The encrypted messaging app Signal has once again shown just how little data it collects on users after publicly revealing its response to a recent government subpoena.
Signal was ordered last month by the United States Attorney’s Office in the Central District of California to provide a wide array of information on numerous users currently under criminal investigation.
The subpoena demanded access not only to multiple users’ names and home addresses but the times and dates they messaged one another.
But there’s just one problem: Given that the app was built from the ground up with privacy in mind, Signal doesn’t collect large amounts of data like other messaging services do.
In a blog post on the matter, Signal detailed how it was unable to provide nearly all of the information requested.
“Because everything in Signal is end-to-end encrypted by default, the broad set of personal information that is typically easy to retrieve in other apps simply doesn’t exist on Signal’s servers,” the company wrote. “The subpoena requested a wide variety of information that fell into this nonexistent category, including the addresses of the users, their correspondence, and the name associated with each account.”
Signal went on to further note that it “doesn’t have access to your messages; your chat list; your groups; your contacts; your stickers; your profile name or avatar; or even the GIFs you search for.”
The only data Signal was able to hand over for the accounts listed in the subpoena were the times and dates when they were created and the last time they connected to the app.
For comparison, the popular Facebook-owned messaging service WhatsApp can hand over everything from your name, IP address, and email address to your profile photos, address book, and “about” information if requested by law enforcement.
Signal’s blog post on Wednesday is not the first time that the encrypted messaging service has revealed the details of a government subpoena. In 2016, Signal also published a blog post about a subpoena from the Eastern District of Virginia. Just like the most recent case, Signal was only able to provide when the user’s account was created and when it was last accessed.
