Unidentified governments are surveilling smartphone users via their apps’ push notifications, a US senator warned on Wednesday.

In a letter to the US department of justice, the senator, Ron Wyden, said foreign officials were demanding the data from Google and Apple. Although details are sparse, the letter lays out yet another path by which governments can track smartphones.

Apps of all kinds rely on push notifications to alert smartphone users to incoming messages, breaking news and other updates. What users often do not realise is that almost all such notifications travel over Google and Apple’s servers.

That gives the two companies unique insight into the traffic flowing from those apps to their users, and in turn puts them “in a unique position to facilitate government surveillance of how users are using particular apps”, Wyden said. He asked the department of justice to “repeal or modify any policies” that hindered public discussions of push notification spying.

In a statement, Apple said that Wyden’s letter gave them the opening they needed to share more details with the public about how governments monitored push notifications.

“In this case, the federal government prohibited us from sharing any information,” the company said in a statement. “Now that this method has become public, we are updating our transparency reporting to detail these kinds of requests.”

The department of justice did not return messages seeking comment on the push notification surveillance or whether it had prevented Apple of Google from talking about it. Google did not return messages seeking comment.

Metadata

Wyden’s letter cited a “tip” as the source of the information about the surveillance. His staff did not elaborate on the tip, but a source familiar with the matter confirmed that both foreign and US government agencies have been asking Apple and Google for metadata related to push notifications to, for example, help tie anonymous users of messaging apps to specific Apple or Google accounts.

The source declined to identify the foreign governments involved in making the requests but described them as democracies allied to the US.

The source said they did not know how long such information had been gathered in that way.

Read: Israel announces state inquiry into spyware scandal

Most users give push notifications little thought, but they have occasionally attracted attention from technologists because of the difficulty of deploying them without sending data to Google or Apple.

Earlier this year, French developer David Libeau said users and developers were often unaware of how their apps emitted data to the US tech giants via push notifications, calling them “a privacy nightmare”. — Raphael Satter, (c) 2023 Reuters