Metadata: The Thing They Still Collect

01 What Stays Visible When the Message Disappears

End-to-end encryption is real and it works: a well-implemented system means the message content is unreadable to everyone except sender and recipient. WhatsApp, Signal, iMessage — the ciphertext is genuinely opaque. But the envelope carrying that ciphertext is another matter entirely.

Metadata is everything that isn't the message. Who sent it. Who received it. When. From which IP address. How large the payload was. How often this pair of people exchange messages. Whether that frequency spiked after a particular news event. Intelligence analysts have a phrase for this: content is circumstantial, but metadata is structural. It shows the architecture of your relationships before a single word is read.

Your messenger almost certainly logs some of it. The server needs to know where to route your message — which means it knows who you're messaging. It timestamps delivery, which is a record of when you were active. Group membership, contact lists, read receipts, last-seen status: all metadata, all potentially retained. Even if a company's privacy policy says it doesn't read your messages, the surrounding data can paint a picture that's arguably more intimate. Patterns of behaviour are harder to spin than individual words.

Signal is the serious outlier here. Its sealed sender architecture and minimal logging are specifically engineered to reduce what even Signal's own servers can learn. In response to legal demands, Signal has repeatedly demonstrated it holds almost nothing — just the time of account creation and the date of last connection. That's the result of designing for metadata minimisation, not just encrypting content. Most services don't make that choice.

The broader problem is structural. Centralised chat services have a business reason to hold metadata — it feeds recommendation engines, ad targeting, and product analytics. WhatsApp's parent company has been explicit that it shares metadata with Meta's broader infrastructure. The message is private; the map of who you know isn't.

Federated systems like Matrix distribute the graph somewhat, since no single server holds everyone's data. But federation also means metadata passes through multiple servers, any of which might log. There's no architecture that makes metadata vanish entirely — only choices about who holds it, for how long, and under what legal jurisdiction.

The practical upshot: when you're evaluating a messenger on privacy, look past the "encrypted" badge. Ask what it retains about contact graphs, session times, and group membership. Choosing a messenger on privacy grounds is, in large part, a metadata question. The content is locked. The envelope is often still lying on the hall table.

These notes are part of an ongoing field guide — corrections and additions are welcome at the desk.

◆ People & organisations