and Android users on the latest Google Messages; encrypted chats show a lock icon).
  8. [8] Signal, WhatsApp's Signal Protocol Integration Is Now Complete (Apr. 5, 2016), signal.org/blog.
  9. [9] Catalin Cimpanu, FBI Document Shows What Data Can Be Obtained from Encrypted Messaging Apps, The Record (Nov. 30, 2021), therecord.media (reproducing the document's entry for each app).
  10. [10] Matthew Green, Is Telegram Really an Encrypted Messaging App?, A Few Thoughts on Cryptographic Engineering (Aug. 25, 2024), blog.cryptographyengineering.com.
  11. [11] ESET, Breaking Down Telegram's Privacy Promise: What's Protected and What's Not (Dec. 2, 2025), eset.com (cloud chats and groups use client-server encryption, and Telegram holds the keys; IP addresses and device data are kept up to 12 months).
  12. [12] Signal, Terms of Service & Privacy Policy, signal.org/legal ("Signal cannot decrypt or otherwise access the content of your messages or calls"; profile names and photos are end-to-end encrypted).
  13. [13] Cooper Quintin & Babette Ngene, EFF to FCC: SS7 Is Vulnerable, and Telecoms Must Acknowledge That, Elec. Frontier Found. (July 15, 2024), eff.org (SS7 "was not built with any security protocols, such as authentication or encryption").
  14. [14] Apple Security Research, iMessage with PQ3: The New State of the Art in Quantum-Secure Messaging at Scale (Feb. 21, 2024), security.apple.com (PQ3 "will fully replace the existing protocol within all supported conversations," starting with iOS 17.4).
  15. [15] Apple, iMessage Security Overview, in Apple Platform Security Guide, support.apple.com.
  16. [16] Meta Engineering, Building End-to-End Security for Messenger (Dec. 6, 2023), engineering.fb.com (personal chats moving to end-to-end encryption by default; "the Signal protocol we use in our products").
  17. [17] Telegram, FAQ, telegram.org/faq (secret chats are device-specific; cloud chat keys are split across data centers in several jurisdictions; client apps are open source, and the server code is unpublished).
  18. [18] Signal, Signal-Server (source code, licensed under the GNU AGPLv3), github.com.
  19. [19] How Long Does Your Mobile Phone Provider Store Data for Law Enforcement Access?, Computerworld (Sept. 28, 2011), computerworld.com (summarizing a 2010 Justice Department retention chart obtained by the ACLU; Verizon kept text content for three to five days, and carriers kept records of who texted whom for one to seven years).
  20. [20] Kieren McCarthy, Thought the FBI Were the Only Ones Able to Unlock Encrypted Phones? Pretty Much Every US Cop Can Get the Job Done, The Register (Oct. 22, 2020), theregister.com (on Upturn's report Mass Extraction; at least 2,000 agencies have tools that extract "even 'deleted' data").
  21. [21] Chance Miller, Apple Debuts Advanced Data Protection to Bring End-to-End Encryption to Messages in iCloud, Photos, Device Backups, Much More, 9to5Mac (Dec. 7, 2022), 9to5mac.com (the feature is opt-in; "Messages in iCloud is end-to-end encrypted when iCloud Backup is disabled").
  22. [22] Meta, End-to-End Encrypted Backups on WhatsApp (Oct. 14, 2021), about.fb.com (an "optional layer of security" for backups stored on Google Drive or iCloud).
  23. [23] Signal, Introducing Signal Secure Backups (Sept. 8, 2025), signal.org/blog (opt-in and end-to-end encrypted, with a 64-character recovery key that "is never shared with Signal's servers").
  24. [24] Telegram Will Provide User Data to Law Enforcement in Response to Legal Requests, Security Affairs (Sept. 24, 2024), securityaffairs.com (Telegram's updated privacy policy; the earlier policy covered only cases of "confirmed terror-related suspicions").
  25. [25] Signal, Response to Grand Jury Subpoena (C.D. Cal. 2021), signal.org/bigbrother (the only data Signal could produce was the account's creation date and last-connection date).
  26. [26] Ionut Arghire, All Your iMessage Contacts Are Belong to Apple, SecurityWeek (Sept. 29, 2016), securityweek.com (reporting The Intercept's finding that the logs include the number entered, the date and time, and the user's IP address).
  27. [27] Apple, Legal Process Guidelines: Government & Law Enforcement Outside the United States, apple.com ("iMessage capability query logs are retained up to 30 days"; subscriber information includes name, physical address, email address and telephone number).
  28. [28] WhatsApp, Privacy Policy (effective Jan. 4, 2021), whatsapp.com (device and connection information including "battery level, signal strength," and IP address; information shared with other Meta companies).
  29. [29] Peter Elkind, Jack Gillum & Craig Silverman, How Facebook Undermines Privacy Protections for Its 2 Billion WhatsApp Users, ProPublica (Sept. 7, 2021), propublica.org (on Natalie "May" Edwards, the pen register on her WhatsApp account, and her six-month sentence).
  30. [30] Anastasia Kolobrodova, Metadata 102: What Is Communications Metadata and Why Do We Care About It?, Freedom of the Press Found. (Apr. 29, 2024, updated June 12, 2026), freedom.press (metadata "can't always be concealed with encryption").
  31. [31] Comm. to Protect Journalists, CPJ Safety Advisory: Spyware Vulnerability Found in WhatsApp (May 14, 2019), cpj.org (the spyware "can still be installed on a person's phone even if they do not answer the call").
  32. [32] NSO Group Hit with $168m Fine for WhatsApp Pegasus Spyware Abuse, Infosecurity Mag. (May 7, 2025), infosecurity-magazine.com (a jury awarded $167,254,000 in punitive damages plus $444,719 in compensatory damages; about 1,400 WhatsApp users' devices were attacked).
  33. [33] Apple Fixes "Zero-Click" iMessage Zero-Day Exploited to Deliver Spyware (CVE-2021-30860), Help Net Security (Sept. 14, 2021), helpnetsecurity.com (Citizen Lab's FORCEDENTRY finding; the exploit "allows circumvention of iOS's BlastDoor security system").
  34. [34] Ian Beer & Samuel Groß, A Deep Dive into an NSO Zero-Click iMessage Exploit: Remote Code Execution, Google Project Zero (Dec. 15, 2021); see also securityweek.com.
  35. [35] Forbidden Stories, About the Pegasus Project (July 18, 2021), forbiddenstories.org (more than 50,000 phone numbers "selected for surveillance" by NSO clients; Pegasus can read messages in encrypted apps and turn on the microphone and camera).
  36. [36] Citizen Lab, Hide and Seek: Tracking NSO Group's Pegasus Spyware to Operations in 45 Countries (Sept. 18, 2018), citizenlab.ca (quoting NSO that its product "is licensed to government and law enforcement agencies").
  37. [37] Bill Marczak et al., Breaking the News: New York Times Journalist Ben Hubbard Hacked with Pegasus after Reporting on Previous Hacking Attempts, Citizen Lab (Oct. 24, 2021), citizenlab.ca ("repeatedly targeted with NSO Group's Pegasus spyware over a three-year period from June 2018 to June 2021").
  38. [38] Citizen Lab, Pegasus investigations (2016-2024), citizenlab.ca.
  39. [39] Tim Starks, Judge Forbids NSO Group from Targeting WhatsApp Users, CyberScoop (Oct. 20, 2025), cyberscoop.com (Judge Phyllis Hamilton cut the punitive award to $4 million and barred NSO from targeting WhatsApp users).
  40. [40] CEO of Israeli Pegasus Spyware Firm to Step Down, Al-Monitor (Aug. 21, 2022), al-monitor.com (NSO's reorganization would include "focusing on NATO-member countries").
  41. [41] Cellebrite Announces Availability of Mobile Device Forensics Solutions Through Federal Government-Wide Procurement Vehicles, Forensic Focus (Aug. 20, 2015), forensicfocus.com (NASA SEWP V and NIH CIO-CS).
  42. [42] Press Release, Apple, Apple Expands Industry-Leading Commitment to Protect Users from Highly Targeted Mercenary Spyware (July 6, 2022), apple.com (Lockdown Mode, "an extreme, optional protection," arriving with iOS 16).
  43. [43] Costin Raiu, Fighting Back Against Pegasus, Other Advanced Mobile Malware, Dark Reading (Jan. 13, 2022), darkreading.com (Pegasus is "non-persistent malware, which leaves almost no traces after reboot").
  44. [44] A United Arab Emirates Agency Put Pegasus Spyware on Phone of Jamal Khashoggi's Wife Months Before His Murder, Forensics Show, Wash. Post (Dec. 21, 2021), reprinted in Anchorage Daily News, adn.com (the analyst "could not determine whether the spyware had successfully infected the phone").
  45. [45] Carpenter v. United States, 585 U.S. 296 (2018), supremecourt.gov (accessing seven days of historical cell-site records is a search; "Our decision today is a narrow one").
  46. [46] Byron Tau & Michelle Hackman, Federal Agencies Use Cellphone Location Data for Immigration Enforcement, Wall St. J. (Feb. 7, 2020) (data drawn from ordinary apps, including games and weather apps).
  47. [47] Joseph Cox, How the U.S. Military Buys Location Data from Ordinary Apps, Motherboard (Nov. 16, 2020), vice.com (Muslim Pro sent location data to X-Mode; X-Mode confirmed sales to U.S. military customers through defense contractors; Special Operations Command bought access to Locate X).
  48. [48] Open Hearing: Worldwide Threats, S. Select Comm. on Intelligence (Mar. 18, 2026), intelligence.senate.gov (witnesses including FBI Director Kash Patel).
  49. [49] Lindsey Wilkinson, Privacy Advocates Sound Alarm on "Data Broker Loophole" Used by FBI, Other Federal Agencies, FedScoop (Mar. 20, 2026), fedscoop.com.
  50. [50] FBI Latest to Admit to Bypassing Warrant Requirements by Purchasing Location Info from Data Brokers, Techdirt (Mar. 16, 2023), techdirt.com (quoting Director Wray's Mar. 8, 2023 testimony to the Senate Intelligence Committee, first reported by Dell Cameron in Wired).
  51. [51] Joseph Cox, Candy Crush, Tinder, MyFitnessPal: See the Thousands of Apps Hijacked to Spy on Your Location, 404 Media (Jan. 9, 2025), 404media.co (produced with support from Wired; the broker "appears to be acquiring their data from the online advertising 'bid stream'").
  52. [52] Press Release, Fed. Trade Comm'n, FTC Takes Action Against Gravy Analytics, Venntel for Unlawfully Selling Location Data Tracking Consumers to Sensitive Sites (Dec. 3, 2024), ftc.gov (the companies "claimed to collect, process, and curate more than 17 billion signals from around a billion mobile devices daily").
  53. [53] Shannon Vavra, DIA Uses Purchased Phone Location Data Without Warrants, CyberScoop (Jan. 22, 2021), cyberscoop.com (quoting a Jan. 15, 2021 Defense Intelligence Agency memo prepared for Sen. Wyden's office).
  54. [54] Press Release, Fed. Trade Comm'n, FTC Finalizes Order Prohibiting Gravy Analytics, Venntel from Selling Sensitive Location Data (Jan. 14, 2025), ftc.gov (exceptions "in limited circumstances involving national security or law enforcement").
  55. [55] Press Release, Rep. Zoe Lofgren, Lofgren, Davidson, Wyden, and Lee Introduce Bipartisan FISA Reform Bill to Protect Americans' Constitutional Rights (Mar. 13, 2026), lofgren.house.gov (the Government Surveillance Reform Act, introduced Mar. 12, 2026).
  56. [56] Jude Joffe-Block, Your Data Is Everywhere. The Government Is Buying It Without a Warrant, NPR (Mar. 25, 2026), npr.org (interviews with Rep. Warren Davidson and Jake Laperruque; ICE's Webloc contract and its request for "commercial Big Data and Ad Tech"; the FBI's refusal to say what it buys).
  57. [57] Eric McDaniel, FISA 702, a Key U.S. Spy Tool, Has Lapsed. Now What?, NPR (June 12, 2026), npr.org.

Updated October 2026 to add numbered citations, correct what the FBI director said about buying location data, and update the parts on Telegram, Signal's backups, RCS and NSO Group.

Disclaimer: This analysis is for educational and informational purposes only. It is not legal advice. The author is not a licensed attorney. The FBI "Lawful Access" document reflects capabilities as of November 2020. Several features have arrived since then, including WhatsApp's encrypted backups, Apple's Advanced Data Protection, Signal's encrypted backups, and encrypted RCS between iPhone and Android. Telegram widened what it shares with authorities in September 2024. FBI Director Patel's testimony regarding data broker purchases was delivered on March 18, 2026. All findings are sourced from published documents, official privacy policies, and reporting by established news organizations.
Field Assessment

Your photo library knows more about you than you think: Ente vs iCloud vs Google Photos vs OneDrive

Every photo you take records your exact GPS coordinates, the device you used, its operating system, the time down to the second, and in many cases the direction you were facing. When you upload those photos to a cloud service, the questions become who can see them, who can be compelled to hand them over, and whether AI is being trained on them without your meaningful consent. This is a field-by-field comparison of five configurations across four providers: Ente Photos, iCloud Photos with Advanced Data Protection, iCloud Photos without it, Google Photos, and Microsoft OneDrive.

D David
November 2025
Updated October 2026
~18 min read
A single photo taken with a modern smartphone can contain hundreds of metadata fields. These include GPS coordinates, a timestamp precise to the second, the make and model of the device, camera settings like aperture, shutter speed, and focal length, the direction the camera was facing (compass bearing), and altitude. This is called EXIF data (Exchangeable Image File Format), and it is embedded automatically every time you press the shutter button. You cannot see it by looking at the photo. But anyone with access to the file can read it in seconds. When you upload that photo to a cloud service, all of that metadata goes with it. That raises questions most people never think to ask. Does the service encrypt it? Can the service read it? Can law enforcement compel the service to hand it over? And is the service using your photos to train AI models? The answers vary dramatically depending on which service you use and how you have configured it.
What a Photo Reveals Encryption by Provider AI & Your Photos Under a Court Order Ente Deep Dive Per-Provider Summary Recommendations

Part I: What a Single Photo Reveals About You

Before comparing providers, it is worth understanding exactly what is at stake. Photo metadata is not abstract. It has been used in criminal investigations, stalking cases, corporate leak investigations, and intelligence operations. [1] The Electronic Frontier Foundation documented a case where the FBI identified an Anonymous hacker ("w0rmer") with help from a photo he linked to on Twitter. The photo was taken with an iPhone 4, and its EXIF data placed it at a house in Wantirna South, Australia. Investigators had already found his real name online, and his Facebook profile showed that his girlfriend was Australian. The location in the photo backed that up, and the FBI arrested him. [2]

EXIF Fields That Identify You These fields are embedded in every photo by default unless you disable them.
LocationGPS latitude, longitude, altitude, compass bearing, and speed. Accurate to within meters. Reveals your home address (from photos taken at home), workplace, doctor's office, attorney's office, place of worship, and every location you visit. Can be used to build a complete movement profile over time.
DeviceCamera make, model, software version, and lens. Many dedicated cameras also record their serial number, a unique hardware identifier that links every photo taken with that camera to a single physical object. Investigators have used serial numbers to connect photos across different platforms and timeframes to the same person.
EXIF Fields That Reveal Your Activity
TimeExact date and time the photo was taken, often to the second. Separate fields for the time the file was created, modified, and digitized. Establishes precise timelines of activity. Has been used in court to corroborate or destroy alibis. [1]
Software and EditingSoftware used to process or edit the image, editing timestamps, embedded thumbnails of the original uncropped image. The thumbnail field is particularly dangerous: even if you crop sensitive content out of a photo, the original uncropped version may persist as an embedded thumbnail in the EXIF data.
Real case When a new fleet of Apache helicopters arrived at a U.S. base in Iraq, soldiers took photos and posted them online. According to the Army, the geotags in those photos let insurgents pinpoint where the helicopters sat inside the compound, and a mortar attack destroyed four of them. [3] Companies like Facebook and Instagram now strip EXIF data on upload, but many platforms still do not. And regardless of what a platform does, the cloud service where the original photo is stored keeps all of it.

Part II: Encryption Architecture, Provider by Provider

Who can see your photos and their metadata? The answer depends entirely on the encryption model. Some providers encrypt your photos but hold the keys (meaning they can decrypt them under legal process). Some encrypt photos end-to-end (meaning only you can decrypt them). And some do not encrypt stored photos at all in any meaningful sense.

Who holds the key to your photos
The provider holds the keyGoogle Photos, OneDrive, and iCloud by default
Your phoneYour photos
Their serversPhotos, encryptedThe key
  • Can open every photo and its location data
  • Can run AI on your photos on its own servers
  • Can be made to hand them over under a warrant
Only you hold the keyEnte, and iCloud with Advanced Data Protection
Your phoneYour photosThe key
Their serversPhotos, encryptedNo key
  • Sees only encrypted files
  • Photo AI has to run on your phone
  • A warrant gets files only you can open
All four providers encrypt your photos on their servers. What differs is who holds the key. Advanced Data Protection is off by default, so most iCloud photo libraries are in the first group.
End-to-End Encryption of Photos This determines whether the provider can see your photos.
Ente PhotosFULL E2EE All photos, videos, and all metadata (including EXIF data, descriptions, tags, album names) are encrypted on your device before upload. Ente cannot see any of it. Uses libsodium, with XChaCha20-Poly1305 for files, XSalsa20-Poly1305 for keys and metadata, X25519 for sharing, and Argon2id to derive a key from your password. Audited twice by Cure53 (a 2023 cryptography audit, and a 2025 audit sponsored by CERN that covered the server, its infrastructure, and the apps). [4] [5]
iCloud (with ADP)E2EE When Advanced Data Protection is enabled, Photos is one of the 25 data categories protected with end-to-end encryption. Apple does not hold the decryption keys. However, ADP is opt-in, not on by default, and most users have not enabled it, so most iCloud photo libraries are not end-to-end encrypted in practice. Some metadata (file checksums, modification dates) remains under standard encryption even with ADP on. [6]
End-to-End Encryption of Photos (continued)
iCloud (without ADP)STANDARD ENCRYPTION ONLY Photos are encrypted in transit and at rest, but Apple holds the decryption keys. Apple can and does decrypt photos in response to valid search warrants. This is the default configuration for every iCloud account. [7] [8]
Google PhotosNO E2EE Photos are encrypted in transit (TLS) and at rest on Google's servers, but Google holds the keys. Google can access, scan, analyze, and provide your photos to law enforcement under a search warrant. [9] Google also scans the contents of Google accounts for CSAM using automated detection. [10]
End-to-End Encryption of Photos (continued)
Microsoft OneDriveNO E2EE FOR PHOTOS OneDrive encrypts files in transit and gives each stored file its own AES-256 key, but those keys are protected by master keys Microsoft keeps in its own Azure Key Vault, so Microsoft holds the keys. OneDrive Personal Vault adds an extra identity check but does not add end-to-end encryption. Microsoft can access stored photos under legal process. [11]
EXIF Metadata Encryption Whether the GPS coordinates, timestamps, and device identifiers embedded in your photos are encrypted If metadata is not encrypted, the provider knows where every photo was taken, when, and with what device.
EnteFULLY E2EE All metadata, including EXIF, is encrypted on device before upload. Ente's architecture encrypts each file "and associated metadata" with its own key, and its help pages list EXIF data as encrypted before upload. [4] [12]
iCloud (ADP)MOSTLY E2EE The photo files, including the EXIF data inside them, are E2EE. Apple states that "some metadata and usage information," such as file modification dates and checksums, remains under standard data protection even with ADP enabled. [6]
EXIF Metadata Encryption (continued)
iCloud (no ADP)NOT E2EE Apple holds the keys. All photo metadata is accessible to Apple and producible under warrant.
Google PhotosNOT E2EE Google reads EXIF metadata to power features like location-based photo search and the timeline view. This data is actively indexed and searchable by Google's systems.
EXIF Metadata Encryption (continued)
OneDriveNOT E2EE Microsoft can access photo metadata. OneDrive uses EXIF data for its "On This Day" and location features, confirming server-side access to the metadata.
Open Source
EnteFULL Client apps (iOS, Android, desktop, web) AND server code are open source. Audited by Cure53 and Symbolic Software in 2023, and by Cure53 again in a CERN-sponsored audit in October 2025. [5] [13]
iCloudNO Closed source. Apple publishes a security whitepaper but the code is not independently auditable.
Open Source (continued)
Google PhotosNO Closed source. Proprietary infrastructure.
OneDriveNO Closed source. Proprietary infrastructure.

Part III: AI, Your Photos, and Who Benefits

Every major cloud photo provider now offers AI-powered features like face recognition, object search, memory curation, image enhancement, and more. The privacy question is where that AI processing happens (on your device or on the provider's servers) and whether your photos are used to train the company's broader AI models.

Where AI Processing Happens Server-side processing means the provider can see your photos in order to analyze them.
EnteON-DEVICE ONLY All machine learning (like face detection, recognition, magic search) runs entirely on your device. Photos are downloaded locally, indexed locally, and the ML indexes are encrypted before syncing to your other devices. That means Ente's servers never see unencrypted photos or ML data. Ente also states that "your photos are never used to train AI models." [14]
iCloudMOSTLY ON-DEVICE Face recognition and object classification in Apple Photos run on your device, and Apple says it never uses its users' private personal data to train its foundation models. [15] The main exception is Enhanced Visual Search, which is on by default and sends Apple an encrypted, low-detail summary of any likely landmark in a photo. Apple built it so its servers cannot learn what is in your photos, and you can turn it off in Settings → Apps → Photos. [16] [17] Apple also planned in 2021 to scan photos on iPhones for known CSAM before they reached iCloud, then dropped the plan in December 2022 after privacy groups warned it would undercut encryption. [18] [19]
Where AI Processing Happens (continued)
Google PhotosSERVER-SIDE Google processes photos on its servers to power features like face grouping, object search, location tagging, memory curation, and the AI-powered "Magic Editor." Google's privacy page for Photos states: "We don't train any generative AI models outside of Google Photos with your personal data in Google Photos." But this carefully worded statement leaves open the question of what happens within the Photos product itself. And if you connect Photos to Gemini, Google says those services "process and save your data originating from Google Photos according to their policies." [20] Google also scans the contents of Google accounts for CSAM using automated detection systems. [10] Ente founder Vishnu Mohandas created the site TheySeeYourPhotos.com specifically to demonstrate what Google's AI can infer from a single photo. [21]
OneDriveSERVER-SIDE Microsoft uses server-side processing for photo features. Its newer People feature groups photos by face, and Microsoft's support page says that to do this it "collects, uses, and stores facial scans and biometric information." [22] Microsoft's privacy statement permits the use of data to "improve and develop" its products. Microsoft Copilot integration with OneDrive raises additional questions about how photo data is processed.
What AI Can Infer From Your Photo Library This applies to any provider that can see your photos in unencrypted form
A photo library is not just a collection of images. To a modern AI system with server-side access, it is a comprehensive behavioral and biographical dataset. From a typical photo library, AI can infer: your home address and workplace (from recurring GPS coordinates), your daily routine and travel patterns, every person you spend time with and how frequently (from face clustering), your physical appearance over time, the interior of your home, your financial status (from visible possessions, car, neighborhood), your children's faces and schools, your medical conditions (from hospital visits visible in location data), your political and religious affiliations (from events and locations), and your romantic relationships. The Ente team built TheySeeYourPhotos.com to make this visible: upload any photo and see what Google's publicly available AI models can extract from it. [21]
The broader AI training question In July 2023, Google updated its general privacy policy to explicitly state it may use publicly available information to train AI models. While Google's Photos-specific page says it does not train "generative AI models outside of Google Photos" with your personal data, the broader Google Terms of Service (updated May 2024) grant Google broad rights to use data across services. In December 2025, Proton publicly accused Google of training its image generation AI on Google Photos libraries. Proton offered no evidence, and Google did not respond to the claim directly. The fundamental issue remains: if the provider can see your photos (because they hold the encryption keys), the technical capability to use them for AI training exists regardless of stated policy. Policy can change. Encryption cannot. [23]
Under a court order: what gets handed over
Your Photo Library Under Legal Process
A search warrant compels the provider to hand over everything they have. The question is: what do they have? For providers that hold the encryption keys, the answer is everything. For providers with end-to-end encryption, the answer is essentially nothing.
Photo and Video Content Your actual photos and videos.
EnteCANNOT HAND OVER E2EE. Ente does not hold decryption keys. All content is encrypted blobs on their servers.
iCloud (ADP on)CANNOT HAND OVER E2EE. Apple's own guidelines say that with ADP on, it "cannot decrypt certain iCloud content, including Photos." [8] Apple's Law Enforcement Response Team has also said it will not confirm whether an account uses ADP without a warrant. [24]
Photo and Video Content (continued)
iCloud (no ADP)CAN HAND OVER Apple holds the keys. This was the loophole law enforcement used for years: even when an iPhone itself was locked, the iCloud backup (including Photos) was accessible via warrant. [7]
Google PhotosCAN HAND OVER Google holds the keys. Google's own policy says a search warrant can compel disclosure of "the content of communications, such as email messages, documents, and photos." [9]
Photo and Video Content (continued)
OneDriveCAN HAND OVER Microsoft holds the keys. Producible under valid legal process.
EXIF Metadata (GPS, timestamps, device info) Reveals where every photo was taken, when, and with what device.
EnteCANNOT HAND OVER E2EE. Metadata is encrypted with the file.
iCloud (ADP on)PARTIALLY PROTECTED The photos and the EXIF data inside them are E2EE, but Apple states that "some metadata and usage information" remains under standard protection, including modification dates and checksums. [6]
EXIF Metadata (continued)
iCloud (no ADP)CAN HAND OVER All metadata accessible.
Google / OneDriveCAN HAND OVER All metadata accessible. Google actively indexes this metadata for search and timeline features.
Face Recognition Data / AI-Generated Indexes
EnteCANNOT HAND OVER ML indexes are generated on-device and encrypted before sync. Thus, Ente's servers never see them.
Google PhotosCAN HAND OVER Face groupings, object tags, location clusters, and AI-generated labels are all server-side data that Google holds and can produce under warrant.
The UK precedent In early 2025, the UK Home Office secretly ordered Apple under the Investigatory Powers Act to provide blanket access to Advanced Data Protection-encrypted iCloud data worldwide. [25] Rather than comply, Apple pulled ADP from the UK in February 2025, so iCloud users there cannot turn on E2EE for their photos. Apple stated: "We have never built a backdoor or master key to any of our products or services, and we never will." [26] The UK later withdrew that order after objections from the United States, then reportedly issued a narrower one covering British users' data. As of August 2026, ADP was still unavailable in the UK, and Apple had filed a new legal challenge. [27] Government pressure on E2EE photo storage is not theoretical. It is happening now.

Part IV: Ente's Encryption Architecture (and Its One Noted Limitation)

Since Ente is the only provider on this list with full end-to-end encryption of photos by default, its architecture deserves a closer look. It also has one documented limitation worth discussing.

How Ente's Key Hierarchy Works
When you create an Ente account, the app generates a masterKey on your device. This key never leaves your device unencrypted. Your password is used to derive a keyEncryptionKey via Argon2id, which encrypts the masterKey. The encrypted masterKey is stored on Ente's servers so you can access your account from other devices, but only your password can unlock it.

Each album (collection) gets its own collectionKey. Each file gets its own fileKey. Files are encrypted with their fileKey, fileKeys are encrypted with the collectionKey, and collectionKeys are encrypted with your masterKey. This hierarchical key structure means that sharing an album with another Ente user requires only sending them the collectionKey (encrypted with their public key), not re-encrypting every file.

All cryptographic operations use libsodium, with XChaCha20-Poly1305 for the files themselves, XSalsa20-Poly1305 for keys and metadata, X25519 for sharing, and Argon2id to derive a key from your password. Cure53 audited the cryptography in March 2023 and audited Ente again in October 2025, in a CERN-sponsored engagement that covered the server, its infrastructure, and the apps. [4] [5] [13]
How Ente's keys fit together
Each key locks the one below it
What Ente's servers hold
Your passwordArgon2idKey encryption key
Never storedRebuilt from your password when you sign in
locks
Master key
Stored encrypted
locks one key for each album
Album keyAlbum key
Stored encrypted
locks one key for each photo
File keyFile keyFile key
Stored encrypted
locks the photo together with its metadata
PhotoPhotoPhoto
Stored encrypted
Sharing an album hands over one key
With another Ente accountYour app locks the album key with their public key
Album key+Their public key
Only they can open it
With a public linkThe album key rides in the link, after the #
albums.ente.com/?t=CsuR…#4mXo…Anyone with the link can open it
The part of a link after the # never reaches Ente's servers, so Ente never sees the key. But the key goes wherever the link goes, which is why a password, an expiry date, or account-to-account sharing matters for anything sensitive. [28]
Shared Links and Forward Secrecy This is a known architectural property, not a vulnerability.
Ente allows you to share albums via links that do not require the recipient to have an Ente account. These links are end-to-end encrypted (the decryption key is embedded in the URL fragment, which is never sent to the server). [28] However, these shared links do not provide forward secrecy. Forward secrecy means that if a key is compromised in the future, past communications remain secure. In Ente's shared link model, the key embedded in the link is static for the lifetime of that link. If someone obtains the link (through interception, a compromised device, or a shared chat log), they can access the album for as long as the link is active.

This is a known property of Ente's sharing model, not a bug. Any link that works without an account has to carry the key itself. The mitigation is straightforward: set an expiration on shared links, protect them with a password, and revoke links when they are no longer needed. For truly sensitive sharing, use Ente's account-to-account sharing (which uses asymmetric key exchange and does not have this limitation) rather than link-based sharing.

Per-Provider Summary

Ente Photos

BESTFull E2EE for everything. Photos, videos, all EXIF metadata, album names, descriptions, tags, and ML indexes. Ente cannot see any of your data.

BESTOn-device AI only. Face recognition and search run locally. ML indexes are encrypted before syncing. No server-side photo processing. No AI training on your data.

BESTFull open source. Client and server. Audited twice by Cure53, most recently in a CERN-sponsored audit in 2025.

PROSelf-hostable. You can run the entire Ente server on your own hardware.

PRO3x replication across providers in the EU, including an underground facility in Paris.

WARNShared links lack forward secrecy. Use password protection, expiration, and account-to-account sharing for sensitive content.

CONPaid service. 10 GB free, then paid plans starting at $2.49/month (50 GB). No free unlimited tier.

iCloud Photos (with ADP)

PROE2EE when ADP is enabled. Apple does not hold the keys. Photos and most metadata are protected.

PRODeep Apple ecosystem integration. Seamless with iPhone, iPad, Mac.

CONADP is opt-in. Not enabled by default. Most users have never turned it on.

CONSome metadata remains under standard protection even with ADP enabled (modification dates, checksums).

CONClosed source. Encryption implementation cannot be independently audited.

CONShared Albums do not support ADP. Photos in Shared Albums use standard encryption only, and an iCloud Shared Photo Library stays end-to-end encrypted only if everyone in it has ADP on.

CONUnavailable in the UK since February 2025, after the Home Office ordered Apple to provide backdoor access.

iCloud Photos (without ADP)

CONApple holds the encryption keys. All photos and metadata are accessible to Apple and producible under warrant.

CONThis is the default. Every iCloud account that has not explicitly enabled ADP operates in this mode.

CONThe iCloud backup loophole. For years, law enforcement obtained iPhone data not from the device itself, but from iCloud backups Apple could decrypt. Photos were a primary target.

WARNEnabling ADP is the single most important step an iPhone user can take for photo privacy. Settings → [Your Name] → iCloud → Advanced Data Protection → Turn On.

Google Photos

CONNo end-to-end encryption. Google holds the keys to every photo.

CONServer-side AI processing. Google's systems analyze your photos, faces, locations, objects, and scenes. All of this data is indexed and searchable on Google's servers.

CONActively scans for CSAM. Automated scanning means Google's systems are looking at your photos.

CONFully producible under warrant. Photos, metadata, face groupings, AI-generated labels, location history derived from photos.

CONPart of the Google advertising ecosystem. Google's broad privacy policy grants extensive data usage rights.

WARNGoogle produced data in about 82% of government requests as of mid-2024, the highest disclosure rate among the major tech companies Surfshark tracks. [29]

Microsoft OneDrive

CONNo end-to-end encryption for photos. Microsoft holds the keys. Personal Vault adds an authentication layer but not E2EE.

CONServer-side processing. Microsoft processes photos for organizational features and Copilot integration.

CONProducible under warrant. All photos and metadata accessible to Microsoft and law enforcement.

WARNOneDrive is not primarily a photo service. It is a general file storage platform. For users who store photos in OneDrive because it came bundled with Microsoft 365, the privacy implications are the same as Google Photos: the provider can see everything.

Recommendations

If privacy is a priority:
Use Ente Photos. It is the only service on this list that encrypts everything (photos, videos, all metadata, ML indexes) end-to-end by default, runs all AI processing on-device, is fully open source, and has been independently audited by Cure53 (twice, including a CERN-sponsored audit). The provider cannot see your photos under any circumstances. There is nothing to hand over under a court order because the data is encrypted and Ente does not hold the keys. For shared links, always set a password and an expiration. For sensitive sharing, use account-to-account sharing instead of links.
If you are staying in the Apple ecosystem:
Enable Advanced Data Protection immediately. This is the single most impactful privacy setting on your iPhone. Without it, every photo you take is stored on Apple's servers with keys Apple holds, producible under warrant. With it, your photos are end-to-end encrypted and Apple cannot decrypt them. Go to Settings → [Your Name] → iCloud → Advanced Data Protection → Turn On. You will need to set up a recovery key or recovery contact. Do it now. Be aware that Shared Albums do not support ADP, that some metadata remains under standard protection even with ADP enabled, and that ADP is not available in the UK for now.
Regardless of which service you use:
Disable location tagging on your camera. iOS: Settings → Privacy & Security → Location Services → Camera → set to "Never." Android: open your camera app's settings and turn off location tagging. It is called "Save location" on Pixel phones and "Location tags" on Samsung. [30] This prevents GPS coordinates from being embedded in your photos in the first place. It is the most effective single step you can take to reduce photo metadata exposure.

Strip EXIF data before sharing photos externally. If you share an original photo by email, as a file, or on any platform that does not automatically strip metadata, the full EXIF data travels with it. [1] On an iPhone, tap Options at the top of the share sheet and turn off Location before you send. [31] Otherwise, use a metadata removal tool or configure your sharing workflow to strip it.

Understand that Google Photos and OneDrive are not encrypted in any meaningful privacy sense. The provider holds the keys. They can see your photos, analyze them with AI, and hand them over under legal process. If you use these services, you are trusting the provider and every government with jurisdiction over them with your complete photo history, including every location, face, and moment captured in it.

Review your photo library as a threat surface. Your photo library is a biography. It contains your home, your family's faces, your travel patterns, your friends, your possessions, your health-related visits, and years of location history. Treat it with the same seriousness you would treat your medical records or financial statements. The encryption (or lack thereof) on your photo storage is not a technical detail. It is a decision about who gets access to the most intimate record of your life.

References

  1. [1] Nishchal Soni, Forensic Value of Exif Data: An Analytical Evaluation of Metadata Integrity across Image Transfer Methods, 2 Perspectives in Legal and Forensic Sciences 10006 (2025), sciepublish.com (chat apps that compress images strip most EXIF data, while email and file transfers keep all of it).
  2. [2] Hanni Fakhoury, A Picture Is Worth a Thousand Words, Including Your Location, Electronic Frontier Foundation (Apr. 20, 2012), eff.org.
  3. [3] Cheryl Rodewig, Geotagging Poses Security Risks, U.S. Army (Mar. 7, 2012), army.mil.
  4. [4] Ente, Architecture, ente.com.
  5. [5] Ente, Ente Completes CERN Sponsored Audit (Nov. 3, 2025), ente.com (Cure53 audited the server, its infrastructure, and all the apps; the report is dated October 2025).
  6. [6] Apple, iCloud Data Security Overview, support.apple.com (with Advanced Data Protection, 25 data categories are end-to-end encrypted, while some metadata stays under standard data protection).
  7. [7] Kendall Casey, Closing the Loophole: Effects of Apple's New Advanced Data Protection for iCloud, J. High Tech. L. Blog (Mar. 4, 2023), sites.suffolk.edu.
  8. [8] Apple, Legal Process Guidelines: U.S. Law Enforcement (Oct. 2025), apple.com (PDF).
  9. [9] Google, How Google Handles Government Requests for User Information, policies.google.com.
  10. [10] Google, Learn How Google Addresses Online Child Sexual Abuse and Exploitation, support.google.com (describes hash matching and AI used to analyze the content of Google Accounts).
  11. [11] Microsoft, How OneDrive Safeguards Your Data in the Cloud, support.microsoft.com; Microsoft, Protect Your OneDrive Files in Personal Vault, support.microsoft.com.
  12. [12] Ente, Metadata and Editing, Ente Help, ente.com.
  13. [13] Ente, Ente Successfully Completes a Security Audit (Mar. 22, 2023), ente.com (audit by Cure53 in collaboration with Symbolic Software, with the full report linked).
  14. [14] Ente, Machine Learning, Ente Help, ente.com.
  15. [15] Apple Machine Learning Research, Introducing Apple's On-Device and Server Foundation Models (June 10, 2024), machinelearning.apple.com.
  16. [16] Apple, About Enhanced Visual Search in Photos (Sept. 15, 2025), support.apple.com.
  17. [17] Stephen Schenck, Did You Know That iOS 18 Transmits Photo Location Data to Apple by Default?, Android Authority (Dec. 30, 2024), androidauthority.com.
  18. [18] Joe Mullin, In 2021, We Told Apple: Don't Scan Our Phones, Electronic Frontier Foundation (Dec. 28, 2021), eff.org.
  19. [19] Ed Hardy, Apple Drops Controversial Plan to Scan iCloud Photos for CSAM, Cult of Mac (Dec. 7, 2022), cultofmac.com.
  20. [20] Google, Gemini Features in Photos Privacy Hub, Google Photos Help (updated Feb. 18, 2026), support.google.com.
  21. [21] This Website Reveals What Google's AI Can Learn From Your Photos, PetaPixel (Dec. 3, 2024), petapixel.com.
  22. [22] Microsoft, Group Photos by People in OneDrive, support.microsoft.com.
  23. [23] Gintaras Radauskas, Proton Claims Google Trains AI on Google Photos Albums: Does It?, Cybernews (Dec. 31, 2025), cybernews.com.
  24. [24] Destin Watkins, iCloud Advanced Data Protection: A Challenge for Law Enforcement, WarrantBuilder (Feb. 12, 2024), warrantbuilder.com.
  25. [25] Pieter Arntz, Apple Ordered to Grant Access to Users' Encrypted Data, Malwarebytes (Feb. 11, 2025), malwarebytes.com.
  26. [26] Jonny Evans, Apple Terminates UK Data Protection After Government Overreach, Computerworld (Feb. 21, 2025), computerworld.com.
  27. [27] Alex Lekander, Apple Challenges New UK Demand to Access Encrypted iCloud Data, CyberInsider (Aug. 4, 2026), cyberinsider.com.
  28. [28] Ente, Public Links, Ente Help, ente.com.
  29. [29] Chiara Castro, Big Tech Increasingly Forced to Disclose Users' Data to Authorities Worldwide, According to a New Report, TechRadar (June 9, 2025), techradar.com (reporting Surfshark's analysis of company transparency reports).
  30. [30] Google, Change Your Camera Location Settings, Google Photos Help, support.google.com (lists the setting name for each phone maker).
  31. [31] Apple, Manage Location Metadata in Photos, Personal Safety User Guide, support.apple.com.
Disclaimer: This analysis is for educational and informational purposes only. It is not legal advice. The author is not a licensed attorney. Provider policies and features are subject to change. iCloud Advanced Data Protection availability varies by region (unavailable in the UK since February 2025). Google Photos and Microsoft OneDrive policies reflect publicly available documentation as of October 2026. Ente's architecture and audit results are based on published documentation and Cure53 audit reports.
Technical Brief

How encryption actually works, why it matters, and where it stops protecting you

This is the post I will keep pointing you to. If you have read anything else on this site and found yourself wondering what AES-256 actually means, what end-to-end encryption is doing under the hood, whether quantum computers can break all of it, or why encryption alone is not enough, this is where those questions get answered. It assumes no background, and it does not water anything down to get there.

D David
October 2025
Updated October 2026
~16 min read
Encryption is mathematics applied to secrecy. That is all it is. It takes readable information, runs it through a mathematical function with a key, and produces output that is unreadable without the key. The math is public. The algorithms are published. The only secret is the key. Everything you read on this site about email privacy, messaging apps, notes metadata, and court orders comes back to this one question. What is encrypted, with what algorithm, and who holds the key? This post explains the core concepts that make all of that analysis possible. It is written for someone who has never studied cryptography, but it does not skip the parts that matter to someone who has.
The Two Types of Encryption AES-256 & The Quantum Question How HTTPS Works Where Encryption Stops Quick Reference

Part I: The Two Fundamental Types of Encryption

Every encryption system in use today falls into one of two categories, or combines both. Understanding the difference between them is the most useful thing you can learn about cryptography.

Symmetric Encryption: One Key, Two People
Symmetric encryption uses the same key to encrypt and decrypt. Think of it like a lockbox with a single key. Whoever holds the key can lock the box and unlock it again, so both people need a copy of the same key. The same key does both jobs.

This is the oldest form of encryption and still the fastest. When your phone encrypts its storage, it uses symmetric encryption. When Signal encrypts a message after the handshake is complete, the actual message encryption is symmetric. When a VPN encrypts your traffic, symmetric encryption does the heavy lifting.

The problem with symmetric encryption is the key exchange. How do you get the same key to two people without anyone else seeing it? If you are standing in the same room, you can whisper it. If you are on opposite sides of the internet, you need a way to agree on a shared secret without ever transmitting it in the clear. That problem is what asymmetric encryption was invented to solve.
The Major Symmetric Algorithms
AES (Advanced Encryption Standard)The most widely used symmetric cipher in the world. Standardized by NIST in 2001. Its three key sizes are AES-128, AES-192, and AES-256. Used by governments, banks, messaging apps, VPNs, disk encryption, and virtually everything else that needs to keep data secret. AES-256 is the variant recommended for long-term security and is considered quantum-resistant (more on this below).
ChaCha20A modern stream cipher designed by Daniel Bernstein. Used by the WireGuard VPN protocol and widely in HTTPS. Faster than AES on devices without hardware AES acceleration, like older phones. With its 256-bit key, it is considered as strong as AES-256.
Asymmetric Encryption: Two Keys, One Direction Each
Asymmetric encryption (sometimes referred to as public-key cryptography) uses two mathematically linked keys, a public key and a private key. Anyone can encrypt a message using your public key. Only your private key can decrypt it. In other words, the public key locks; the private key unlocks. They are not the same key, and no one can work out the private key from the public key in any practical amount of time.

This solves the key exchange problem. You publish your public key to the world. Someone encrypts a message with it and sends it to you. Only you can read it, because only you have the private key. No shared secret needs to be transmitted.

The trade-off is speed. Asymmetric encryption is far slower than symmetric encryption, often by a factor of a thousand or more. You would never encrypt an entire video call with RSA. It would be unusably slow. This is why real-world systems use both types together.
The Major Asymmetric Algorithms
RSAThe original. Published in 1977. Security is based on the mathematical difficulty of factoring very large numbers into their prime components. RSA-2048 and RSA-4096 are common key sizes. Older Proton Mail accounts still use RSA keys. [1] RSA is vulnerable to quantum computers running Shor's algorithm, which can factor large numbers efficiently. RSA will need to be replaced in the post-quantum era.
Elliptic Curve (ECC)A newer approach using the mathematics of elliptic curves. Provides equivalent security to RSA with much smaller keys (a 256-bit ECC key is roughly equivalent to a 3,072-bit RSA key). X25519, built on Curve25519, is one of the most widely used. Signal uses it, Tuta Mail uses it, and newer Proton Mail accounts use Curve25519 keys by default. [1] Faster and more efficient than RSA. Also vulnerable to Shor's algorithm on a quantum computer.
Hybrid Encryption: How the Real World Actually Works This is what every modern secure system uses.
In practice, systems that send data between devices do not use either type alone. Every secure messaging app, every HTTPS connection, every VPN tunnel uses both together in what is called hybrid encryption. Here is how it works.

Step 1: Your device and the other device use asymmetric cryptography (like X25519) to agree on a shared secret key. This is called the key exchange or handshake. It happens once at the start of the session.

Step 2: Once both devices have the shared secret, they switch to symmetric encryption (like AES-256 or ChaCha20) for the actual data. Every message, every file, every voice packet is encrypted with the fast symmetric cipher using the key that was established in step 1.

The asymmetric part solves the "how do two strangers agree on a secret?" problem. The symmetric part handles the "now encrypt everything quickly" problem. Together, they give you both security and speed. When someone says "Signal uses the Signal Protocol with X25519 and AES-256," they are describing a hybrid system.
How two phones agree on a key without ever sending it
Your phone
The networkAnyone can watch
Their phone
Step 1, the handshake
Each phone makes a pair of keys.
Private keyPublic key
Nothing sent yet
Private keyPublic key
They trade public keys.
ReceivesTheir public key
Public key→←Public keyVisible to anyone
ReceivesYour public key
Each phone mixes its own private key with the other's public key, and both arrive at the same secret.
Your private key+Their public key=Shared secret
Never sentThe secret is never on the network
Their private key+Your public key=Shared secret
Step 2, the messages
The shared secret encrypts everything that follows, with a fast cipher like AES-256.
"See you at 6"→Encrypt
9f2c 71ab e04d 5a…Unreadable
Decrypt→"See you at 6"
Someone watching the network sees both public keys and the encrypted messages, but there is no practical way to work out the shared secret from them. This is the X25519 handshake behind Signal, HTTPS, and many VPNs.

Part II: Can AES-256 Be Cracked? The Quantum Question, Answered With Physics

This is the section I wrote because I keep seeing the same fear repeated online. "Quantum computers will break all encryption." That statement is half true and half dangerously misleading. Quantum computers pose a real, existential threat to asymmetric encryption (RSA, ECC). They pose essentially zero practical threat to AES-256. Here is why, quantified in terms that are hard to forget.

What Grover's Algorithm Actually Does
Grover's algorithm, published in 1996, is the best known quantum algorithm for attacking symmetric encryption. It provides a quadratic speedup for brute-force search, meaning it can search a keyspace in roughly the square root of the number of steps a classical computer would need.

For AES-256, the keyspace is 2^256 possible keys. Grover's algorithm reduces this to 2^128 operations. In plain language, a quantum computer running Grover's algorithm against AES-256 would face the equivalent difficulty of a classical computer brute-forcing AES-128.

AES-128 is still considered secure against classical computers today. 2^128 is approximately 3.4 × 10^38 operations. To put that in human terms, there are roughly 10^22 stars in the observable universe. 2^128 is about 34 quadrillion times that number. Grover's algorithm makes AES-256 "only" as hard as that. [2] [3]
What Shor's Algorithm Does (and Why It Matters for RSA, Not AES)
Shor's algorithm is the quantum threat that actually keeps cryptographers awake. Unlike Grover's quadratic speedup, Shor's algorithm provides an exponential speedup for factoring large numbers and computing discrete logarithms. These are the specific mathematical problems that RSA and Elliptic Curve cryptography depend on.

A sufficiently powerful quantum computer running Shor's algorithm could factor an RSA-2048 key in hours or days instead of billions of years. It could solve the elliptic curve discrete logarithm problem that protects X25519. When this happens (and many researchers expect it within the next 10 to 20 years), every asymmetric algorithm currently in widespread use will be broken.

AES is not vulnerable to Shor's algorithm. AES does not depend on factoring or discrete logarithms. It is a substitution-permutation network. Shor's algorithm simply does not apply to it. The only quantum attack on AES is Grover's brute-force speedup, and as shown above, AES-256 survives that comfortably. [4]
The Physics Argument, and Where It Stops Against an ordinary computer, this stops being a math problem and becomes a physics problem.
In 2000, MIT professor Seth Lloyd published a paper in Nature titled "Ultimate Physical Limits to Computation." Lloyd worked out the most computing any physical system can do, using three fundamental constants, the speed of light, Planck's constant, and the gravitational constant. His theoretical "ultimate laptop" was a 1-kilogram computer confined to 1 liter of volume, operating at the absolute limit physics allows and converting all of its mass into computational energy via E=mc². [5]

This ultimate laptop could perform about 5 × 10^50 operations per second. Nothing built from a kilogram of matter can do more.

Now point it at AES-256 the classical way, by trying every key. There are about 1.2 × 10^77 possible keys. Even if the ultimate laptop could test one key per operation, trying them all would take about 7 × 10^18 years, roughly 500 million times the current age of the universe.

That settles the classical case. Against Grover's algorithm, physics on its own does not. If the ultimate laptop could somehow run Grover's 2^128 steps at full speed, it would finish in less than a trillionth of a second. What protects AES-256 from a quantum attack is how Grover's algorithm has to run on real machines.

Grover's steps have to happen one after another, and each step means running the entire AES cipher as a quantum circuit many thousands of error-corrected operations deep. Even a wildly optimistic quantum computer that finished a billion of those steps every second would need about 10^22 years to find one AES-256 key, nearly a trillion times the age of the universe. Splitting the work across machines barely helps, because Grover's algorithm parallelizes poorly. A million quantum computers working together would finish only about a thousand times sooner. [6]

Even one such machine is far off. A 2015 study estimated that running Grover's algorithm against AES-256 would take close to 7,000 logical, error-corrected qubits, along with an extraordinarily long chain of operations. [4] The largest quantum processors built so far have around a thousand physical qubits, and each error-corrected logical qubit takes many physical ones. [7] The gap between where we are and where an attack would need to be is not a matter of a few years but of architectural generations.

The NSA's own CNSA 2.0 suite, its standard for protecting classified information against future quantum computers, requires AES-256. [8]
What a large quantum computer does to each kind of key
Effective strength in bits, against today's computers and against a large quantum computer
AlgorithmAgainst today's computersAgainst a large quantum computer
AES-256 and ChaCha20256 bits128 bits, halved by Grover's algorithm
X25519128 bitsBroken by Shor's algorithm
RSA-2048112 bitsBroken by Shor's algorithm
Grover's algorithm cuts AES-256 to 128 bits, the same strength X25519 has against today's computers. Shor's algorithm does not weaken RSA and elliptic curve keys, it breaks them. Strength figures follow NIST's comparable security strengths. [9]
Bottom line Quantum computers are a real and urgent threat to RSA and Elliptic Curve cryptography. They are not a meaningful threat to AES-256. If your data is encrypted with AES-256 (or ChaCha20 at equivalent key length), the quantum apocalypse does not apply to you. The post-quantum transition is about upgrading the key exchange algorithms (the asymmetric part), not the data encryption algorithms (the symmetric part). This is exactly what Tuta Mail did in March 2024 when it deployed TutaCrypt, which pairs the classical X25519 key exchange with CRYSTALS-Kyber, a quantum-resistant algorithm, while keeping AES-256 for the data. Chrome did the same for HTTPS connections in 2024. [10]

Part III: How HTTPS Encryption Works (and What It Does Not Do)

Every time you see the padlock icon in your browser or a URL starting with https://, you are using encryption. Since this site is served over HTTPS, and since HTTPS is the most common encryption most people encounter daily, it is worth understanding what it actually protects.

What HTTPS Does
HTTPS stands for HTTP Secure. It wraps the normal web protocol (HTTP) in a layer of encryption called TLS (Transport Layer Security, the successor to SSL). When your browser connects to a website over HTTPS, a hybrid encryption handshake occurs.

1. Your browser and the server agree on a shared secret using asymmetric cryptography, typically X25519. Chrome has paired it with a post-quantum algorithm by default since 2024, now ML-KEM. [10]
2. The server proves its identity using a digital certificate signed by a Certificate Authority (CA) that your browser trusts.
3. All the data that follows is encrypted with that shared secret using symmetric encryption (AES-GCM or ChaCha20-Poly1305).

The result is that everything between your browser and the server is encrypted. The content of the pages you view, the data you submit in forms, the cookies your browser sends, all of it travels through an encrypted tunnel that your ISP, your Wi-Fi operator, and anyone else on the network path cannot read.
What HTTPS Does Not Do These are common misconceptions.
HTTPS does not hide which website you are visiting. Your ISP can see the domain name (for example, orionprivate.com) because the DNS query that resolves the domain is typically unencrypted, and the TLS handshake itself includes the server name in plaintext. HTTPS hides the page you are on and the content you are viewing, but not the fact that you visited the site at all. To hide the domain, you need encrypted DNS (DoH or DoT) and a site that supports Encrypted Client Hello (ECH).

HTTPS does not protect data after it reaches the server. TLS encryption covers data in transit. Once the data arrives at the server, it is decrypted and the server can read it. If you submit a form over HTTPS, the website operator can see exactly what you typed. This is client-to-server encryption, not end-to-end encryption. End-to-end encryption (like Signal or the PGP form on this site) means only the intended recipient can decrypt the data, not even the server that carries it.

HTTPS does not mean the website is trustworthy. A padlock means the connection is encrypted. It says nothing about who is on the other end. Phishing sites use HTTPS too.
What someone watching your connection can see
Finding the siteThe DNS lookup
Youorionprivate.comDNS server
Visibleunless you use encrypted DNS
Opening the connectionThe TLS handshake
Youorionprivate.comWebsite
Visibleunless the site supports Encrypted Client Hello
Loading the pageEverything after the handshake
You7f3a 0c91 e24b 9d…Website
Encryptedthe exact page, its content, what you type, your cookies
At the websiteWhere HTTPS ends
WebsiteWhat you sent, decryptedSite owner
Readableby whoever runs the site
HTTPS hides what you do on a site, not which site you visit. Encrypted DNS and Encrypted Client Hello close the first two gaps. Only end-to-end encryption closes the last one.

Part IV: Where Encryption Stops Protecting You

This is the most important section in this post. Encryption is extraordinary technology. The math is sound. AES-256 will not be broken in your lifetime, your children's lifetime, or the lifetime of the sun. But encryption only protects what it covers. And the places where it does not cover you are exactly the places where real-world surveillance happens.

Metadata Is Not Encrypted This is the most important concept in practical privacy.
End-to-end encryption protects the content of your message. It does not protect the fact that you sent it, who you sent it to, when you sent it, how often you communicate, from what device, or from what location. This information, called metadata, is available to the service provider and, under legal process, to law enforcement.

As I documented in my messaging comparison, the FBI's own "Lawful Access" document shows that, under a pen register order, WhatsApp can send law enforcement the source and destination of every message every 15 minutes. The message content is encrypted. The metadata is not. In the Natalie Edwards case, that kind of metadata helped the FBI build its case against a Treasury Department adviser who later pleaded guilty to leaking documents to a reporter. [11]

Former NSA Director Michael Hayden put it more bluntly. "We kill people based on metadata."
A Compromised Device Makes Encryption Irrelevant
Encryption protects data in transit (between devices) and at rest (on disk). It does not protect data in use (on your screen, in your app's memory, after decryption). If your device is compromised by spyware like NSO Group's Pegasus, the attacker reads your messages after they are decrypted, directly from the screen and memory of your phone. It does not matter if you are using Signal with AES-256 and X25519 and disappearing messages. Pegasus reads the decrypted text, records your screen, activates your microphone, and exfiltrates everything. Google's Project Zero called one Pegasus exploit "one of the most technically sophisticated exploits we've ever seen." [12]

Similarly, forensic extraction tools like Cellebrite and GrayKey, used by law enforcement worldwide, can often bypass device locks and extract data from phones, including messages from encrypted apps, if they gain physical access to the device. [13]

For iPhone users facing elevated threat levels, Apple's Lockdown Mode (iOS 16+) reduces the attack surface significantly by disabling features commonly exploited by spyware, including certain iMessage attachment types, FaceTime from unknown callers, and shared albums. It is the most effective step an iPhone user can take against targeted surveillance short of switching to a dedicated security-focused operating system.

The encryption did not fail. The device did.
Your Phone Takes Screenshots of Everything Most people do not know this happens.
Both iOS and Android take automatic screenshots of your apps for the app switcher (the screen you see when you swipe up to switch between apps). These preview images are stored locally on the device. On iOS, these snapshots are taken every time you leave an app or switch to another one. They capture whatever was on screen at that moment, including the contents of encrypted messaging apps, passwords visible in a password manager, sensitive documents, and anything else displayed.

These snapshots are stored in the device's filesystem and can be extracted by forensic tools during a physical examination of the phone. Your encrypted Signal message that disappears after 30 seconds may live on indefinitely as a screenshot in the app switcher cache.

Signal addresses this with a setting that blocks the operating system from capturing these previews (Settings → Privacy → Screen Security on Android, and Hide Screen in App Switcher on iOS). [14] When it is on, Signal shows a blank screen in the app switcher. Many other messaging apps have no equivalent setting, so check before you rely on one.
Cloud Backups Undo Encryption
As I covered in my messaging comparison, if your encrypted iMessages are backed up to iCloud without Advanced Data Protection enabled, Apple stores the messages with the encryption key and hands both over under a search warrant. If your WhatsApp messages are backed up to Google Drive or iCloud without encrypted backup enabled, the content sits in the cloud without end-to-end encryption, where the cloud provider can be compelled to hand it over.

The encryption worked perfectly. The backup defeated it. That is not a failure of the encryption but of the system design around it, and of the defaults that most users never change.
Operational Security (OPSEC) Is the Real Perimeter
Encryption is a tool. Operational security is the discipline of using that tool correctly within the full context of your threat model. The best encryption in the world does not help if any of the following is true.

You reuse a password that has already leaked, with no security key behind it. Whoever signs in as you reads everything you can, which is the likely story behind the leak of the FBI director's personal Gmail in 2026 (I go through that case in a short brief).

You use a personal recovery email on your encrypted mail account (the Catalan activist case, where Proton Mail's encryption held but the recovery email led to identification via Apple). [15]

You pay for a privacy service with a credit card (the Stop Cop City case, where payment data Proton handed to Swiss authorities helped the FBI identify a Proton Mail user). [16]

You carry a phone full of ad-supported apps with location permissions enabled while federal agencies buy location data from commercial brokers (in March 2026 the FBI director told the Senate the bureau buys commercially available information and wouldn't rule out location data). [17]

You discuss sensitive topics in a group chat where one participant has iCloud backup enabled. Your encryption is only as strong as the weakest device in the conversation.

Encryption protects the pipe. OPSEC protects everything around it. Serious adversaries rarely bother attacking the mathematics; they go after the person using it.

Quick Reference: What to Remember

Symmetric encryption (AES-256, ChaCha20):
Same key encrypts and decrypts. Fast. Used for the actual data. AES-256 is quantum-resistant. The NSA recommends it for classified data. Even with Grover's quantum speedup, finding a single key would take far longer than the age of the universe.
Asymmetric encryption (RSA, ECC/X25519):
Two keys. Public encrypts, private decrypts. Slow. Used for key exchange and digital signatures. Vulnerable to quantum computers running Shor's algorithm. Will need to be replaced with post-quantum algorithms such as ML-KEM and ML-DSA, the standards NIST finalized in 2024 from Kyber and Dilithium, within the next 10 to 20 years. The "harvest now, decrypt later" threat is real. Data encrypted with RSA today could be stored and decrypted once quantum computers are available.
Hybrid encryption:
Every system that sends data between devices uses both together. Asymmetric for the handshake, symmetric for the data. HTTPS, Signal, WhatsApp, VPN tunnels, and Tuta Mail all work this way. Post-quantum migration means replacing the asymmetric handshake layer while keeping the symmetric data layer.
HTTPS:
Encrypts traffic between your browser and the server. Protects content in transit. Does not hide which domain you visit (that takes encrypted DNS and Encrypted Client Hello). Does not protect data after it reaches the server (that requires end-to-end encryption). Does not mean the website is trustworthy.
Where encryption stops:
Metadata (who, when, how often) is not encrypted by most services. Compromised devices read messages after decryption. App switcher screenshots capture encrypted content. Cloud backups can store your messages without end-to-end encryption. Operational security failures (recovery emails, payment data, location tracking) expose you through channels encryption was never designed to protect. The mathematics holds; the weak points are the people and systems around it, and that is where your attention belongs.

References

  1. [1] Proton, How to Create New Encryption Keys in Proton Mail, proton.me (Proton Mail uses Curve25519 keys by default; accounts created before 2021 may still have RSA keys).
  2. [2] Lov K. Grover, A Fast Quantum Mechanical Algorithm for Database Search, in Proceedings of the 28th Annual ACM Symposium on Theory of Computing 212 (1996).
  3. [3] Understanding Shor's and Grover's Algorithms, Fortinet, fortinet.com.
  4. [4] Markus Grassl et al., Applying Grover's Algorithm to AES: Quantum Resource Estimates, arXiv:1512.04965 (2015), arxiv.org.
  5. [5] Seth Lloyd, Ultimate Physical Limits to Computation, 406 Nature 1047 (2000), nature.com.
  6. [6] Grover's Algorithm and Its Impact on Cybersecurity, PostQuantum.com, postquantum.com (Grover's iterations must run in sequence, and the algorithm parallelizes poorly).
  7. [7] Matt Swayne, IBM Says New 1,000-plus Processors Help Advance Industry Toward Quantum Utility, The Quantum Insider (Dec. 4, 2023), thequantuminsider.com (IBM's Condor processor, at 1,121 physical qubits).
  8. [8] Nat'l Sec. Agency, Announcing the Commercial National Security Algorithm Suite 2.0 (Sept. 7, 2022), media.defense.gov (PDF) (AES-256 for symmetric encryption, alongside quantum-resistant algorithms for key establishment and signatures).
  9. [9] Elaine Barker, Recommendation for Key Management, Part 1, NIST Special Publication 800-57 Part 1 Rev. 5 (May 2020), csrc.nist.gov (comparable security strengths, including 112 bits for RSA-2048 and 128 bits for 256-bit elliptic curve keys).
  10. [10] David Adrian et al., A New Path for Kyber on the Web, Google Online Security Blog (Sept. 13, 2024), security.googleblog.com (Chrome's hybrid key exchange paired X25519 with Kyber and moved to ML-KEM in Chrome 131).
  11. [11] Fed. Bureau of Investigation, Lawful Access (Jan. 7, 2021) (obtained via public-records request by Property of the People), reported in Rolling Stone (Nov. 29, 2021).
  12. [12] Ian Beer & Samuel Groß, A Deep Dive into an NSO Zero-Click iMessage Exploit: Remote Code Execution, Google Project Zero (Dec. 15, 2021); see also securityweek.com.
  13. [13] Can the Government Read My Text Messages?, Digital Rights Bytes (Elec. Frontier Found.), digitalrightsbytes.org.
  14. [14] Signal Support, Screen Security, support.signal.org.
  15. [15] Lorenzo Franceschi-Bicchierai, Encrypted Services Apple, Proton, and Wire Helped Spanish Police Identify Activist, TechCrunch (May 8, 2024), techcrunch.com (Swiss legal process compelled Wire and Proton to disclose account metadata, including the recovery email, which led Apple to provide the user's name and address; message content remained encrypted).
  16. [16] Joseph Cox, Proton Mail Helped FBI Unmask Anonymous "Stop Cop City" Protester, 404 Media (Mar. 5, 2026), 404media.co (Proton Mail provided account payment data to Swiss authorities, who passed it to the FBI; end-to-end encryption protected message content, not the account metadata).
  17. [17] Jude Joffe-Block, Your Data Is Everywhere. The Government Is Buying It Without a Warrant., NPR (Mar. 25, 2026), npr.org.
Disclaimer: This analysis is for educational and informational purposes only. It is not legal advice. The author is not a licensed attorney or a cryptographer. The mathematical and physical claims in this article are based on published, peer-reviewed research and are cited accordingly. The physical computing limits come from Seth Lloyd's 2000 paper in Nature. Grover's and Shor's algorithm descriptions reflect the current scientific consensus. Quantum computing capability estimates reflect publicly available information as of October 2026.
Analysis

The FTC was never enough: How America's de facto privacy regulator was structurally outmatched long before it lost its independence

For two decades the Federal Trade Commission was the closest thing Americans had to a privacy regulator. In 2025 the President fired its Democratic commissioners, and in June 2026 the Supreme Court held that he could. The easy story is that politics broke a working agency. The truer one is that the FTC Congress built could not have protected your privacy on its own, even at its best, and that its most careful scholar, Chris Hoofnagle, documented why while defending it.

D David
April 2026
Updated October 2026
~31 min read
The United States has no federal privacy law. Where the European Union has the GDPR and independent regulators, the United States has a patchwork. HIPAA covers health, FERPA covers education, COPPA covers children, and almost everything else falls to the Federal Trade Commission. Its privacy authority comes from Section 5 of the FTC Act, which bars "unfair or deceptive acts or practices." That's the whole of it. There's no privacy mandate, no general power to fine a privacy violation, and no practical way to write general privacy rules. The role was inferred from a commercial fairness statute a century older than the data economy.

The FTC made it work by improvising. Its staff framed privacy cases as deception and settled them in consent orders that bound Google, Facebook and others for twenty years. (A consent order is a settlement the agency issues itself. When a company breaks one, the penalty case goes to federal court, where the settlement is usually called a consent decree.) It produced real results, and it was fragile and insufficient at the same time. It was fragile because it depended on lawyers willing to push, economists willing to go along, and commissioners willing to vote yes. It was insufficient because the tools were never built for the job. The second problem matters more, and it's the one I argue here.

Two more threads run through what follows. Section 5 reaches commerce, not the government, and the government has become one of the largest buyers of the data you generate. And the agency's history keeps teaching one distinction. A promise protects you until someone decides otherwise. A constraint protects you until someone acts, in public, to remove it. The FTC spent most of its privacy history policing promises, and in the end it was only a promise itself.
Borrowed Authority Even at Full Strength The Inner Struggle Settlements, Not Law The Test, 2025 to 2026 What Enough Looks Like Promises and Constraints Conclusion

Part I: Borrowed Authority

The FTC was built in 1914 to break up monopolies. Privacy came more than eighty years later, and the agency had to improvise it out of a fairness statute and a long history of false advertising cases. Its most careful scholar, Chris Hoofnagle, is my main source, and that's deliberate. He wrote the strongest defense of the agency, and the same body of work holds the clearest evidence of its limits. I read them together.

Built to fight monopolies
Congress created the FTC in 1914 to fight the trusts and monopolies of the industrial economy. It had no consumer protection mission until the Wheeler-Lea Amendments of 1938 added "unfair or deceptive acts or practices" to its original ban on "unfair methods of competition." [1] Privacy is a small, recent entry on a long list. The agency enforces some seventy laws, covering everything from "dolphin-safe" tuna labels to the sanctioning of boxing matches. Hoofnagle describes the FTC as an exercise in "creative syncretism," an agency given many flexible tools so it could adapt to problems Congress couldn't foresee. [1] That flexibility is its strength. For privacy it's also a weakness, because a regulator designed to be redirected can be redirected by whoever holds it.

There's an irony here. The core of the modern privacy problem is bigness, the thing the FTC was created to fight. Louis Brandeis called concentrated economic power the "curse of bigness," and Hoofnagle traces a line from that fight to today's calls for the FTC to police the power that comes from piling up personal data. [1] The agency's original job held a natural home for privacy.
Borrowed from advertising law
Section 5 gives the agency two tools. Under the FTC's 1983 Policy Statement on Deception, a practice is deceptive when a representation, omission or practice is likely to mislead a consumer acting reasonably and the point is material. Under the 1980 Policy Statement on Unfairness, which Congress wrote into the statute in 1994, a practice is unfair when it causes substantial injury that consumers can't reasonably avoid and that isn't outweighed by benefits to consumers or competition. [2] The gap between those two tests shaped the agency's entire privacy practice.

Hoofnagle's central legal claim is that this authority is broader than most people realize, and that the FTC could go further on privacy by drawing on its long record in advertising cases. [1] Congress chose vague language in 1914 and again in 1938 so the statute could grow. But the flexibility that let staff reach new privacy practices also meant the agency's privacy law grew out of false advertising cases, which don't map cleanly onto collecting and selling personal data. The authority was real but secondhand, and it had a fixed edge. Section 5 reaches commerce, which means companies and not the government.

Authority borrowed this way lasts only as long as the agency keeps choosing to use it, which makes it closer to a promise than a constraint.

Part II: Even at Full Strength

For this part, set 2025 aside and picture the FTC at its best, fully funded and bipartisan, with committed lawyers and commissioners who want aggressive privacy enforcement. Two of the three limits below are choices Congress made, not failures of the agency, so the claim needs to be sized carefully. I'm not saying no Congress could build an adequate privacy agency. I'm saying the one Congress did build couldn't be made adequate by better leadership, more money or more will.

What adequate would mean
A test that can't fail isn't worth much, so here is what adequate would mean. An agency equal to the data economy would need four things.

1. The power to set rules in advance, on a timetable that works.
2. A penalty for the first violation, not only the second.
3. The reach to stop a harmful practice whether or not the company promised anything about it.
4. Protection that outlasts a change in leadership, meaning precedent a court has ratified and orders a later commission can't quietly drop.

This part tests the first three, and Parts IV and V test the fourth. If the FTC had these powers, or could have used them as built, my argument fails. The agency did achieve a lot. It brought more than 150 privacy and security cases and shaped how an entire industry behaved. [3] The question is whether even its best met this bar.

I've left one gap out of the test on purpose. Section 5 can't reach the government, so grading the FTC on that would grade it on something it was never built to do. Part VI comes back to it.
No rules in advance
A regulator that can't set rules in advance can only punish conduct after it happens, one company at a time. For most privacy questions, that's the FTC's position. To issue a binding rule under Section 5, it has to follow Section 18 of the FTC Act, a process Congress created in the Magnuson-Moss Act of 1975 and made heavier in 1980, after the agency's attempt to restrict children's television advertising set off a backlash. [4] It adds an advance notice, informal hearings and a formal economic analysis to ordinary notice and comment, and these rules have taken almost six years on average, against under a year for ordinary rules. [5]

When Hoofnagle wrote in 2016, the agency "has not sought to promulgate rules for privacy." [1] It finally tried in August 2022, under Chair Lina Khan, with a rulemaking on commercial surveillance and data security that never got past the advance notice. [6] And the process can undo the rules the agency does finish. In July 2025 a federal appeals court threw out the FTC's click-to-cancel rule because the agency had skipped a required preliminary economic analysis. [7]

The exceptions matter. Where Congress handed the agency a specific privacy rule, it has one. The COPPA Rule protects children under 13, the Safeguards Rule covers data security at financial companies under the FTC's jurisdiction, and the Health Breach Notification Rule covers health apps. [8] But no general FTC rule tells companies what they may do with your data before they do it. Everywhere else there is only enforcement after the fact.
No penalty for a first violation
Under Section 5, the first time a company misuses your data, the FTC can't fine it. It can only order the company to stop. Money comes into it only if the company later breaks that order, breaks a trade regulation rule, or breaks a statute with its own penalties, such as COPPA. [2] That's why the famous privacy penalties, Google's $22.5 million in 2012 and Facebook's $5 billion in 2019, were both for breaking consent orders the companies had already agreed to. In effect the first violation is free. A penalty that comes only on the second offense, and is small next to a large company's revenue, gives that company little reason to be careful the first time.

Section 5 does offer one route to a first-violation fine, and the agency's habit of settling closed it. Under Section 5(m)(1)(B), the FTC can fine a company that knowingly engages in a practice the Commission has already found unlawful in an earlier case. But the earlier order has to come out of a contested case, because the statute excludes consent orders by name. [2] Since nearly every privacy case ended in a consent order, the privacy docket produced almost nothing this route could use.

Where Congress wrote a specific rule, the picture changes. The FTC can fine a first violation of the COPPA Rule. In 2023 GoodRx agreed to a $1.5 million penalty, the first under the Health Breach Notification Rule, for sharing users' prescription and health information with advertisers. [9] A 2024 law lets the FTC seek penalties against data brokers that sell Americans' sensitive data to China, Russia, Iran, North Korea or companies they control. [10] Congress has raised the ceiling for children, health records and national security, but not for privacy in general.

The one general workaround was then taken away. For decades the FTC used Section 13(b) of the Act to win restitution directly in federal court. In AMG Capital Management v. FTC (2021), a unanimous Supreme Court held that Section 13(b) authorizes no such relief, because Congress had never granted it. [11]
Deterrence without fines
Money isn't the only thing that deters a company. A twenty-year order brings audits and monitoring, and an FTC investigation can move a stock price. Solove and Hartzog argue that the settlement system disciplined companies in exactly these ways. [12] That's real, but every one of those pressures depends on the agency's continuing willingness to investigate, sue and monitor, and that can change the moment the agency changes hands. The one deterrent that depends on no one's continuing will, a price fixed in advance for the first offense, is exactly what the statute withholds.
Mostly against broken promises
Of Section 5's two tests, unfairness requires proof of substantial injury and a weighing of costs against benefits. Deception requires only a misleading statement that matters. Because the agency's economists treated privacy injury as unmeasurable without a market price, privacy enforcement came to rest mostly on deception, which means catching companies breaking their own promises. [3] A company that never promised you anything had nothing to break. Platforms learned to work that gap. They paid app developers in user data while truthfully enough denying that they "sold" it, which Hoofnagle showed was a sale by barter the deception model couldn't easily touch. [13] The incentive taught companies to manage what they said rather than what they collected.

Experts the agency itself invited had already shown that the promise model didn't work. In a 2006 paper for the FTC's Tech-ade hearings, Joseph Turow, Hoofnagle, Deirdre Mulligan and their colleagues showed that the FTC had adopted only part of the Fair Information Practices (notice, choice, access and security) and dropped the parts that carried the weight, limits on collection and use, purpose specification and accountability. The omission, they wrote, "led firms to collect extraneous information, and repurpose information without consumer consent." About 59 percent of people surveyed wrongly believed that a site with a "privacy policy" would not share their data, and only 1.4 percent said they read software license agreements thoroughly. [14]

Notice and choice also changed what privacy meant. Justice Harlan's test in Katz v. United States asks whether a person actually expected privacy and whether society is prepared to recognize that expectation as reasonable. [15] The second question sets the limit from outside any transaction. Notice and choice moved the question inside it. If the policy disclosed the practice and you clicked accept, the practice was legitimate. The Fourth Amendment drifted the same way in the third-party cases, which held that what you knowingly share with a phone company or a bank loses protection. [15] The agency built its enforcement on a theory of privacy that was already shifting from constraint to permission.

Still, the promise limit was a habit more than a wall. From 2022 to 2024 the agency brought unfairness cases against companies that collected and sold sensitive location data, among them X-Mode, Gravy Analytics, Mobilewalla and Kochava, built on the harm itself rather than on any broken promise. [16] The agency could reach past promises when its leadership chose to. The same discretion could just as easily stop.
Norms, the agency's real tool
The FTC never governed mainly by fines, and Hoofnagle insists on the point. Its power was in setting norms and forcing information into the open. Its Section 6(b) study power let it compel companies to hand over what they'd rather keep private, which produced a 2024 staff report on nine large social media and streaming platforms. [17] Through workshops, reports and guidance on how to handle your data, it set the terms companies believed they had to meet. This is the "creative syncretism" Hoofnagle admires, and he's right about it. [1]

But a norm is the most fragile tool an agency has. A consent order at least binds a company for twenty years and takes a formal proceeding to undo. Guidance binds no one, and it disappears when the agency stops saying it. In March 2025 the FTC took down more than three hundred blog posts from the prior administration, including business guidance on AI, consumer protection and privacy, with no public explanation. [18]

Rules, first-violation penalties and the reach to stop harmful practices would have been constraints. What the FTC had were promises, to bring the next case, keep the guidance up and hold the line, and none of them bound the next commission.

Part III: The Inner Struggle

Even the narrow, deception-based enforcement the FTC could manage had to get past its own economists. In "The Federal Trade Commission's Inner Privacy Struggle," Hoofnagle documented a dynamic most privacy advocates never saw, and in separate work he supplied the economics that explains why it mattered.

Economists who priced privacy at zero
Inside the FTC, lawyers in the Bureau of Consumer Protection choose and build cases, and economists from the Bureau of Economics evaluate them and recommend remedies. Hoofnagle showed that the economists consistently concluded that privacy violations cause no measurable harm, which pushed recommended penalties toward zero. [3]

Without a market price for privacy, the Bureau sees no basis for measuring injury. When Google was fined for tracking Safari users it had promised not to track, an economist could see even $22.5 million as too high, because no consumer had paid for the privacy feature Google got around, and "any price on the tracking would be speculative." Hoofnagle obtained the Bureau's training materials through a Freedom of Information Act request and found a reading list with "a distinctly laissez faire bent," led by a paper from an industry-funded think tank. [3] The economists were not corrupt. They were trained to find what they found.

The economists' view has serious defenders. James Cooper and Joshua Wright, who both held senior posts at the FTC, argued in the same Cambridge handbook that holds Hoofnagle's chapter that the agency's privacy work lacked the economic discipline that reshaped antitrust in the 1970s. They wanted privacy harms tied to consumer welfare and enforcement backed by evidence. [19] That's a fair demand, since an agency that sues without a clear theory of harm invites courts to strike it down. Where I part ways is over what counts as harm.

The statute doesn't require that privacy injury be reduced to a dollar figure. Section 5 asks about substantial injury, not out-of-pocket loss, and Hoofnagle argues that the cognizable-harm requirement critics press "does not exist anywhere in Title 15." [1] Losing control over information about you is an injury on its own terms. In 2024 a federal court agreed, at least at the start of a case, holding in the FTC's suit against the location data broker Kochava that "an invasion of privacy may constitute an injury that gives rise to liability under Section 5(a)." [20] Insisting that privacy harm doesn't count until it can be priced is a policy choice dressed up as arithmetic.
The economics the Bureau got backward
Hoofnagle and the economist Jan Whittington offered a stronger rebuttal. Applying transaction cost economics to "free" services, they found that a zero-price exchange is still a market transaction, and an unusually costly one. [21] As you pay a service with your data, you become dependent on it and can't leave without losing what you've built there. The exchange is continuous, like a long-term contract with a company that keeps changing its terms, and its costs are mostly hidden from you when you sign up. The market the Bureau says doesn't exist plainly does, and the Bureau has declined to price it.

The agency's own 2024 study, built on answers compelled from nine of the largest platforms, documented an industry built on collecting personal information and monetizing it at scale. [17] One part of the agency measured what another had called unmeasurable. No single person's data has a clean price, and I'm not claiming one. The narrower point is enough. Personal information was producing measurable revenue, and an economics that looked only for the consumer's out-of-pocket loss was looking in the wrong place.

The lock-in is also the moat. A zero price lets a platform grow fast and wall out competitors, which is why Hoofnagle and Whittington argue that "free" has to become part of how competition law understands platform power. [21]
The single point of failure
The agency's lawyers adapted. Unfairness invites the cost-benefit analysis the economists used to zero out harm, and deception doesn't, so they pleaded privacy cases as deception wherever a broken promise allowed it. "Deception cases receive much less economic attention," Hoofnagle noted. [3]

This worked because the FTC gives staff lawyers wide freedom to choose cases, and its investigative power is, in Hoofnagle's phrase, "akin to an inquisitorial body." [1] He saw that insulation, staff discretion plus commissioners protected from political pressure, as the agency's defense against shifting politics. It was also its single point of failure. Privacy enforcement happened as long as the lawyers controlled which cases got brought. Hoofnagle identified the load-bearing wall. He didn't say, and may not have expected, that someone could simply remove it. That control was a promise the structure made to its staff, and the structure could take it back.

Part IV: Settlements, Not Law

The consent order made sense given how little else the FTC had. But it was a poor foundation for anything lasting, and the courts started exposing its weaknesses well before any administration did.

Law no court had ratified
The consent orders did produce law. Solove and Hartzog showed, and Hoofnagle agrees, that they added up to a "new common law of privacy" that companies treated as binding. [12] Companies hired lawyers, built compliance programs and behaved as if the settlements were precedent. But after more than fifteen years of enforcement there was, in their words, "no meaningful body of judicial decisions to show for it," because nearly every case settled. [12] As Hoofnagle put it from the inside, the wrongness of a practice "is simply declared in a complaint and consent decree agreed to by the respondent." [3]

A common law no court has entered binds only by convention, and conventions can be dropped. Van Eijk, Hoofnagle and Kannekens note that "the contours of the FTC Act are unclear," because the agency rarely explains why a practice is unfair or deceptive. [22] That vagueness helped while the agency was expanding. Once leadership chose to pull back, there was no judicial precedent to overrule and nothing to stop the retreat.
What the courts did say
In the years after Solove and Hartzog wrote, the courts said two things, and they pointed in different directions. In FTC v. Wyndham Worldwide (2015), the Third Circuit upheld the agency's power to treat weak data security as unfair. In LabMD v. FTC (2018), the Eleventh Circuit threw out an FTC data security order because its command to keep a "reasonable" security program was too vague to enforce. [23] The courts confirmed the power and then limited what the agency could order with it.

LabMD traces back to Part II. With no data security rule written in advance, the agency had only the open language of unfairness to work with, and its order was open-ended too. The inability to make rules weakened the enforcement that was supposed to substitute for them. Then AMG took away the agency's main route to money. [11] The courts were wearing down the consent order model before any president touched it, and an order the agency issues is one the agency can reopen.
Too late to matter
Hoofnagle also saw a timing problem. "Remedies are unlikely to be effective by the time the FTC gets involved, investigates a case, and litigates it," he wrote, and the delay "gives respondents time to establish their platform and shut out competitors." [3] Facebook and Google both won you over with privacy promises, then relaxed them once you couldn't easily leave. By the time an order issued, it governed yesterday's practice. An enforcer that can act only years after the fact is not a constraint on a fast-moving industry. It is a historian of it.
The competition route The agency's founding power, tested in court.
The agency still had its older tool. The lock-in described in Part III is also a competition harm, and competition is the FTC's founding mission. But American antitrust asks, at bottom, whether a company can raise prices above the competitive level, and a zero-price product scrambles that question at the root. [21]

The FTC pressed the theory anyway. It sued to unwind Meta's purchases of Instagram and WhatsApp, and in November 2025 the court ruled for Meta. The agency had proposed a narrow market of personal social networking (Facebook, Instagram, Snapchat and the small network MeWe), and the court held it had to include TikTok and YouTube, which pushed Meta's share below monopoly levels. [24] With no price to measure, the court measured time and attention, and a market drawn that way can stretch to include anything else competing for your attention.

The FTC appealed in January 2026, arguing among other things that the court gave too much weight to recent changes in the market and that TikTok doesn't serve the friends-and-family sharing at the center of the case. The appeal is pending in the D.C. Circuit. [24] One district court loss isn't a structural verdict. The market may have been framed badly, the appeal may succeed, and the industry did change over the five years the case ran. But the ruling shows the doctrine at work. Even on the ground the agency was built for, its tools were made to see prices, and the platform economy doesn't charge you any.

Part V: The Test, 2025 to 2026

Hoofnagle's 2017 essay ended with a prediction. He expected the Bureau of Economics to gain influence under a Trump administration, pushing cases toward unfairness and blunting the lawyers' expansion of privacy norms. He was right about the direction. But his own prescription was to strengthen the agency and defend it against an "ideological movement intent on disassembling the administrative state" that he warned was "more radical than their sponsors understand." [1] What happened in 2025 and 2026 went well past the internal rebalancing he predicted.

What Hoofnagle predicted
His forecast was internal and procedural. The economists would gain influence over which cases got brought, unfairness would become the favored theory, and privacy cases would get harder to bring because the economists would demand proof of harm their methods were built not to find. Enforcement would shrink because the balance of power inside the agency changed, not because the law did. The prediction assumed the institution would stay intact and the contest would still be fought inside it, under its usual procedures.
What happened in 2025 This went beyond what Hoofnagle predicted.
In January 2025 Andrew Ferguson, no relation to the legal scholar Andrew Guthrie Ferguson, became chairman. A document Punchbowl News reported as his pitch for the job promised to drop "novel and legally dubious consumer protection cases." [25] Weeks earlier, in the location data cases against Gravy Analytics and Mobilewalla, he had written, "My colleagues want the FTC Act to be a comprehensive privacy law. But it is not." [26] He shares my premise and draws the opposite conclusion. In February he named Christopher Mufarrige to lead the Bureau of Consumer Protection. [25]

In March, President Trump fired the two Democratic commissioners, Alvaro Bedoya and Rebecca Kelly Slaughter. Both sued, and after Bedoya resigned in June, Slaughter carried the case to the Supreme Court. [27] That same March the agency took down more than three hundred blog posts from the prior administration. [18]

In December 2025 the FTC reopened and set aside its own consent order against Rytr, a company that sold an AI writing tool. The order had been issued under former Chair Lina Khan over Ferguson's dissent, and the Commission started the reopening itself. It cited the administration's AI Action Plan, which directed the agency to review "all FTC final orders, consent decrees, and injunctions" and set aside any "that unduly burden AI innovation." [28] The case was about AI, not privacy, but the mechanism matters. A final consent order can now be undone by a commission acting on a White House policy.
What happened in 2026
On June 29, 2026, the Supreme Court decided Trump v. Slaughter, 6 to 3. It held that the FTC Act's protection against removing commissioners violates the separation of powers and overruled Humphrey's Executor, the 1935 decision that had upheld it, as applied to the FTC. The President can now fire commissioners at will. The dissent warned that the law's bipartisan requirement "can easily be evaded simply by firing all Commissioners of the opposite party." [29]

That protection was the one real constraint shielding the FTC from political control. The Court had upheld it in 1935, and removing it took a public fight that ran fifteen months through three courts. Everything built on top of it came down faster. The guidance came down the same month as the firings, with no explanation, and the Rytr order went at the agency's own initiative. That's the difference between a constraint and a promise, playing out on the agency itself.

Since Commissioner Melissa Holyoak left in November 2025 to become interim U.S. Attorney for Utah, the commission has had two members, Ferguson and Mark Meador, with a third nominee waiting on the Senate. In mid-2026 they split 1-1 over a merger review, and the tie ended the review with no action. [30] Either commissioner can now stop any case.

In May 2026 X Corp. asked the FTC to end Twitter's 2022 privacy order early. If you gave Twitter your phone number to secure your account, that order, which came with a $150 million penalty, is what bars the company from using that number to target ads. It runs until 2042, and X wants it to end this year. Comments closed July 2, and the FTC had not decided as of this update. [31] This is a privacy order, the exact tool Part IV describes, and whether it survives depends on two commissioners the President can remove at will.

The case against the location data broker Kochava, filed in 2022, led to a proposed settlement in May 2026. It bars Kochava from selling sensitive location data without consent, includes no payment that I could find, and is narrower than the 2024 X-Mode order, according to one analysis. [32] The theory survived the change in leadership in a smaller form.

The current FTC hasn't stopped protecting privacy. It calls children's privacy a top priority, its updated children's privacy rule became enforceable in April 2026, and Disney agreed in 2025 to pay $10 million to settle charges that it mislabeled children's videos on YouTube. [33] In February 2026 it warned data brokers against selling Americans' data to foreign adversaries. [10] In August 2025 Ferguson warned tech companies that weakening encryption at the request of foreign governments may violate Section 5. [34] What changed is which parts of your privacy get protected, and whoever holds the agency now decides that.
Beyond the prediction
Hoofnagle predicted a shift inside the agency's structure. What happened was the removal of the structure's protections. Staff control of case selection and commissioners the President couldn't fire at will were what he saw as the FTC's shield. The events of 2025 overrode both, and Slaughter erased the second as a matter of law. The lawyers who brought more than 150 privacy and security cases, and won orders against Google, Facebook, Twitter and Microsoft, show what the people inside could do. [3] How quickly it all stopped shows what the structure couldn't protect.

Part VI: What Enough Looks Like

It's tempting to read all of this as one long staircase down. Hoofnagle's own history corrects that. The FTC's power has always moved in cycles. In the late 1970s the press called it a "National Nanny" after it tried to restrict children's advertising, and in 1980 Congress let its funding lapse in the middle of a fight over its powers. The agency closed for a day, and Congress then limited its rulemaking. [4] [35] It recovered to become what Hoofnagle calls the most important regulator of information privacy in the world. [1] This low point may pass too.

What the cycle doesn't change
What doesn't move with the cycle is the ceiling. At the top of the cycle and at the bottom, the agency couldn't fine a first violation, couldn't write a general privacy rule, built little precedent a court would enforce, and depended on discretion that could be redirected. The politics will swing back. The ceiling moves only by statute, and so far Congress has raised it only for children, health records and national security.
Hoofnagle's answer, supervision
Hoofnagle saw the ceiling himself, and his answer matters because it isn't the one I end on. He concedes that modern information problems may not be policeable by an enforcement agency at all, and he points instead to supervision, the continuous oversight bank examiners and the Consumer Financial Protection Bureau perform, with standing access, regular audits and the power to correct practices before they cause harm. [1] Supervision doesn't wait for a broken promise or need a first-violation penalty, and it sets expectations in advance. If the institutional path has a future, this is probably it, and it should be built.

But supervision still depends on who's in charge. Examiners report to a chair, and Congress can take back what it granted. Some institutions do outlast the people running them. Courts are bound by precedent, central banks are anchored by statute and markets (even Slaughter set the Federal Reserve apart), and civil servants have tenure protections. [29] The FTC's privacy work had none of those anchors. It was discretion all the way down, and a privacy regime built on someone's continuing will lasts only as long as that will does. Institutions matter. The question is which kinds of institutional power survive a change of hands.
Testing the benchmark
Apply the benchmark from Part II to real alternatives and it turns out it can be met, at least in part.

California comes closest. Its privacy agency, CalPrivacy, writes binding regulations, the latest of which took effect in January 2026, and it fines first violations. Honda paid $632,500, Tractor Supply $1.35 million and General Motors $12.75 million in a joint action with the attorney general, and data brokers have been fined just for failing to register. [36] Your rights there apply whatever a company promised, and one request through DROP, the state's deletion platform, now reaches every registered data broker. (I go through what DROP does and doesn't remove in a separate piece.) The law's durability has an anchor too. Because voters passed it as Proposition 24, the legislature can amend it only in ways that are "consistent with and further the purpose and intent" of the act. [37] What it lacks is much court-tested precedent, and like any state law it's exposed to federal preemption.

Texas has shown what first-violation money looks like under state law, with a $1.375 billion settlement from Google in 2025 over location tracking, private browsing and biometric data. [38]

The federal bill in Congress cuts both ways. The SECURE Data Act, introduced in the House in April 2026, would give you rights to access, correct and delete your data and to opt out of targeted advertising and data sales, and it would treat violations as violations of an FTC rule, which would allow penalties for a first violation. But it also gives companies a mandatory 45-day period to cure a violation before anyone can enforce, which gives back much of that, and it preempts state law so broadly that Representative Frank Pallone said at the June hearing it would reach California's broker deletion law. [39] If you live in California, it could leave you with less than you have now.
The half the agency never faced
Every option above shares one more gap. None of them reaches the government, which has become one of the largest buyers of the data your devices produce. The state doesn't need to break into your phone when it can buy your location history from a broker. Carpenter v. United States requires a warrant for location records compelled from a phone carrier and says nothing about records bought on the open market. Some federal laws limit government access, such as the Stored Communications Act and the Privacy Act, but none of them stops an agency from buying from a broker, and the bills that would, the Fourth Amendment Is Not For Sale Act and the Government Surveillance Reform Act, haven't passed. [40] I cover this in my piece on the government buying data it cannot legally collect. On the commercial side the FTC was never enough. On the government side it was never present.

Part VII: Promises and Constraints

If every institutional answer depends on who holds office, the remaining question is whether anything protects you that doesn't. There's one candidate, and it's the distinction I started with.

A constraint built into the product
A privacy policy is a promise the company can revoke. A zero-knowledge design, where the company never holds the keys to your data, is a constraint it can't simply revoke. A provider that holds no keys can't be compelled to hand over what it can't read, can't be breached into data it never had, can't sell what it never collected, and can't quietly loosen a setting to expose you, the way Facebook changed users' privacy settings in December 2009 without their approval, the change that led to its first FTC order. [41] Against a sale and against a subpoena, the protection that lasts no matter who's in office is the one written into the design. (The mechanics are in how encryption actually works.)
Who carries the burden
There's an obvious objection. Part II argued that notice and choice failed because individuals can't protect themselves. It would be inconsistent to then tell you to go install the right apps. That puts the burden back on the individual and sorts protection by sophistication and income, giving the most privacy to the people who need help least. Turow and Hoofnagle's survey work found that public passivity about privacy is a knowledge problem, not apathy. [14] People care. The system is built so that caring isn't enough.

So the argument has to be made one level up. The goal is for the constraint to be how products are built, rather than an upgrade that sophisticated users go looking for. It should be the default that ships in the box, the floor a procurement contract or a future privacy law requires, and the standard a regulator would set if it could still set rules.
What airbags teach
Airbags are the closest comparison I know, and they cut against the easy version of this argument. An airbag protects you whether or not you understand it, and no settings update can switch it off. But airbags didn't become standard because drivers demanded them or carmakers volunteered them. Federal regulators pushed for passive restraints through years of industry resistance, and Congress finally required airbags in every new passenger car built after August 1997. [42] Web encryption spread through standards bodies and, after 2013, because large platforms found it useful. So far, constraint at scale has arrived through mandates or corporate self-interest, the same forces I've spent this whole piece distrusting. Architecture doesn't escape politics when it's adopted. What it changes is how protection lasts once it's built, and what it costs to remove.
The limits of the answer
I've used Hoofnagle as someone who defended the FTC while documenting what held it back. I'm doing the same with encryption, so its limits come first, and the claim I make is whatever survives them.

The first limit is that architecture is itself regulated. The Clipper chip of the 1990s was a key-escrow mandate built into hardware, and its logic returns in lawful-access proposals and client-side scanning, which would inspect content on your device before encryption applies. In January 2025 the United Kingdom served Apple a secret order demanding access to end-to-end encrypted iCloud data, and Apple withdrew its Advanced Data Protection feature from British users rather than comply. In 2026 Britain served a new notice limited to UK users, Apple challenged it in August, and in September a tribunal heard whether the government can keep such orders secret at all. [43]

That secrecy fight is the real test of my claim. Apple held no key it could hand over quietly, so the state had to order it to change what it builds. The order surfaced in press reports, and Apple answered in public by pulling the feature, which turned it into a dispute between two governments. The UK's effort to keep such orders secret shows how much the state prefers to act quietly. A promise can be broken in a settings update no one reads. A constraint can be overridden only by forcing a visible change, a feature pulled or a product rebuilt, where it can be seen and contested.

The second limit is scope. End-to-end encryption protects what you say, not necessarily the metadata around it, and most services keep a great deal of metadata. Encryption does nothing once the device itself is seized or hacked. And it runs into compulsion. Courts are divided on whether the Fifth Amendment lets the state force you to decrypt a device, a federal court used the All Writs Act in 2016 to order Apple to help unlock an iPhone, and border agents can search devices on little or no suspicion. [44]

So here is the claim, stated precisely. Architecture doesn't put protection beyond politics, and nothing does. What it changes is the default and the cost of reversal. A guidance page dies by deletion, a consent order by a commission vote, an enforcement priority by an election, each of them quiet, cheap and fast. A deployed constraint dies only by an act that leaves a visible mark, a law passed, an order that forces a product change, an update pushed to every device. It changes what the state must do to reach you, and how visibly it has to do it.

Conclusion

The FTC was never enough because of how Congress built it, not because of who ran it. Even at its peak it couldn't write a general privacy rule or fine a first violation, it reached past promises only when its leaders chose to, and its protections could be dropped by a later commission. It was never built to reach the government at all. In 2025 and 2026 those limits stopped being theoretical. Commissioners can now be fired at will, the agency is down to two members, and a privacy order meant to last until 2042 is up for early termination.

What lasts
None of this argues against institutions. Supervision is worth building, California shows the benchmark can be met in part, and a federal law could raise the ceiling if it doesn't trade away stronger state protections to do it. But every institutional answer shares the FTC's basic weakness. It lasts only as long as the people holding it choose to keep it.

The protection that survives a change of administration is not the one beyond the state's reach, because nothing is. It's the one the state must act in public to remove, provided we insist it be built in for everyone and stay honest about what it covers. The math doesn't change with the administration. But the math was never the whole of it, and saying so is what makes the case worth trusting.

References

  1. [1] Chris Jay Hoofnagle, Federal Trade Commission Privacy Law and Policy (Cambridge Univ. Press 2016), cambridge.org (see esp. chs. 1, 4, 5 and 12; the book's description calls the FTC the most important regulator of information privacy in the world).
  2. [2] 15 U.S.C. § 45, law.cornell.edu (including § 45(m)(1)(B), which allows penalties against anyone who knowingly engages in a practice the Commission has found unlawful in a final order "other than a consent order"); FTC Policy Statement on Deception (1983); FTC Policy Statement on Unfairness (1980), codified at 15 U.S.C. § 45(n).
  3. [3] Chris Jay Hoofnagle, The Federal Trade Commission's Inner Privacy Struggle, in The Cambridge Handbook of Consumer Privacy (Evan Selinger, Jules Polonetsky & Omer Tene eds., 2018), ssrn.com (working paper posted 2017).
  4. [4] Magnuson-Moss Warranty-Federal Trade Commission Improvement Act, Pub. L. No. 93-637, 88 Stat. 2183 (1975); Federal Trade Commission Improvements Act of 1980, Pub. L. No. 96-252, 94 Stat. 374, govinfo.gov; Duane C. Pozza, As the FTC Re-Examines Its Approach to Consumer Privacy, It Faces Echoes of Past Failed Rulemaking, Wiley Connect (Apr. 9, 2019), wileyconnect.com.
  5. [5] Jeffrey S. Lubbers, It's Time to Remove the "Mossified" Procedures for FTC Rulemaking, 83 Geo. Wash. L. Rev. 1979 (2015), gwlr.org (Magnuson-Moss rules took almost six years on average).
  6. [6] Trade Regulation Rule on Commercial Surveillance and Data Security, 87 Fed. Reg. 51273 (Aug. 22, 2022) (advance notice of proposed rulemaking), regulations.gov.
  7. [7] Custom Commc'ns, Inc. v. FTC, No. 24-3137, 2025 WL 1873489 (8th Cir. July 8, 2025) (per curiam) (vacating the amended Negative Option Rule).
  8. [8] Children's Online Privacy Protection Rule, 16 C.F.R. pt. 312; Standards for Safeguarding Customer Information, 16 C.F.R. pt. 314; Health Breach Notification Rule, 16 C.F.R. pt. 318.
  9. [9] Covington & Burling, FTC Announces First Enforcement Action Under Health Breach Notification Rule, Inside Privacy (Feb. 2, 2023), insideprivacy.com.
  10. [10] Protecting Americans' Data from Foreign Adversaries Act of 2024, Pub. L. No. 118-50, div. I, ftc.gov; Wiley Rein, FTC Sends Warning Letters to Data Brokers on PADFA Compliance (Feb. 2026), wiley.law.
  11. [11] AMG Cap. Mgmt., LLC v. FTC, 593 U.S. 67 (2021).
  12. [12] Daniel J. Solove & Woodrow Hartzog, The FTC and the New Common Law of Privacy, 114 Colum. L. Rev. 583 (2014), columbialawreview.org.
  13. [13] Chris Jay Hoofnagle, Facebook and Google Are the New Data Brokers, Cornell Digital Life Initiative (Dec. 18, 2018), dli.tech.cornell.edu.
  14. [14] Joseph Turow, Chris Jay Hoofnagle, Deirdre K. Mulligan, Nathaniel Good & Jens Grossklags, The Federal Trade Commission and Consumer Privacy in the Coming Decade, 3 I/S: J.L. & Pol'y for Info. Soc'y 723 (2007), lawcat.berkeley.edu (first presented at the FTC's Tech-ade hearings, Nov. 2006).
  15. [15] Katz v. United States, 389 U.S. 347, 361 (1967) (Harlan, J., concurring) (an "actual (subjective) expectation of privacy" that society is "prepared to recognize as 'reasonable'"); United States v. Miller, 425 U.S. 435 (1976); Smith v. Maryland, 442 U.S. 735 (1979).
  16. [16] Press Release, Fed. Trade Comm'n, FTC Order Prohibits Data Broker X-Mode Social and Outlogic from Selling Sensitive Location Data (Jan. 9, 2024), ftc.gov; Mobilewalla, Inc.; Analysis of Proposed Consent Order to Aid Public Comment, Fed. Reg. (Dec. 6, 2024), federalregister.gov; FTC v. Kochava, Inc., No. 2:22-cv-00377 (D. Idaho) (filed Aug. 2022).
  17. [17] Fed. Trade Comm'n, A Look Behind the Screens: Examining the Data Practices of Social Media and Video Streaming Services (Staff Report, Sept. 19, 2024), ftc.gov.
  18. [18] FTC Removes Posts Critical of Big Tech from Its Website, TechCrunch (Mar. 18, 2025), techcrunch.com; Goodwin, Trump 2.0 Tech Policy Rundown: 100 Days In (May 2025), goodwinlaw.com.
  19. [19] James C. Cooper & Joshua D. Wright, The Missing Role of Economics in FTC Privacy Policy, in The Cambridge Handbook of Consumer Privacy (Evan Selinger, Jules Polonetsky & Omer Tene eds., 2018), law.gmu.edu.
  20. [20] FTC v. Kochava, Inc., No. 2:22-cv-00377 (D. Idaho Feb. 3, 2024) (order denying motion to dismiss the amended complaint) ("an invasion of privacy may constitute an injury that gives rise to liability under Section 5(a)").
  21. [21] Chris Jay Hoofnagle & Jan Whittington, Free: Accounting for the Costs of the Internet's Most Popular Price, 61 UCLA L. Rev. 606 (2014); Jan Whittington & Chris Jay Hoofnagle, Unpacking Privacy's Price, 90 N.C. L. Rev. 1327 (2012).
  22. [22] Nico van Eijk, Chris Jay Hoofnagle & E. Kannekens, Unfair Commercial Practices: A Complementary Approach to Privacy Protection, Eur. Data Prot. L. Rev., no. 3, 2017.
  23. [23] FTC v. Wyndham Worldwide Corp., 799 F.3d 236 (3d Cir. 2015); LabMD, Inc. v. FTC, 894 F.3d 1221 (11th Cir. 2018).
  24. [24] FTC v. Meta Platforms, Inc., No. 1:20-cv-03590 (D.D.C. Nov. 18, 2025); Press Release, Fed. Trade Comm'n, FTC Appeals Ruling in Meta Monopolization Case (Jan. 2026), ftc.gov; FTC Asks D.C. Circuit Appeals Court to Revive Its Monopoly Case Against Meta over Instagram and WhatsApp Acquisitions, Shopifreaks (May 27, 2026), shopifreaks.com.
  25. [25] Bryan Cave Leighton Paisner, Trump Controlling the FTC? Picks for FTC Chair and FTC Commissioner Signal Significant Changes (Dec. 16, 2024), bclplaw.com; Press Release, Fed. Trade Comm'n, FTC Chairman Ferguson Appoints Christopher Mufarrige as Director of the Bureau of Consumer Protection (Feb. 2025), ftc.gov.
  26. [26] Statement of Commissioner Andrew N. Ferguson, Gravy Analytics, Inc. and Mobilewalla, Inc. (Dec. 3, 2024), ftc.gov.
  27. [27] Trump Admin's Removal of FTC Commissioners Could Shift Privacy Efforts, The Record (Mar. 2025), therecord.media; Bedoya Resigns From FTC, Seeks to Remain in Lawsuit, Broadband Breakfast (June 2025), broadbandbreakfast.com.
  28. [28] Press Release, Fed. Trade Comm'n, FTC Reopens and Sets Aside Rytr Final Order in Response to the Trump Administration's AI Action Plan (Dec. 22, 2025), ftc.gov; Covington & Burling, FTC Sets Aside Rytr Final Order Pursuant to White House AI Action Plan, Inside Privacy, insideprivacy.com; Holland & Knight, A Look at the FTC's Current Approach to AI Regulation (Aug. 19, 2026), hklaw.com.
  29. [29] Trump v. Slaughter, No. 25-332 (U.S. June 29, 2026), oyez.org (overruling Humphrey's Executor v. United States, 295 U.S. 602 (1935), as applied to the FTC); Venable, Supreme Court Overrules Humphrey's Executor and Permits At-Will Removal of FTC Commissioners (June 30, 2026), venable.com (noting that the Court left the Federal Reserve's protection open); Debevoise & Plimpton, Supreme Court Clarifies Presidential Removal Authority: What Trump v. Slaughter Means for the FTC (July 2026), debevoise.com.
  30. [30] Commissioner Holyoak Leaves FTC to Serve as Interim U.S. Attorney in Utah, Nat'l L. Rev. (Nov. 2025), natlawreview.com; Mayer Brown, The FTC's Two-Commissioner Deadlock's Impact on Antitrust Policy (Sept. 2026), mayerbrown.com.
  31. [31] Press Release, Fed. Trade Comm'n, FTC Seeks Comment on X Corp. Petition to Set Aside or Modify FTC Order Concerning Twitter (June 3, 2026), ftc.gov; Elec. Frontier Found., EFF and Allies: X's FTC Petition to Waive Privacy Violation Order Should Be Rejected (June 2026), eff.org.
  32. [32] Willkie Farr & Gallagher, FTC Prohibits Kochava and Subsidiary from Collecting and Selling Consumers' Geolocation Data (May 11, 2026), complianceconcourse.willkie.com; FTC's Kochava Settlement Advances Data Privacy Enforcement but Leaves Critical Gaps in Protecting Consumers, Yale J. on Reg.: Notice & Comment (July 14, 2026), yalejreg.com.
  33. [33] Loeb & Loeb, Children's Online Privacy in 2026: Congress Stalls (Again), FTC Signals Priorities (June 2026), loeb.com; Disney Agrees to $10 Million FTC Settlement over Kids' Privacy on YouTube, Data Privacy + Cybersecurity Insider (Sept. 2025), dataprivacyandsecurityinsider.com.
  34. [34] Skadden, FTC Chair Warns Tech Firms: Weakening Encryption or Censoring Americans for Foreign Governments May Violate US Law (Sept. 2025), skadden.com.
  35. [35] That Time One Agency Shut Down for One Day and Changed Government Forever, Nextgov (Oct. 2025), nextgov.com.
  36. [36] Sheppard Mullin, California Privacy Regulations on ADMT, Cybersecurity Audits, and Risk Assessments Receive Final Approval (Sept. 2025), sheppard.com; CalPrivacy, CalPrivacy Announces Second Data Broker Enforcement Action in Less Than a Week (Aug. 13, 2026), privacy.ca.gov (listing earlier actions against Honda, Tractor Supply and General Motors).
  37. [37] California Privacy Rights Act of 2020, Prop. 24; Californians for Consumer Privacy, Yes, Prop 24 Can Be Amended to Further Enhance Privacy, caprivacy.org (the measure's sponsor).
  38. [38] Hunton Andrews Kurth, Texas AG Announces $1.375 Billion Settlement with Google for Privacy Violations (May 12, 2025), hunton.com.
  39. [39] SECURE Data Act, H.R. 8413, 119th Cong. (2026); Epstein Becker Green, One Nation, One Privacy Law: GOP Introduces Federal Privacy Legislation (May 12, 2026), ebglaw.com; Troutman Pepper Locke, Federal Privacy Bills Introduced: GUARD Financial Data Act and SECURE Data Act (2026), troutman.com; House Subcommittee on Commerce, Manufacturing and Trade Hosts Hearing on SECURE Data Act, Tech Policy Press (June 2026), techpolicy.press (transcript of the June 3, 2026 hearing).
  40. [40] Carpenter v. United States, 585 U.S. 296 (2018); NPR, Your Data Is Everywhere. The Government Is Buying It Without a Warrant (Mar. 25, 2026); Press Release, Sen. Mike Lee, Lee Introduces Bipartisan Government Surveillance Reform Act (Mar. 2026), lee.senate.gov; Stored Communications Act, 18 U.S.C. §§ 2701-2713; Privacy Act of 1974, 5 U.S.C. § 552a.
  41. [41] Press Release, Fed. Trade Comm'n, Facebook Settles FTC Charges That It Deceived Consumers by Failing to Keep Privacy Promises (Nov. 29, 2011), ftc.gov.
  42. [42] Intermodal Surface Transportation Efficiency Act of 1991, Pub. L. No. 102-240, § 2508, 105 Stat. 1914 (codified at 49 U.S.C. § 30127), law.cornell.edu; Motor Vehicle Mfrs. Ass'n v. State Farm Mut. Auto. Ins. Co., 463 U.S. 29 (1983) (setting aside the rescission of the passive restraint standard).
  43. [43] Elec. Frontier Found., The UK Is Still Trying to Backdoor Encryption for Apple Users (Oct. 2025), eff.org; Apple Battles It Out Again with the UK over Encrypted iCloud Access, Malwarebytes (Aug. 4, 2026), malwarebytes.com; Apple Challenges UK Secrecy over iCloud Encryption Order, iClarified (Sept. 18, 2026), iclarified.com.
  44. [44] Compare In re Grand Jury Subpoena Duces Tecum Dated Mar. 25, 2011, 670 F.3d 1335 (11th Cir. 2012) (compelled decryption was testimonial and barred), with Commonwealth v. Gelfgatt, 11 N.E.3d 605 (Mass. 2014) (compelled decryption allowed under the foregone conclusion doctrine); In re Search of an Apple iPhone Seized During the Execution of a Search Warrant on a Black Lexus IS300, No. ED 15-0451M (C.D. Cal. Feb. 16, 2016) (order compelling Apple's assistance under the All Writs Act); United States v. Cotterman, 709 F.3d 952 (9th Cir. 2013) (en banc) (a forensic examination of a device at the border requires reasonable suspicion; a manual search requires none).

Updated October 2026. This revision brings the piece up to date through the Supreme Court's decision in Trump v. Slaughter, the two-member commission, X's petition to end Twitter's privacy order and the Kochava settlement. It takes on the strongest counterevidence (Wyndham, the location data cases, the penalty-offense route and the privacy rules Congress did authorize), tests the benchmark against California and the SECURE Data Act, corrects several facts and rebuilds the references. The thesis is the same, stated more narrowly where the evidence required it.

Disclaimer: This analysis is for educational and informational purposes only. It is not legal advice. The author is not a licensed attorney. Professor Hoofnagle's work is cited from published versions, SSRN preprints, and his 2016 book; statutory and case citations are to public sources. FTC enforcement developments, the Meta and Slaughter decisions, the SECURE Data Act, and the Apple matter reflect publicly available court opinions, press releases, law-firm analyses, and news reporting through October 2026 and may have developed further. The characterization of Professor Hoofnagle's arguments, in particular the reading of his work as a defense of the agency that nonetheless documents its structural limits, is the author's interpretation. Readers are encouraged to consult the original sources for the full context of his analysis.
Technical Brief

Encryption wouldn't have saved the FBI director's Gmail

In March 2026, an Iranian state-linked group published more than 300 emails and photos from FBI Director Kash Patel's personal Gmail. Nothing was decrypted. Someone most likely signed in with an old password, and what they found was more than a decade of mail nobody had cleared out. Most people share those two weaknesses, and encryption fixes neither.

D David
March 2026
Updated October 2026
~7 min read
On March 27, 2026, a group calling itself Handala Hack Team published more than 300 emails and photos from the personal Gmail account of FBI Director Kash Patel, along with a resume and other documents. [1] The Justice Department says the group is run by Iran's Ministry of Intelligence and Security. [2] The FBI said the material was "historical in nature and involves no government information." [3]

Most privacy advice, including much of what I publish here, is about encryption. It asks who can read your messages and who can be forced to hand them over. This breach shows where that advice stops. Nothing was decrypted. Someone most likely signed in.

Two ordinary things decided how bad it was. The first was the lock, a password that had likely leaked years earlier with nothing behind it to stop a stranger from using it. The second was what sat behind the lock, more than a decade of personal email. Encryption addresses neither, and both are fixable in an afternoon.
What Happened How They Likely Got In What Encryption Does and Doesn't Do What Would Have Helped The Takeaway

What Happened

The leak
Most of the emails date from 2010 to 2012, and the newest item is a 2022 plane-ticket receipt. [1] The cache held personal photos, travel and business correspondence, and emails Patel sent from his Justice Department account to his Gmail in 2014. TechCrunch confirmed several of the messages by checking their cryptographic signatures. [4] None of it was classified. What made it damaging was volume and age, a decade of one person's life sitting in one place.
Who did it, and why then
Handala presents itself as a pro-Palestinian hacktivist group. On March 19 the Justice Department seized four of its domains and alleged that two of them were controlled by Iran's intelligence ministry. [2] The seizure followed Handala's attack on the medical technology company Stryker earlier that month, which wiped nearly 80,000 devices, and Handala called the Patel leak a response to the seizure. [5]

The timing was strategic. The leak came a month into the U.S.-Israeli strikes on Iran that began February 28, but file metadata suggests the account was breached before the war started. [1] [6] "Looks like something they had sitting around," Alex Orleans of Sublime Security told NBC News. [1] The same day the FBI confirmed the breach, the State Department reissued a $10 million reward for information on Handala, and that weekend federal agents took down the sites hosting Patel's emails. [7] Within days, Iran-linked hackers published emails belonging to Tamir Pardo, a former head of Israel's Mossad. [8]
An earlier warning
This wasn't Patel's first run-in with Iranian hackers. In late 2024, before he took over the FBI, he was told he had been targeted, and the hackers were believed to have accessed at least some of his communications. [9] Reporting hasn't said whether that warning involved this account.

How They Likely Got In

No one has confirmed the method. The evidence points to one of two routes, and the same defense would have stopped both.

An old password
Reuters found that the Gmail address Handala claimed matches an address linked to Patel in earlier data breaches preserved by the dark web intelligence firm District 4 Labs. [10] That's the setup for credential stuffing. Attackers take email and password pairs from old breaches and try them on other accounts. It works when a password was reused or never changed and nothing else stands in the way. Analysts at the Foundation for Defense of Democracies concluded that Handala likely used credentials from old, unrelated breaches. [6]
Or a convincing login page
The other route is phishing, a fake sign-in page that captures your password, and sometimes your one-time code, as you type them. Iranian state hackers use it regularly. In 2024 the Justice Department charged three members of Iran's Revolutionary Guard with using spoofed login pages to break into personal accounts tied to a presidential campaign. [11] It's also how John Podesta's Gmail was taken in 2016, through a fake Google security alert that his campaign's own help desk called legitimate. [12]

Either way, a security key would have stopped it. A stolen password is useless without the key, and the key won't sign in to a site that isn't the real one.

What Encryption Does and Doesn't Do

Gmail's encryption worked as designed
Gmail encrypts mail in transit and on Google's servers, but Google holds the keys. That protects your mail from someone snooping on a network or stealing a hard drive. It does nothing against someone who signs in as you, and it doesn't stop Google from handing your mail over under a warrant. (I explain the difference in how encryption actually works.)
End-to-end encryption wouldn't have changed this
With an end-to-end encrypted provider like Proton Mail or Tuta, the company can't read your mailbox, so a warrant or a breach of its servers can't expose your messages. That matters, and I compare the two providers in detail. But anyone who signs in as you sees what you see. Moving Patel to an encrypted provider would have protected his mail from the provider and from a warrant. It wouldn't have kept out someone holding his password.

What Would Have Helped

These are in the order they would have mattered most here.

A security key or passkey The most effective protection against account takeover.
A hardware security key, or a passkey stored on your phone or in your password manager, is the one defense that blocks both routes in. After Google required physical keys for its employees in early 2017, none of its more than 85,000 employees had a work account phished, according to the company. [13] For people at higher risk, Google's Advanced Protection Program requires a passkey or security key to sign in and limits which outside apps can reach your account. [14] A key won't stop malware that steals a session from a computer you're already signed in on, which is one more reason to keep less in the account.
A password that has never leaked
Check every address you use at Have I Been Pwned. If an address shows up in a breach, treat any password you used with it as public and replace it. A password manager makes it practical to give every account a long, random password you never reuse, so one breach can't unlock the next account.
Less in the account
The password decided who got in. The archive decided how much they took. Patel's account held years of travel and business email, most of it more than a decade old. Delete what you don't need, and move records you have to keep to encrypted storage you control. Every old message left in a consumer inbox is readable by anyone who signs in, by the provider under a warrant, and by whoever breaches the account next.
Work kept out of personal email
The 2014 emails from Patel's Justice Department account to his Gmail show how a personal breach can spill into work. Even when nothing sensitive is attached, those messages reveal official addresses and habits an attacker can use. Keep work and personal accounts separate, and don't forward work mail to a personal inbox.
If you're ever told you've been hacked
Changing the password isn't enough. Sign out every other session, then check the account's forwarding rules, filters, connected apps, app passwords and recovery email and phone, since attackers often leave one of these behind to get back in. Add a security key. Then look at what's stored and decide what should still be there. Google's Security Checkup covers most of the account settings in one place.

The Takeaway

What it comes down to
Nothing about this breach was exotic. A password that had likely leaked years earlier, nothing behind it to stop a stranger, and a decade of email waiting on the other side. Encryption is still worth having for what it protects. But the defenses that would have kept Iran's intelligence service out of the FBI director's inbox cost very little, and the cleanup costs nothing.

The hard part was never the technology. It's that almost no one sits down with their own accounts, finds which passwords have already leaked and what's sitting in the archive, and fixes it in order. The director of the FBI apparently didn't, and most people reading this haven't either.

References

  1. [1] Kevin Collier, Iranian Hackers Publish Emails Allegedly Stolen from Kash Patel, NBC News (Mar. 27, 2026), nbcnews.com (more than 300 emails and photos, mostly from 2010 to 2012, the newest a 2022 plane-ticket receipt; file metadata indicating the account was breached before the war began).
  2. [2] U.S. Dep't of Justice, Justice Department Disrupts Iranian Cyber-Enabled Psychological Operations (Mar. 19, 2026), justice.gov (seizing four domains and alleging that two Handala domains were controlled by the Ministry of Intelligence and Security).
  3. [3] Eric Tucker, Pro-Iranian Group Claims Credit for Hacking into FBI Director Patel's Personal Account, Associated Press (Mar. 27, 2026), pbs.org (as republished).
  4. [4] Lorenzo Franceschi-Bicchierai & Zack Whittaker, Iranian Hackers Claim Breach of FBI Director Kash Patel's Personal Email Account, TechCrunch (Mar. 27, 2026), techcrunch.com.
  5. [5] Ionut Ilascu, FBI Confirms Hack of Director Patel's Personal Email Inbox, BleepingComputer (Mar. 29, 2026), bleepingcomputer.com (the Stryker attack wiped nearly 80,000 devices; Handala called the leak a response to the domain seizures).
  6. [6] Ari Ben Am & Ethan Sheinker, 6 Things to Know About Handala: Tehran's Hackers Making Front Page News, Found. for Def. of Democracies (Apr. 1, 2026), fdd.org (U.S.-Israeli strikes on Iran began Feb. 28, 2026; the group likely used credentials from old, unrelated breaches).
  7. [7] Jonathan Greig, State Department Reissues $10 Million Reward for Info on Iranian Hackers, The Record (Mar. 30, 2026), therecord.media (the reward named Handala; sites hosting the Patel material were taken down that weekend).
  8. [8] Business and Letter to CIA Chief: Iran Leaks Ex-Mossad Head's Emails, Haaretz (Mar. 30, 2026), haaretz.com.
  9. [9] Kash Patel, Trump's Pick to Lead FBI, Has Been Targeted in an Iranian Hack, CNN (Dec. 3, 2024), cnn.com (hackers "are believed to have accessed at least some of Patel's communications"; the report does not name the account).
  10. [10] Iran-Linked Hackers Breach FBI Director Kash Patel's Personal Email, Publish Excerpts Online, Reuters (Mar. 27, 2026), cnbc.com (as republished).
  11. [11] U.S. Dep't of Justice, Three IRGC Cyber Actors Indicted for 'Hack-and-Leak' Operation Designed to Influence the 2024 U.S. Presidential Election (Sept. 27, 2024), justice.gov (spearphishing and spoofed login pages used to harvest credentials).
  12. [12] Tami Abdollah & Michael Biesecker, Emails Show How Clinton Campaign Chairman Was Apparently Hacked, Associated Press (Oct. 28, 2016), boston.com (as republished).
  13. [13] Brian Krebs, Google: Security Keys Neutralized Employee Phishing, Krebs on Security (July 23, 2018), krebsonsecurity.com.
  14. [14] Google, Advanced Protection Program, landing.google.com (sign-in requires a passkey or security key; only Google apps and verified third-party apps can access account data).

Updated October 2026. This revision reframes the piece around what failed and what would have helped, adds the Justice Department's domain seizure, the State Department reward and the context of the U.S.-Israeli strikes on Iran, corrects the description of the Podesta breach and the dates of the leaked emails, drops a claim about the 2024 warning that reporting doesn't support, and rebuilds the references.

Disclaimer: This analysis is for educational and informational purposes only. It is not legal advice. The author is not a licensed attorney. It relies on published reporting, court filings and government statements about the breach, cited accordingly. How the account was accessed has not been officially confirmed, and the discussion of likely methods is the author's assessment. No leaked material was accessed or reviewed for this piece beyond what news organizations described.
Services

Personal Privacy Consulting

Most privacy firms help companies with compliance. I work for people. I find out what anyone can learn about you and fix it with you, starting with the listings that show up when someone searches your name and working inward to your accounts and devices. Every price is fixed and in writing before any work starts.

Who I work with
Professionals in sensitive or regulated fields, and people whose work puts them in public view. People dealing with stalking, harassment, or a custody dispute. Anyone who has watched the data economy grow and wants less of themselves in it. You don't need a special reason. Wanting your privacy is enough.
What I don't do
I don't investigate other people. If you need to know who is behind harassment, or you need evidence for court, that's work for a licensed private investigator or your attorney, and I can point you to one. I also don't give legal advice or prepare legal documents.

Business privacy work, like running a privacy program or HIPAA and CCPA compliance, isn't something I offer yet. It's on my roadmap once I earn the CIPM certification, and until then I refer it out.
My background. I studied Legal Studies and Public Policy at UC Berkeley, and I'm working toward the CIPP/US certification from the International Association of Privacy Professionals. I'm not an attorney, and nothing on this site is legal advice. My work is privacy research, threat modeling, jurisdiction analysis, and hands-on setup. Every engagement ends with something in writing, in plain language unless you'd rather have the technical version. Orion Private LLC carries errors and omissions and cyber liability insurance.
Services and pricing

Prices are for one person. Each additional adult in your household adds 40%, since so much of the work overlaps.

How it works
01
Encrypted intake form (free) or email
Fill out the form on the contact page or send me an email. There's no commitment. I reply within 36 hours with my take on whether I'm the right fit for what you need.
02
Paid consultation ($60, 30 min)
We go deeper into what you need, where you're exposed, and what your threat model looks like. The $60 counts toward any service that follows.
03
Scoping & proposal
I send a written scope that spells out what I'll do, what you'll get, and the fixed price. If it includes something you've already paid for in the last 60 days, like an audit, that comes off. Nothing starts until you agree to it.
04
Execution
This is the research, setup, migration, and hardening. Hands-on work happens in person when possible, or over screen share, so you stay in control. Along the way I show you how to maintain what we build, explain the reasoning behind each recommendation, and answer questions as they come up.
05
Handoff & training
I hand over written documentation, walk through it with you, and train you on the security habits that keep it all working. Support lasts for the window listed on your service. After that, Monitoring keeps things current, or I can help as needed for $60 per half hour.
Common questions
Free, no commitment. I respond within 36 hours.
About

About Orion Private LLC

O
Orion Private LLC
Founded by David
privacy@orionprivate.com
Legal Studies (UC Berkeley)Privacy ResearchEncryptionDigital Rights
PGP fingerprint
B4A7 B0FF 8F75 F17E A28E 056F F025 2FAB 7CB1 AA0C
Download public key
For encrypted communication, use the intake form or encrypt with this key in your email client.

Hi, I'm David. Orion Private is my one-person privacy practice, which I started in 2025. I work with individuals, families, and professionals who have decided their digital lives are worth protecting and want to do something about it.

My background is in Legal Studies and Public Policy from UC Berkeley, and that training shapes every engagement. I read statutes and court opinions, and I trace whose laws your data falls under. I've also worked on data breach response, reviewing breached data to find whose personal and health information was exposed so they could be notified. That work showed me what actually ends up in the wrong hands. I'm now working toward the CIPP/US certification from the International Association of Privacy Professionals, with the CIPM to follow.

Most people aren't being targeted by one determined person, but everyone lives inside the surveillance economy. Big tech collects by default, brokers sell what they gather, and the government can reach much of it through those same companies. So I start with your threat model, who could realistically come after your information and what it would take, and build from there instead of handing you a checklist.

I use these tools every day myself, so I know they can be cumbersome to live with. A good consultant meets you where you are, brings changes in at a pace you can handle, and tells you the truth when something has to change.

You won't find my photo or full name on this site. I keep my own footprint small on purpose, the same way I'd help you keep yours. Your name and your engagement never go into a CRM, a billing platform, or an AI that trains on what passes through it, and the practice carries errors and omissions and cyber liability insurance. The Services page has more on how I handle your information.

Looking ahead

After the CIPM, I want to take on the business side. Small practices under HIPAA or the FTC's Safeguards Rule often have no one on staff to meet those duties, so compliance turns into paperwork that does little to protect anyone.

Law school is the long-term plan, so I can work on these problems wherever the leverage is greatest, in practice, in policy, or inside the agencies that are supposed to hold the line. It's also expensive. Starting in 2026, new law students can borrow no more than $50,000 a year in federal loans, less than most schools cost, so I'm building the practice and my credentials first. I'd rather not let a massive loan balance decide what kind of law I practice.

Research classification
Field Assessment Technical comparisons, tool evaluations, provider breakdowns
Analysis Policy failures, regulatory gaps, government overreach
Technical Brief Educational explainers, foundational concepts
Investigative Report Exposure pieces, tracking research, hidden practices revealed
Policy Commentary Opinion and commentary on the law

I work from primary sources where I can, such as court records, statutes, official documentation, transparency reports, and academic research, along with established reporting. No affiliate links and no sponsorships.

I sometimes use AI tools to edit and tighten my writing. The research, arguments, and conclusions are mine, and I check every source myself.

About this site

I write this whole site as one HTML file, with no frameworks, templates, or WordPress. A short script copies each article onto its own page so it can be linked and found. It all runs as static pages on GitHub Pages, so there's no server-side code or database to attack. It loads only two outside files, the OpenPGP library behind the contact form and a small analytics script. No ad trackers, and nothing that follows you across the web.

The analytics tool is Plausible. It's open source, sets no cookies, doesn't store your IP address, and can't follow you across sites or devices. It's an EU company that keeps its data in Germany and doesn't sell what it collects.

Contact

Get in Touch

Ask about consulting, send a research question, or tell me what I got wrong.

Encrypted intake form

Free, no commitment.
Only I can read what you send.

Encrypted in your browser with OpenPGP.js. Nothing is sent until you email it.

Getting started

01
Intake form
Free
02
I reply
Within 36 hours
03
Paid consultation
$60 for 30 minutes
04
Fee credited
Toward any service
Other ways to reach me

Email

privacy@orionprivate.com
PGP fingerprint
B4A7 B0FF 8F75 F17E A28E 056F F025 2FAB 7CB1 AA0C
Download public key

Plain email isn't encrypted. Use my key or the form.

Anonymous encrypted contact

No email, phone number, or account needed.

SimpleX address
https://smp15.simplex.im/a#xZA93oZyUT6tQ7lAHF7K_45JNwSjTMQHzewneBQn8cU
Need SimpleX? Download it here