If you allow it, Signal can check your phone's address book contacts to see which ones use Signal, by sending scrambled (hashed) versions of your contacts' phone numbers to Signal's servers.
When you use Signal's contact discovery feature, information about your contacts — people who may not use Signal and have not consented to any data processing — is cryptographically processed and sent to Signal's servers, which may have GDPR implications for EU users.
Cross-platform context
See how other platforms handle Contact Discovery Data Processing and similar clauses.
Compare across platforms →Even though Signal hashes contact data before transmission, this process involves uploading information about people who have not consented to Signal's data processing — a significant GDPR third-party data subject consideration.
(1) REGULATORY FRAMEWORK: Contact discovery implicates GDPR Art. 6 (lawful basis for processing third-party contact data), Art. 14 (information to data subjects whose data was not collected from them), and Art. 9 (where contact lists reveal special category data such as religious or political associations). CCPA §1798.100 applies to California residents' contact data. Illinois BIPA (740 ILCS 14) may apply if contact hashing constitutes biometric data processing — unlikely but worth assessment. (2)
Compliance intelligence locked
Regulatory citations, enforcement risk, and due diligence action items.
Watcher: regulatory citations. Professional: full compliance memo.