The FBI got their hands on deleted Signal messages. Cheers, iPhone notifications.
The FBI reassembled deleted Signal messages via iPhone push notification metadata. End-to-end encryption didn't make a difference.
An American judicial document confirms what privacy researchers have been saying since 2023: iPhone push notifications are a backdoor for accessing encrypted message content, even after it’s been deleted by the user. Signal is doing its job correctly. Apple is too, technically. It’s the combination of the two that betrays you.
What’s happening
In early April 2026, 9to5Mac reported on a federal American case. The FBI was investigating an individual, requested iCloud push notification data from Apple, and was able to reconstruct the content of received Signal messages that the target had deleted from their device.
The mechanism is simple. When a message arrives on Signal, the app triggers a push notification. This notification passes through APNs, Apple’s notification service. If the user has the default preview setting, the message content is sent in plaintext within the notification payload. Apple stores these metadata for an unspecified duration and, upon judicial order, hands them over to authorities.
The EFF published an in-depth analysis on April 16. The conclusion is clear: it’s not a bug in Signal, nor is it a bug in Apple; it’s the very architecture of the notification system that creates a blind spot. Signal encrypts messages end-to-end. Apple delivers the notification. In between, there’s a server relay that sees the content if you haven’t locked it at the source.
Senator Ron Wyden had already raised the alarm in December 2023, revealing that the US government regularly requests this data from Apple and Google. Three years later, we finally have proof that the technique has been used to access Signal conversations. And it works even after user-side deletion.
Why this matters to you
You can have the best end-to-end encryption in the world. If the notification that lands on your lock screen contains the phrase “Meet at 9 PM at the usual address,” that phrase exists somewhere on an Apple server before it reaches you. And that “somewhere” is accessible via a warrant.
This isn’t a scenario for dissident journalists or activists. It’s how your iPhone works by default today. Notifications have previews, sender names are displayed, and the first line of the message is readable from the lock screen. Convenient, very convenient. As convenient for you as it is for any institutional actor.
The kicker: it survives deletion. You delete the conversation on Signal, it disappears from your phone, and it never existed on Signal’s servers. Perfect.
But the notification announcing that message? It left a trace with Apple. That trace is more ephemeral than your emails, but it’s sufficient to reconstruct a conversation if the request comes within the right time window.
The 9to5Mac case involves the FBI and an individual pursued in the US. But the mechanism is universal. Any authority that can compel Apple to hand over iCloud data can, in principle, access these metadata. American jurisdiction, CLOUD Act, no need for a schema.
The irony is cruel. You chose Signal for maximum privacy. You enabled ephemeral messages. You were diligent. And you’re betrayed by an iOS setting that no one ever presented to you as a security issue.
What you need to do
Two settings, five minutes, and the leak is plugged.
1. Immediately: Signal > Settings > Notifications > “No Name or Content”. The app stops injecting the sender’s name and content into the notification. You know a Signal message has arrived, but you don’t know who it’s from or what it says until you open the app.
2. Within the week: iOS > Settings > Notifications > Previews > Never. You disable content previews for all apps at once, including Messages, Mail, WhatsApp, and the rest. Slightly degraded convenience, massively reduced exposure surface.
3. If you want to go further: spend thirty minutes going through the privacy settings on macOS and iOS. Most blind spots can be addressed once and last for years.
Need tech terms explained? Check the glossary.