# MEGA privacy rating

End-to-end encrypted cloud storage and file sharing service with desktop, mobile and web apps and source-available clients.

## Summary

MEGA scores 38 out of 100 (grade F) on the encrypted cloud storage criteria. It meets 2 of 8 criteria: transparency report and TLS configuration. It partly meets open source and security headers. It does not meet no trackers or telemetry, no ads or data sales, independent audit and tells users about requests. It is based in Hungary: Not in the Five, Nine or Fourteen Eyes; EU member (GDPR). Automated tests: SSL Labs grade A+ and Mozilla HTTP Observatory grade B.

- Website: https://mega.io
- Source code: https://github.com/meganz/android
- Jurisdiction: Hungary. Not in the Five, Nine or Fourteen Eyes. EU member (GDPR).
- Platforms: Web, Windows, macOS, Linux, Android, iOS
- Home page trackers: Google Tag Manager
- Category: [Encrypted cloud storage](https://privacyratings.com/cloud-storage/)
- Grade: F (38/100)

## Criteria

| Criterion | Answer | Note | Evidence |
| --- | --- | --- | --- |
| Open source | Partial | Client source is published under the MEGA Limited Code Review Licence, which is not OSI-approved. The server is closed. | https://github.com/meganz/android/blob/master/LICENCE.md |
| No trackers or telemetry | No | The Android app includes Google AdMob, Firebase Analytics and Crashlytics. | https://reports.exodus-privacy.eu.org/en/reports/mega.privacy.android.app/latest/ |
| No ads or data sales | No | MEGA may serve ads in its services through third-party advertising companies and uses usage data for marketing. | https://mega.io/privacy |
| Independent audit | No | No independent audit is published. |  |
| Transparency report | Yes | Publishes a yearly transparency report with counts of legal orders and other requests. | https://mega.io/transparency |
| Tells users about requests | No | No published policy on notifying users about data requests. |  |
| TLS configuration | Yes | Grade A+ | https://www.ssllabs.com/ssltest/analyze.html?d=mega.nz&hideResults=on |
| Security headers | Partial | Grade B (75/100+) | https://developer.mozilla.org/en-US/observatory/analyze?host=mega.nz |
| Modern web standards | Not tested yet | Not tested yet. |  |

Source: https://privacyratings.com/cloud-storage/mega/
Edit: https://github.com/privacyratings/privacyratings.com/edit/main/ratings/cloud-storage/mega.md