Yet another Hacker News

Google is silently linking your phone number across all signed-in accounts

183 points Brajeshwar 3 hours ago 42 comments

maxo133 2 hours ago | parent

Google is probably the most aggressive anti-privacy big tech company currently operating.

No other big-tech company goes to such great lengths to deanonymize users and make its services difficult to use, especially during account creation.

The requirement to have a mobile device to scan a QR code to verify that you're human. Reverse SMS verification, where you have to send an SMS rather than receive a verification code. You think of signing up using a VPN server in another country? The phone number you use to send the SMS from must also be from that country.

Not being able to watch YouTube videos when using VPN - without signing in to a Google account, all under the guise of "bot protection."

Gemini not working in 3/4 of cases when using VPN.

It's essentially almost impossible to create a Google account without giving up your identity, and your phone number often leads directly to your real-life identity.

I'm not sure what happened in recent years, but they definitely switched their strategy to maximize data collection and make sure privacy-savy users are pressured via technical solutions to reveal their identities.

PS. The first company federal investigators often go for data is often Google

fred_is_fred 1 hour ago | parent

More data = better ad sales.

baggachipz 1 hour ago | parent

line go up

burningChrome 1 hour ago | parent

Trying to fight it takes an enormous amount of time and energy. I carry two phones now - since I have my "privacy" enabled phone that basically has nothing on it. Email, messages, weather app and a few privacy enabled browsers. My other phone has all my "faux" google stuff on it. Maps, gmail, banking apps, my authenticator apps, music apps, etc.

Even then, these can all be tied together fairly easy, but just trying to make it harder to keep my data private is such a battle; and friends always ask me why I spend so much time trying to keep myself anonymous when in 2026 its virtually impossible to do so.

I always tell them: “Bene vixit, bene qui latuit.” (To live well is to live concealed.)

Waterluvian 1 hour ago | parent

This all sounds completely sensible. And yet, being caught by the police with two phones would probably be a big stupid red flag for them.

mixdup 1 hour ago | parent

Having two phones is more common than you think, and has a very plausible explanation even if it's not true for the particular individual: One is my work phone, issued by my company, other one is mine

That happens all the time

noah_buddy 19 minutes ago | parent

Unless you’re clever about setting up the phones to match your excuse, you are now lying to the police as well.

SllX 7 minutes ago | parent

Follow the usernames in the response chain. I have two phones for the exact same reason as well: work issued & personal. It would hold up just because it’s actually true. There’s no need to arrange anything beyond how they are naturally arranged.

ProblemExplorer 1 hour ago | parent

> I'm not sure what happened in recent years, but they definitely switched their strategy to maximize data collection and make sure privacy-savy users are pressured via technical solutions to reveal their identities.

Every scammer, fraudster, scammer-in-training, fraudster-in-training, uses a Google account.

The first company federal investigators often go for data is often Google because that's the start of their lead into their investigation. Google needs to provide answers, sometimes by regulation in countries.

ninininino 1 hour ago | parent

Have you noticed the front page article sharing front page real estate with this one about Big Tech getting in trouble for not doing more to stop scamming and fraudsters?

https://www.theguardian.com/us-news/2026/oct/14/dating-app-s...

Regulators want Big Tech to stop children from doing various things (such as access certain platforms or content), to stop fraudsters and scammers, to stop foreign intelligence operations or bots from astroturfing social media/manipulating social discourse, and so on.

Failing to so leads to inquiries, new laws or regulations, fines, and so on.

The technical solutions to combat these problems are the exact solutions that also ruin privacy for users, create friction at account creation time, require ever more draconian identity verification methods and so on. It's 1:1.

"I'm not sure what happened in recent years, but they definitely switched their strategy to maximize data collection and make sure privacy-savy users are pressured via technical solutions to reveal their identities."

It's really not any more complicated than that Governments have told them its time to start violating users privacy in order to combat these other problems.

bsammon 1 hour ago | parent

> It's essentially almost impossible to create a Google account without giving up your identity, and your phone number often leads directly to your real-life identity.

A process I've gone through a few times (though I didn't actually want a Google Account):

1) Get a new (second-hand sometimes) ChromeOS or Android device.

2) (if necessary) do a power-wash or factory-reset.

3) Do the "set up a new device" process.

4) When it asks you for a Google account, click on the "I don't have one. create a new account" button.

In all these cases, the device didn't (or couldn't, in the case of the Chromebook) have a SIMcard in it, so it couldn't link it to a phone number.

One smartphone that I bought for $20, and never (IIRC) had a SIMCard in, I think the only identity-oriented app I have on it is Netflix. I've wondered if Google links the smartphone's google account to the Netflix account (which is actually not me, but a cousin's), and whether Netflix is complicit in this linking.

BizarroLand 1 hour ago | parent

I imagine that Google is keeping a log of the ip addresses that phone reports when it's connected to wifi. I There's probably some overlay between you and your known associates / locations.

xnickb 24 minutes ago | parent

Even if they don't, the law enforcement definitely does (or rather requires your ISP to).

So depending on who you are trying to protect against you are in for varying amounts of fun.

jstanley 1 hour ago | parent

> The requirement to have a mobile device to scan a QR code to verify that you're human.

FWIW I've never seen this.

rwmj 1 hour ago | parent

It's required for setting up a new Youtube account now.

foresto 21 minutes ago | parent

> It's essentially almost impossible to create a Google account without giving up your identity, and your phone number often leads directly to your real-life identity.

I had a Gmail account before they required phone numbers. One day, Google stopped allowing me to log in, demanding my phone number if I wanted to continue. Nothing was wrong with my credentials, or behavior patterns, or IP address, or anything at all. My already-registered recovery email address didn't help. There was no way to appeal.

I'm not willing to have my phone number extorted from me, so I sighed and accepted that I'll never again have use of that account. It remains a constant source of irritation, because it still forwards incoming messages to my home email address, and Google doesn't do a very good job of filtering out all the spam before they forward it my way.

Adding insult to injury, Google still (years later) hasn't made good on their announcement that idle accounts would be deleted. I wish they would. I'm done with Google.

shevy-java 8 minutes ago | parent

> No other big-tech company goes to such great lengths to deanonymize users and make its services difficult to use, especially during account creation

Dunno. Facebook is pretty ruthless and evil here as well.

_s_a_m_ 6 minutes ago | parent

> Google is probably the most aggressive anti-privacy big tech company currently operating

isnt that their only business model almost from day 1? Everyone shitting on Meta because of privacy but Google's the worst.

happymellon 3 minutes ago | parent

Gemini doesn't work 10/10 times for me.

Recently its taken over and I can't switch back to Assistant on Android. Now I have timers that run for a bit and then disappear, and whenever I'm driving and use voice to call it brings up the phone number and requires me to press again to dial.

Absolutely frustrating and I don't understand how this can be pushed as the default.

I can only assume its another scenario where they disable all the features because I'm not in the US, but then never tested it.

axus 1 minute ago | parent

Meta is worse, but easier to ignore.

hoppyhoppy2 2 hours ago | parent

I think it's creepy and bad, but "silently" is not accurate, at least in my case: Google sent each of my accounts an email telling me about it.

tgv 2 hours ago | parent

That's mighty generous of them. Does the mail contain an opt-out link?

jamiesonbecker 2 hours ago | parent

Very unexpected behavior, esp for those with several accounts and phone numbers, intending to keep them separate for security or other reasons.

weezing 1 hour ago | parent

People who want security don't use multiple google accounts tho.

Scaled 2 hours ago | parent

This is an outrageous privacy invasion and if it's not illegal already, it should be.

toomuchtodo 2 hours ago | parent

Report to your state's privacy department (if applicable) and your Attorney General. No guarantees, but once it's in regulator hands, you can let them run with it.

https://www.naag.org/find-my-ag/

rdtsc 1 hour ago | parent

That's why I stay away from trying Gemini or doing anything much with Google until I still host my main gmail account there. One misstep and I'll find myself locked out. Because it's Google's job to spy on everyone, if I have other accounts there, those will also locked out too ("oh! you're trying to circumvent our ban? we noticed!" kind of a thing). Then the only recourse from what I understand is to make an HN post and hope it makes it to the front page and someone from Google who knows someone else at Google will help you.

exabrial 1 hour ago | parent

Our corporate policy doesn't allow personal phones to be linked to corp accounts, for obvious reasons. We have no idea what kind of security your personal phone number has setup, nor do we compensate employees for their personal phones, nor do we want corporate communications happening on your personal device (work/life separation).

If the vendor is unable to comply, all we're using them for is email. Time to look elsewhere.

Havoc 1 hour ago | parent

Yay surveillance state pushed by ad tech!

chneu 1 hour ago | parent

Um, I think you mean convenience at the cost of privacy, which most people have no problem with, unfortunately.

Think of how nice this will be for all the people who don't care and have given up! So convenient.

anygivnthursday 1 hour ago | parent

Is it silent, though? I got notifactions about it on my devices, then emails on each account. Then I went straight to delete the added numbers and disabled this "feature". It did not leave a good taste that I had to do this after the fact, I would have appreciated a notice with a chance to opt out first, because they may have already permanently stored those numbers in some internal history (I just asked Dropbox for my data and they listed every single email I've ever used on that account too). But, to be honest, I am not surprised, and I already consider all devices and numbers that ever come into contact with a Google account being permanently on record on some Google server.

jeffbee 1 hour ago | parent

"Silently" has been redefined to mean "we know this because of the emails it sends".

nullc 1 hour ago | parent

fuck. keeping your phone number off accounts is an important security step as many attacks require that you have a phone number connected.

If it's ever been on there you cant trust that some long forgotten recovery pathway can't be convinced to use it to authenticate access to your account.

GrumpyGoblin 58 minutes ago | parent

No shit

jabroni_salad 57 minutes ago | parent

I don't think this is new. If you have ever gotten a "fuck off and die" letter from AdSense after like 2010 or so, then you know they will correlate your identity and ban your other accounts too. They don't ban accounts, they ban people.

I've also heard of people getting oopsied trying to farm the GCP demo credits and someone on HN once claimed that a company's gsuite tenant was actioned when they hired somebody on google's naughty list.

barrkel 53 minutes ago | parent

This isn't the behavior I observe on my phone.

All my SIMs I've used in my phone seem to have been added as verified phone numbers to my primary account, but my secondary accounts don't have any phone numbers still.

It's still somewhat obnoxious since it means random travel sims that could get reused after they expire are "verified" for my account.

plorg 52 minutes ago | parent

Just the other day I tried to log into the Google account I have connected only to this HN account, and Google asked me to use the account linked to the backup email address on that account to verify my login, then logged me into that account on my phone when I used it to verify my login. After that point I saw my phone number attached to the HN-specific Gmail account, though it may have been attached before.

declan_roberts 42 minutes ago | parent

It really bothers me that every dick and jane website has normalized asking for your personal phone number. It's the first thing they ask when you sign up. At this point your phone number has become your social security number of the internet.

I don't care if fighting fraud is hard for you. Figure it out without stripping away my privacy.

nateweber 30 minutes ago | parent

More companies have my phone number than not..

PerilousD 24 minutes ago | parent

Its taking me awhile (about a month so far) but Im migrating my Google Pixel 5A to Google Pixel 10 Pro and GraphenOS. Its a step but seriously worth it to avoid the Google stink. RFC messaging is the only real breakage Ive seen so far in that folks that have me in a group msg dont work any more (actually that COULD work as a feature and so far everyone Ive talked to that swear they sent a msg are iPhone users so it could be another Google-Apple pissing contest underway.

SoftTalker 24 minutes ago | parent

The biggest player in ad tech also being the biggest provider of mobile phone operating systems and web browser and web search and email services was only ever going to end up this way. I'm not a big fan of regulation but at some point a single corporate entity should not be allowed to control all of the things.

shevy-java 9 minutes ago | parent

Daily Evil by Google.

Anyone still having doubts about this company? To be fair: the US corporations all do that. I remember how Facebook linked off-connection data together. They are all operating in the same manner here, sustaining US spy interests.