When people defend bulk collection of phone records, they usually say the same thing: “We are not listening to your calls. It’s only metadata.” Who called whom, when, for how long, from which cell tower. No words, no voices.
It sounds harmless. It isn’t. In many cases metadata tells a stranger more about you than the content of your messages would. And end-to-end encryption, which is now standard in good messengers, does nothing about it. Encryption locks the letter. The envelope is still on the outside, with the address written on it.
What the envelope says
Take one ordinary week of your phone records. No content at all. Just numbers, times and places.
A call to a cardiology clinic, then a lab, then a pharmacy. Three calls to the same number every evening at 23:00, never during the day. A night spent at an address that is not your home. Your phone goes quiet every Sunday morning near the same church. A short call to a lawyer who does divorces, the day after a long call with your sister.
None of these needs a single word of content. Each one is easy to read. Put a few months of them together and you have health, religion, relationships, money trouble and daily routine. That is a better profile than most people could write about themselves.
A former head of the NSA and the CIA, Michael Hayden, put it in one sentence at a public debate in 2014: “We kill people based on metadata.” He was not describing a theory.
This has been measured
In 2016 three Stanford researchers published a study on phone metadata. 823 volunteers installed an app that shared only their call and text records: about 250,000 calls and 1.2 million text messages. No content. The researchers then looked at which numbers people called and who owned those numbers.
The results read like a medical file. One participant called a pharmacy for chronic care, several neurology practices and a hotline for a drug used only for multiple sclerosis. Another got a long call from a cardiology group, then called the hotline of a heart arrhythmia monitoring device. Another called a firearm dealer and the support line of a rifle maker. Another called a hardware store, a locksmith, a hydroponics shop and a head shop in under three weeks. The researchers checked two of these against public sources. Both were right.
They used simple methods and a small sample. An operator, an ad network or a government has much more data and much better tools.
Location is even worse. A 2013 study of 1.5 million mobile users found that four points of place and time were enough to pick out 95% of them uniquely. “Anonymous” location data stays anonymous until someone asks the right question. Your home is where your phone sleeps. Your job is where it spends the day.
And sometimes nobody has to ask. In 2018 a fitness app published a global heat map of its users’ runs. It was meant to show popular routes. It also showed the outlines of military bases in places where almost nobody else owns a fitness tracker, because the soldiers jogged around the perimeter every morning.
Why encryption doesn’t fix it
End-to-end encryption is a real win. With it, the server that carries your message cannot read it. But the server still has to deliver it, and to deliver it, it needs to know where it goes.
So in most systems the service knows:
- who sent a message and who received it
- when, to the second, and how often
- how big it was (a photo looks different from “ok”)
- where you were, roughly, from your IP address
- who is in which group, and when people joined or left
Your contact list is the most valuable piece. Many apps ask to upload it “to find your friends”. From that moment the service has a map of your social life, and of the lives of people who never installed the app and never agreed to anything.
Email is worse. Even with encryption tools, the sender, the receiver, the time and usually the subject line travel in clear text. On the web, a secure connection hides the page you read, but not which site you visit, when, and for how long.
This is also why “we can’t read your messages” is a weaker promise than it sounds. It may be true. It says nothing about the envelope.
Why companies keep it
Content is hard to use. It’s in many languages, full of jokes and context, and encrypted more and more often. Metadata is the opposite. It’s structured, small, cheap to store and easy to analyse. You can put ten years of it in a database and run queries on it in seconds.
That makes it attractive to everyone. Ad networks use it to place you in a segment. Data brokers buy and sell location trails collected by ordinary apps. Fraud teams, insurers and law enforcement all have reasons to ask for it. Logs that were kept “for debugging” become the thing everyone wants on the day of a court order or a breach.
The best answer to a court order is a short one. One well-known encrypted messenger has published its replies to subpoenas: the only data it could hand over about an account was the date it was created and the date it last connected. That is not a legal trick. The service was built not to know the rest.
What builders can do
You can’t remove all metadata. A message has to go somewhere. But most of it is collected by habit, not by need, and a lot can be designed away:
- Don’t upload the address book. Check contacts on the device, or let people share a code or a link instead.
- Keep data on the phone when the feature works there. A habit tracker or a notes app that never talks to a server leaves no trail on one. There is nothing to log because nothing is sent.
- Log less, and shorter. Cut IP addresses, drop exact timestamps, delete logs on a schedule. The same rule we described in data that is never collected cannot leak applies to the envelope as much as to the letter.
- Hide the sender from the server when you can. Some messengers now deliver messages without the server learning who sent them. It takes more work. It is possible.
- No third-party SDKs. A tracking library sees when the app opens, for how long and from where. That is metadata too, sent to a company the user never heard of. More on this in why we don’t track users.
For users the questions are simple. Does this app need my contacts? Does it need my location all the time? Does it need an account at all? Every “no” means a shorter trail.
What you say is often less private than when, where and to whom you say it. Encryption protects the words. Protecting the rest is a design choice, made by whoever builds the app. If a service promises privacy, ask what it knows about the envelope, not only the letter.