# XMPP privacy rating

XMPP, also known as Jabber, is an open standard for federated instant messaging maintained by the XMPP Standards Foundation, with many independent clients and servers.

## Summary

XMPP scores 78 out of 100 (grade B) on the messengers criteria. It meets 5 of 7 criteria: open source, no trackers or telemetry, no ads or data sales, no phone number needed and decentralized. It partly meets end-to-end encrypted by default. It does not meet metadata protection.

- Website: https://xmpp.org
- Source code: https://github.com/xsf/xeps
- Home page trackers: none found
- Category: [Messengers](https://privacyratings.com/messengers/)
- Grade: B (78/100)

## Criteria

| Criterion | Answer | Note | Evidence |
| --- | --- | --- | --- |
| Open source | Yes | Open standard (RFC 6120) with many open source clients and servers. | https://datatracker.ietf.org/doc/html/rfc6120 |
| No trackers or telemetry | Yes | The standard defines no telemetry, and the xmpp.org site loads only its own scripts with no analytics. | https://github.com/xsf/xmpp.org |
| No ads or data sales | Yes | Maintained by the non-profit XMPP Standards Foundation, funded by sponsors, with no ads. | https://xmpp.org/about/xmpp-standards-foundation/ |
| End-to-end encrypted by default | Partial | End-to-end encryption comes from the optional OMEMO extension; some clients enable it by default, but the core protocol does not. | https://xmpp.org/extensions/xep-0384.html |
| No phone number needed | Yes | Accounts are addresses of the form user@server; no phone number is involved. | https://datatracker.ietf.org/doc/html/rfc6120 |
| Metadata protection | No | Servers store contact lists and see who talks to whom. |  |
| Decentralized | Yes | Federated; anyone can run a server that talks to other servers. | https://datatracker.ietf.org/doc/html/rfc6120 |

Source: https://privacyratings.com/messengers/xmpp/
Edit: https://github.com/privacyratings/privacyratings.com/edit/main/ratings/messengers/xmpp.md