Data & Privacy
Metadata says who, when and where, and it is rarely encrypted
Strong encryption protects what was said. The record that a conversation happened, between whom and for how long, usually travels in the clear.
Comparisons of communications metadata usually pick a winner. This one picks the circumstances, which is more useful.
The difference in one place
- Routing information cannot be hidden from the network carrying it.
- Patterns of contact reveal relationships without any content at all.
- Retention rules for this data vary enormously between countries.
Content and envelope are different problems
Encryption scrambles the contents of a message so that only the intended recipient can read what it says. The network still needs to know where to deliver it, which means the addressing information must remain readable. That envelope includes who contacted whom, at what time, from which network location and for how long.
None of that is protected by encrypting the contents, because the delivery mechanism depends on being able to read it. This is a structural property of any network that routes traffic rather than a weakness in any particular application.
Why the carrier cannot be cut out
A mobile network must know which device is attached to which tower in order to deliver a call or a message. That requirement generates location records continuously, whether or not any communication actually takes place. An internet provider sees which addresses you connect to and when, even where the contents are entirely opaque.
Encrypted name lookups and similar measures move some of that visibility to a different party rather than removing it. Someone always knows the envelope, and the practical question is which organisation that is and what they do with it.
Patterns speak without content
Knowing who contacts whom, how often and at what hours describes a relationship without a single word being read. A sudden burst of contact between people who rarely speak indicates an event, and the nature of it is often guessable. Contact between a person and a specialist service can imply something sensitive purely from the identity of the other party.
Building a graph of contacts identifies groups and central figures within them, which is why this data is valued. Officials have argued both that metadata is less intrusive than content and that it is uniquely revealing, and the disagreement is genuine.
Retention varies enormously
Some jurisdictions require providers to keep records for a defined period, while others prohibit keeping them that long. The rules differ for calls, messages and internet connections, and they have changed repeatedly following court decisions. Access requirements also vary, with some systems requiring judicial authorisation and others allowing administrative requests.
At the protocol level, because traffic crosses borders, records about one conversation can exist under several different legal regimes at once.
Anyone reasoning about this should check the rules where they live rather than assuming a familiar arrangement applies.
What reduces the envelope
Routing traffic through intermediaries separates knowledge of who you are from knowledge of where you are going. Layered routing systems arrange for no single relay to know both ends, which is a genuine structural improvement.
The short version: some messaging systems hide the sender's identity from their own servers, so the record reveals a recipient and little else. Padding messages to a uniform size and adding delays frustrates analysis based on timing and length. Each technique costs speed or convenience, which is why they are used selectively rather than by default everywhere.
Firmware updates change this behaviour more often than hardware does.
What to expect in practice
Assume that the fact of a communication is recorded somewhere even when its contents are protected properly. Assume that location is generated by carrying a connected device rather than by using it for anything in particular. Treat claims that a service keeps no records with appropriate scepticism unless the design makes retention impossible.
Where a relationship itself is sensitive, choosing a channel that hides participants matters more than choosing stronger encryption. Threat modelling here means asking who you are hiding from, since different adversaries see completely different parts of the envelope.
Side by side
| Consideration | What it means in practice |
|---|---|
| Content and envelope are different problems | Routing information cannot be hidden from the network carrying it. |
| Why the carrier cannot be cut out | Patterns of contact reveal relationships without any content at all. |
| Patterns speak without content | Retention rules for this data vary enormously between countries. |
The takeaway
Encrypting the letter does nothing about the postmark.
The constraint is almost always physical, and marketing rarely mentions which one.
Questions readers ask
If my messages are end-to-end encrypted, what can the provider see?
Typically who spoke to whom, when, message sizes and connection addresses. Design choices can reduce this, and it is rarely eliminated.
Does a virtual private network hide metadata?
It hides destinations from your access provider and reveals them to the operator instead. The envelope moves rather than disappearing.
