Messengers
iMessage privacy rating
Apple's end-to-end encrypted messaging service built into the Messages app on iPhone, iPad, Mac and other Apple devices, addressed by phone number or Apple Account email.
Summary
iMessage scores 42 out of 100 (grade D) on the messengers criteria. It meets 2 of 8 criteria: no ads or data sales and end-to-end encrypted by default. It partly meets no trackers or telemetry and no phone number needed. It does not meet open source, independent audit, metadata protection and decentralized. It is based in the United States: Five Eyes member; subject to the US CLOUD Act.
Score 42 out of 100. How scoring works
Criteria
- No
-
Partial
No trackers or telemetry Weight 3 of 3
Are the website and apps free of third-party trackers, with any analytics anonymous and any telemetry off by default?
No third-party trackers in the app, and sharing device analytics with Apple is opt-in. Apple web pages load Apple's own analytics (ac-analytics, sent to metrics.apple.com) by default.
-
Yes
No ads or data sales Weight 2 of 3
Is the product funded without advertising, ad targeting or selling user data?
Funded by Apple device sales, with no ads in Messages; the privacy policy states Apple does not sell personal data.
-
No
Independent audit Weight 2 of 3
Has an independent security or privacy audit been published within the last three years?
No independent audit is published; Apple has only published commissioned formal analyses of the PQ3 protocol.
-
Yes
End-to-end encrypted by default Weight 3 of 3
Are all chats, including groups, end-to-end encrypted by default?
All iMessage chats, including groups, are end-to-end encrypted; iCloud backups of messages are only end-to-end encrypted with Advanced Data Protection, and SMS fallback is not encrypted.
-
Partial
No phone number needed Weight 2 of 3
Can an account be created without a phone number?
Creating an Apple Account requires verifying a phone number, but iMessage can be used with an email address so the number is not shown to contacts.
-
No
Metadata protection Weight 2 of 3
Does the service minimize who-talks-to-whom metadata (for example sealed sender or no user identifiers)?
Apple's servers route messages by sender and recipient and may keep the phone numbers and email addresses a user looks up for up to 30 days.
-
No
Decentralized Weight 1 of 3
Can people run their own server or talk peer to peer?
One central service run by Apple.