Rights

Encrypting a message is like sealing an envelope. Nobody in transit can read the letter. Everybody in transit can still read the address, the return address, the postmark, the date, and the thickness of the envelope. That outside layer is metadata, and it is not a lesser form of data. It is a different one, and in some ways a more revealing one.

The legal answer, and why it surprises people

The question of whether it counts as personal data has a legal answer, not just a philosophical one. **GDPR Article 4(1)** defines personal data as *"any information relating to an identified or identifiable natural person"*, and it says a person may be identifiable *"directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier"*. Location data and online identifiers are named **explicitly**. So metadata is not exempt by nature: it is personal data whenever it can be tied back to a person, which in practice is most of the time.

The reason this matters is that metadata resists the intuition people have about it. Content feels sensitive because you can read it. Metadata feels harmless because it is just a list of numbers and timestamps. The research says otherwise.

What 546 phones gave away without a single message

Stanford researchers **Jonathan Mayer and Patrick Mutchler**, with **John C. Mitchell**, ran a study using an app called **MetaPhone**, collecting call metadata from **546 volunteers** starting in **November 2013**. With no message content at all, and using public sources to identify who was being called, they were able to infer medical conditions, firearm ownership and religious affiliation.

• Metadata - the data about your communications, not their content: who, when, how long, from where
• GDPR Article 4(1) names 'location data' and 'online identifier' explicitly among identifiers
• Stanford MetaPhone study: 546 volunteers, medical conditions and religious affiliation inferred from call records alone
• Structured and machine-readable, metadata scales to millions in a way reading content never could
• Encryption protects content, not the record that a conversation happened

One published example is worth reading slowly. A participant called several local neurology groups, a specialty pharmacy, a rare-condition management service, and a pharmaceutical hotline used for multiple sclerosis. Nobody read a word that person wrote. The pattern of who they called, in what order, told the story anyway.

That is the property that makes metadata powerful: it does not need to be interpreted. Content is ambiguous, sarcastic, in a language you may not speak. A call log is structured, machine-readable and complete. It scales to millions of people in a way reading their messages never could.

"We kill people based on metadata"

The bluntest statement of this came from **Michael Hayden**, who directed the NSA from 1999 to 2005 and the CIA from 2006 to 2009. At a **2014 debate at Johns Hopkins University**, responding to a description of what metadata reveals, he said: *"[That] description... is absolutely correct. We kill people based on metadata."* He immediately added: *"But that's not what we do with this metadata"*, drawing a line between foreign targeting and domestic collection. Both halves belong in the quote. The first tells you how much metadata is thought to be worth; the second is the distinction he insisted on.

What this does not mean, and what you can do

None of this makes encryption pointless, and that is the wrong conclusion to draw. Sealing the envelope still stops anyone from reading the letter, which is not a small thing. It just means the envelope is not the whole problem, and that a service can encrypt content perfectly while keeping a rich record of your contacts, your hours and your location.

This is exactly why, in any honest comparison of messaging apps, the question is not only *"is it end-to-end encrypted?"* but *"how much does the operator keep about who I talk to?"* Two apps can use the same encryption protocol and differ enormously on that second question. The encryption is the easy part to advertise; the metadata practice is the part that requires you to trust who runs the service.

What you can act on is narrower than the problem, but it is real. Prefer services that are designed to hold little metadata rather than services that merely encrypt content. Reduce the number of intermediaries that see your traffic. Assume that anything not encrypted end-to-end has metadata retained by default, and that deleting a message rarely deletes the record that it was sent.