Messengers
Google Messages privacy rating
Google's default SMS, MMS and RCS messaging app for Android, with a paired web client. RCS chats between Google Messages users are end-to-end encrypted automatically; SMS and MMS are not.
Summary
Google Messages scores 17 out of 100 (grade F) on the messengers criteria. It partly meets no trackers or telemetry and end-to-end encrypted by default. It does not meet open source, no ads or data sales, independent audit, no phone number needed, metadata protection and decentralized. It is based in the United States: Five Eyes member; subject to the US CLOUD Act.
Score 17 out of 100. How scoring works
Criteria
- No
-
Partial
No trackers or telemetry Weight 3 of 3
Are the website and apps free of third-party trackers, with any analytics anonymous and any telemetry off by default?
Exodus finds no third-party trackers, but Google collects app usage and diagnostic data by default.
-
No
No ads or data sales Weight 2 of 3
Is the product funded without advertising, ad targeting or selling user data?
The app shows no ads, but it is provided free by Google, whose privacy policy uses activity across its services to fund and personalize advertising.
-
No
Independent audit Weight 2 of 3
Has an independent security or privacy audit been published within the last three years?
No independent audit is published.
-
Partial
End-to-end encrypted by default Weight 3 of 3
Are all chats, including groups, end-to-end encrypted by default?
RCS chats, including groups, are end-to-end encrypted automatically only when all participants use a supporting app; SMS and MMS are never encrypted.
-
No
No phone number needed Weight 2 of 3
Can an account be created without a phone number?
Messages are sent and received with the phone number of the SIM, which is visible to recipients.
-
No
Metadata protection Weight 2 of 3
Does the service minimize who-talks-to-whom metadata (for example sealed sender or no user identifiers)?
Google and carriers see who talks to whom.
-
No
Decentralized Weight 1 of 3
Can people run their own server or talk peer to peer?
RCS runs through carrier and Google servers that users cannot run themselves.