# Google Messages privacy rating

Google's default SMS, MMS and RCS messaging app for Android, with a paired web client. RCS chats between Google Messages users are end-to-end encrypted automatically; SMS and MMS are not.

## Summary

Google Messages scores 17 out of 100 (grade F) on the messengers criteria. It partly meets no trackers or telemetry and end-to-end encrypted by default. It does not meet open source, no ads or data sales, independent audit, no phone number needed, metadata protection and decentralized. It is based in the United States: Five Eyes member; subject to the US CLOUD Act.

- Website: https://messages.google.com
- Jurisdiction: United States. Five Eyes member. Subject to the US CLOUD Act.
- Platforms: Android, Web
- Home page trackers: none found
- Category: [Messengers](https://privacyratings.com/messengers/)
- Also rated: [Gmail](https://privacyratings.com/email-providers/gmail/) (Email providers), [Gmail app](https://privacyratings.com/email-clients/gmail-app/) (Email clients), [Google Takeout](https://privacyratings.com/email-backup/google-takeout/) (Email backup tools), [Google Chrome](https://privacyratings.com/browsers/google-chrome/) (Browsers), [Google Search](https://privacyratings.com/search-engines/google-search/) (Search engines), [Google Authenticator](https://privacyratings.com/two-factor-authentication/google-authenticator/) (Two-factor authentication), [Google Meet](https://privacyratings.com/video-calls/google-meet/) (Video calls), [Google Voice](https://privacyratings.com/virtual-phone-numbers/google-voice/) (Virtual phone numbers), [Google Public DNS](https://privacyratings.com/dns-resolvers/google-public-dns/) (DNS resolvers), [Google Cloud](https://privacyratings.com/server-hosting/google-cloud/) (Server hosting), [Chrome Remote Desktop](https://privacyratings.com/remote-desktop/chrome-remote-desktop/) (Remote desktop), [Google Keep](https://privacyratings.com/notes/google-keep/) (Notes), [Google Calendar](https://privacyratings.com/calendars/google-calendar/) (Calendars), [Google Docs](https://privacyratings.com/office-suites/google-docs/) (Office suites), [Google Forms](https://privacyratings.com/forms/google-forms/) (Forms and surveys), [Google Translate](https://privacyratings.com/translation/google-translate/) (Translation), [Google Gemini](https://privacyratings.com/ai-assistants/google-gemini/) (AI assistants), [Google Drive](https://privacyratings.com/cloud-storage/google-drive/) (Encrypted cloud storage), [Google Maps](https://privacyratings.com/maps/google-maps/) (Maps and navigation), [Google Analytics](https://privacyratings.com/web-analytics/google-analytics/) (Website analytics), [Google Home](https://privacyratings.com/smart-home/google-home/) (Smart home), [Google Nest Cam](https://privacyratings.com/security-cameras/google-nest-cam/) (Security cameras), [Fitbit](https://privacyratings.com/wearables/fitbit/) (Wearables and health), [Google Fit](https://privacyratings.com/fitness-trackers/google-fit/) (Fitness trackers), [Google Photos](https://privacyratings.com/photo-management/google-photos/) (Photo management)
- Grade: F (17/100)

## Criteria

| Criterion | Answer | Note | Evidence |
| --- | --- | --- | --- |
| Open source | No | Closed source. |  |
| No trackers or telemetry | Partial | Exodus finds no third-party trackers, but Google collects app usage and diagnostic data by default. | https://reports.exodus-privacy.eu.org/en/reports/com.google.android.apps.messaging/latest/ |
| No ads or data sales | No | The app shows no ads, but it is provided free by Google, whose privacy policy uses activity across its services to fund and personalize advertising. | https://policies.google.com/privacy |
| Independent audit | No | No independent audit is published. |  |
| End-to-end encrypted by default | Partial | RCS chats, including groups, are end-to-end encrypted automatically only when all participants use a supporting app; SMS and MMS are never encrypted. | https://support.google.com/messages/answer/10262381 |
| No phone number needed | No | Messages are sent and received with the phone number of the SIM, which is visible to recipients. |  |
| Metadata protection | No | Google and carriers see who talks to whom. |  |
| Decentralized | No | RCS runs through carrier and Google servers that users cannot run themselves. |  |

Source: https://privacyratings.com/messengers/google-messages/
Edit: https://github.com/privacyratings/privacyratings.com/edit/main/ratings/messengers/google-messages.md