No Data Sale Commitment

What it is

Signal makes an unconditional promise never to sell, rent, or make money from your personal data or the content of your messages.

Why it matters (compliance & governance perspective)

This is a direct, unqualified commitment that distinguishes Signal from ad-supported platforms and provides a clear baseline expectation for users concerned about commercial data use.

Consumer impact (what this means for users)

Users' personal data and message content will not be sold or monetized in any form, which means Signal's business model cannot rely on profiling or data brokering activities involving user information.

Institutional analysis (Compliance & governance intelligence)

REGULATORY LANDSCAPE: This provision directly engages the FTC Act's prohibition on unfair or deceptive trade practices; a public, unqualified no-sale commitment creates a binding consumer-facing representation enforceable by the FTC and state attorneys general. Under CCPA, California residents have a statutory right to opt out of the sale of personal information, and this provision effectively forecloses that activity entirely. The FTC is the primary enforcement authority. GOVERNANCE EXPOSURE: Low. The commitment is unambiguous and architecturally supported by Signal's end-to-end encryption model, which limits the data available for monetization in the first place. The primary compliance risk would arise if Signal's business practices were found to diverge from this stated commitment, which would constitute a deceptive practice under Section 5 of the FTC Act. JURISDICTION FLAGS: California residents benefit from CCPA's enforcement framework in addition to FTC oversight. EU/EEA users would also be protected under GDPR's prohibition on processing personal data for incompatible purposes without a valid legal basis. The commitment appears globally applicable as stated. CONTRACT AND VENDOR IMPLICATIONS: Organizations procuring Signal for business communications can rely on this provision as a contractual representation against data monetization. However, Signal does not offer formal Data Processing Agreements, which may be required by GDPR Article 28 for enterprise deployments; this gap should be flagged in vendor assessments. COMPLIANCE CONSIDERATIONS: Compliance teams should document this provision as a key privacy representation in vendor risk assessments. Any future update to this language should trigger immediate review, as modification of this commitment could constitute a material change requiring user notification and potentially regulatory scrutiny.

Applicable agencies

Provision details

Other risks in this policy

• End-to-End Encryption and Message Inaccessibility low
• Compelled Disclosure Carve-Out medium
• Aggregate Liability Cap of $100 medium
• California Exclusive Jurisdiction medium
• Phone Number Registration and Contact Discovery medium
• Unilateral Terms Modification medium