It may come as an unsettling surprise, but your iPhone and Android push notifications—those small messages that continually pop up offering the latest updates—can potentially be used to spy on you. According to recent revelations, governments have compelled Apple and Google to hand over user data collected through push notifications under strict secrecy.

The story first came to light when U.S. Senator Ron Wyden sent a letter to the Justice Department voicing concerns over an attempt to investigate how foreign governments were requesting push notification data from major tech companies. Wyden’s office received a tip in Spring 2022 alleging that user data was being accessed in bulk through smartphone push notifications.

When Wyden’s team attempted to gather more details from Apple and Google, they were stonewalled—company insiders cited government restrictions barring them from disclosing any information regarding data access requests. This cloak-and-dagger approach troubled privacy advocates and prompted Wyden to press for transparency.

Now that the secret is out, Apple and Google have pledged to overhaul their policies. “In this case, the federal government prohibited us from sharing any information,” Apple said. “Now that this method has become public we are updating our transparency reporting to detail these kinds of requests.” Google echoed a similar commitment: “We share the Senator’s commitment to keeping users informed about these requests.”

So how does accessing push notification data equate to spying on users? Typically, the apps you install retain control over account data, while notification content flows through Apple’s or Google’s servers before reaching your device. By compelling the tech giants to share these streams, governments can potentially access extremely sensitive user information.

It may be time to re-examine your app permissions and notification settings if this newly uncovered surveillance pathway raises privacy issues. For those concerned, disabling notifications blocks this particular data-gathering technique in its tracks.

The velvet-gloved strong-arming around push notification data marks the leading edge of a disconcerting trend. As mobile devices become more deeply integrated into daily life, expanding surveillance powers collide with reasonable privacy expectations. Senator Wyden’s actions shine a light on the opaque processes governing requests for user data. By forcing vital transparency and policy changes from Apple and Google, he strikes an important victory for consumer protection in the digital domain.