Creating a Signal account requires a phone number, and if you choose to use the contact discovery feature, your contacts' phone numbers are cryptographically hashed before being sent to Signal's servers to check who is also on Signal.
This analysis describes what Signal's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
Phone number registration ties your Signal identity to a real-world identifier, and contact discovery involves uploading hashed versions of your contacts' phone numbers to Signal's servers, which affects not just your privacy but also the privacy of people in your address book who may not be Signal users.
Interpretive note: The policy does not specify retention periods for hashed contact data or clarify whether the legal basis for processing third-party contact data meets GDPR requirements, creating ambiguity for EU compliance assessment.
Your phone number is the sole required personal identifier for Signal and cannot be replaced with an anonymous identifier; the optional contact discovery feature transmits hashed contact data to Signal's servers, which has privacy implications for contacts who have not consented to this process.
How other platforms handle this
You can always contact your local data protection authority if you have concerns regarding your rights under local law.
If you are an end user in a Workspace not owned by you and wish to update, delete, or receive any information we have about you, you may do so by contacting the organization who owns your ClickUp Workspace.
If you choose to reveal any personal information about yourself to other users, you do so at your own risk. We strongly encourage you to use caution in disclosing any personal information online.
"You register a phone number when you create a Signal account. Phone numbers are used to provide our Services to you and other Signal users. Signal can optionally discover which contacts in your address book are Signal users, using a service designed to protect the privacy of your contacts. Information from the contacts on your device may be cryptographically hashed and transmitted to the server in order to determine which of your contacts are registered.Excerpt from Signal's Privacy Policy
REGULATORY LANDSCAPE: The processing of contact data from a user's address book engages GDPR Article 6 lawful basis requirements, particularly for data about third parties (contacts) who have not directly consented to Signal's processing.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
Phone number registration ties your Signal identity to a real-world identifier, and contact discovery involves uploading hashed versions of your contacts' phone numbers to Signal's servers, which affects not just your privacy but also the privacy of people in your address book who may not be Signal users.
Your phone number is the sole required personal identifier for Signal and cannot be replaced with an anonymous identifier; the optional contact discovery feature transmits hashed contact data to Signal's servers, which has privacy implications for contacts who have not consented to this process.
ConductAtlas has identified this type of provision across 290 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Signal.