Compelled Disclosure Carve-Out

What it is

Signal may share your data if required to do so by law, court order, or government request.

Why it matters (compliance & governance perspective)

Even though Signal stores minimal data and cannot access message content, it can still be compelled to share the technical metadata it does hold (such as account registration information and technical tokens) in response to legal process.

Consumer impact (what this means for users)

If Signal receives a valid legal demand, it may share the limited technical information it holds about your account (primarily your phone number and technical metadata) with authorities, though it cannot share message content due to encryption.

Institutional analysis (Compliance & governance intelligence)

REGULATORY LANDSCAPE: This provision is standard across US-based service providers and reflects obligations under ECPA's Stored Communications Act, which governs government access to stored electronic communications. The provision does not specify whether Signal provides notice to affected users when feasible, which is a transparency consideration under GDPR Article 13/14 and relevant to Signal's trust positioning. The DOJ and relevant law enforcement agencies are the primary actors in this context. GOVERNANCE EXPOSURE: Medium. The compelled disclosure provision is legally standard, but its significance for Signal users is distinctive because Signal's minimalist data architecture limits what can actually be disclosed. Known responses to legal process have reportedly produced only registration date and last connection date, though this is not stated in the document itself and should not be relied upon as a contractual commitment. JURISDICTION FLAGS: EU/EEA users should be aware that data transfers to US authorities pursuant to legal process engage GDPR Chapter V considerations and the EU-US Data Privacy Framework. UK GDPR creates similar considerations for UK users. The policy does not address these frameworks explicitly. CONTRACT AND VENDOR IMPLICATIONS: Organizations using Signal for sensitive communications should understand that while content is inaccessible, account-level metadata may be disclosed to authorities. This is relevant to threat modeling for high-risk users and enterprise security assessments. COMPLIANCE CONSIDERATIONS: Legal teams advising high-risk users (journalists, activists, legal professionals) should document the distinction between content inaccessibility and metadata disclosure risk. Organizations subject to legal hold obligations should assess what metadata Signal could produce if served with process.

Applicable agencies

Provision details

Other risks in this policy

• No Data Sale Commitment low
• End-to-End Encryption and Message Inaccessibility low
• Aggregate Liability Cap of $100 medium
• California Exclusive Jurisdiction medium
• Phone Number Registration and Contact Discovery medium
• Unilateral Terms Modification medium