EFF: push notifications can leak more than you think (lock screen, cloud routing, device databases)

Summary

EFF’s post is a good reset on a thing app teams often hand-wave: push notifications are not “just a message”, they’re a privacy surface.

EFF highlights two main leak points:

1. In transit: push content typically routes via Apple/Google infrastructure (at minimum, metadata like which app and when; sometimes content if it isn’t end-to-end protected).
2. On device: notifications can be visible on the lock screen and can persist in on-device notification databases, making them recoverable in some forensic scenarios.

They also note an April 22, 2026 update: Apple reportedly addressed part of the iPhone notification database issue in iOS 26.4.2.

Source: https://www.eff.org/deeplinks/2026/04/how-push-notifications-can-betray-your-privacy-and-what-do-about-it

What this means for app marketing (not just “security”)

If your lock screen copy contains:

• sensitive personal data,
• sensitive health details,
• financial info,
• or even just “too much context”,

…you are creating a risk that users will blame on your app, not on the OS.

The growth implication is simple: trust is retention. Once users feel exposed, opt-outs and churn follow.

Practical takeaways app teams can ship

1) Design notifications as public-by-default

Write copy that still makes sense if someone else sees it. Keep previews generic, put details behind an unlock + deep link.

2) Make “notification detail level” a real setting

Secure messaging apps often offer granular controls (name only, no content, etc.). Many mainstream apps don’t. If your domain has sensitivity, consider adding:

• “show message previews” toggle,
• “hide sensitive content” mode,
• category-level notification controls.

3) Audit your high-risk templates

Pick your top 10 most-sent notifications and ask:

• Would this be OK on a shared lock screen?
• Would this be OK in a screenshot?
• Does the deep link land somewhere safe and obvious?

What to do this week (tiny wins)

• Rewrite one notification template so it contains no personal data (but still has a reason to tap).
• Add one deep link that lands on a proof screen, not the home screen.
• Ask engineering whether notification payloads are ever logged or stored in a way that increases exposure.

Category tag

Privacy & Messaging

Internal links

• Retention marketing guide: /guides/retention-marketing-guide/
• Measurement and attribution guide: /guides/measurement-and-attribution-guide/

Editor: App Store Marketing Editorial Team