# iMessage privacy rating

Apple's end-to-end encrypted messaging service built into the Messages app on iPhone, iPad, Mac and other Apple devices, addressed by phone number or Apple Account email.

## Summary

iMessage scores 42 out of 100 (grade D) on the messengers criteria. It meets 2 of 8 criteria: no ads or data sales and end-to-end encrypted by default. It partly meets no trackers or telemetry and no phone number needed. It does not meet open source, independent audit, metadata protection and decentralized. It is based in the United States: Five Eyes member; subject to the US CLOUD Act.

- Website: https://support.apple.com/messages
- Jurisdiction: United States. Five Eyes member. Subject to the US CLOUD Act.
- Platforms: iOS, macOS
- Home page trackers: none found
- Category: [Messengers](https://privacyratings.com/messengers/)
- Also rated: [iCloud Mail](https://privacyratings.com/email-providers/icloud-mail/) (Email providers), [Hide My Email](https://privacyratings.com/email-forwarding/hide-my-email/) (Email forwarding and aliases), [Apple Mail](https://privacyratings.com/email-clients/apple-mail/) (Email clients), [Safari](https://privacyratings.com/browsers/safari/) (Browsers), [Apple App Store](https://privacyratings.com/app-stores/apple-app-store/) (App stores), [Apple Passwords](https://privacyratings.com/password-managers/apple-passwords/) (Password managers), [FileVault](https://privacyratings.com/file-encryption/filevault/) (File encryption), [FaceTime](https://privacyratings.com/video-calls/facetime/) (Video calls), [iOS](https://privacyratings.com/mobile-operating-systems/ios/) (Mobile operating systems), [macOS](https://privacyratings.com/desktop-operating-systems/macos/) (Desktop operating systems), [Spotlight](https://privacyratings.com/launchers/spotlight/) (App launchers), [Apple Notes](https://privacyratings.com/notes/apple-notes/) (Notes), [Apple Journal](https://privacyratings.com/journaling/apple-journal/) (Journaling apps), [Apple iWork](https://privacyratings.com/office-suites/apple-iwork/) (Office suites), [QuickTime Player](https://privacyratings.com/screen-recording/quicktime-player/) (Screenshots and screen recording), [Apple Books](https://privacyratings.com/ebook-readers/apple-books/) (Ebook readers), [Apple Dictation](https://privacyratings.com/speech-to-text/apple-dictation/) (Dictation and transcription), [iCloud Drive](https://privacyratings.com/cloud-storage/icloud-drive/) (Encrypted cloud storage), [Apple Maps](https://privacyratings.com/maps/apple-maps/) (Maps and navigation), [SwiftUI](https://privacyratings.com/app-frameworks/swiftui/) (Cross-platform app frameworks), [Apple Home](https://privacyratings.com/smart-home/apple-home/) (Smart home), [Apple Watch](https://privacyratings.com/wearables/apple-watch/) (Wearables and health), [Apple Health Cycle Tracking](https://privacyratings.com/period-trackers/apple-health-cycle-tracking/) (Period trackers), [Apple Music](https://privacyratings.com/music-streaming/apple-music/) (Music streaming), [iCloud Photos](https://privacyratings.com/photo-management/icloud-photos/) (Photo management)
- Grade: D (42/100)

## Criteria

| Criterion | Answer | Note | Evidence |
| --- | --- | --- | --- |
| Open source | No | Closed source. |  |
| No trackers or telemetry | Partial | No third-party trackers in the app, and sharing device analytics with Apple is opt-in. Apple web pages load Apple's own analytics (ac-analytics, sent to metrics.apple.com) by default. | https://www.apple.com/legal/privacy/data/en/device-analytics/ |
| No ads or data sales | Yes | Funded by Apple device sales, with no ads in Messages; the privacy policy states Apple does not sell personal data. | https://www.apple.com/legal/privacy/en-ww/ |
| Independent audit | No | No independent audit is published; Apple has only published commissioned formal analyses of the PQ3 protocol. |  |
| End-to-end encrypted by default | Yes | All iMessage chats, including groups, are end-to-end encrypted; iCloud backups of messages are only end-to-end encrypted with Advanced Data Protection, and SMS fallback is not encrypted. | https://support.apple.com/guide/security/imessage-security-overview-secd9764312f/web |
| No phone number needed | Partial | Creating an Apple Account requires verifying a phone number, but iMessage can be used with an email address so the number is not shown to contacts. | https://support.apple.com/en-us/108647 |
| Metadata protection | No | Apple's servers route messages by sender and recipient and may keep the phone numbers and email addresses a user looks up for up to 30 days. | https://www.apple.com/legal/privacy/data/en/messages/ |
| Decentralized | No | One central service run by Apple. |  |

Source: https://privacyratings.com/messengers/imessage/
Edit: https://github.com/privacyratings/privacyratings.com/edit/main/ratings/messengers/imessage.md