Warning! Your iPhone’s Notifications Are Full of Sensitive Info—Here’s How to Make Sure It Doesn’t End Up in the Wrong Hands

Gmail. WhatsApp. Signal. Teams. Facebook. Should I go on? Between work and personal life, I use at least eight different apps to stay in touch with friends, family and colleagues, and you probably do too. To keep up with all these messages, we tend to rely on push notifications, those little pings that apps send to let you know something needs your attention.

Most of us receive dozens—sometimes even hundreds—of push notifications every day. These notifications can be useful, like when your email app pings you about a time-sensitive job offer, or they can be annoying, like when a friend won’t stop texting you about the boring dude they’re dating. But few people realize that push notifications can also be dangerous. If you allow personal info to show up in your push notifications, it could turn your smartphone or computer into a target.

Luckily, there’s a way to patch up these holes in our cybersecurity armor. To find out how to do that, I reached out to Kayne McGladrey, a cybersecurity consultant and senior member of the Institute of Electrical and Electronics Engineers, and Thorin Klosowski, senior security and privacy activist at the civil liberties nonprofit the Electronic Frontier Foundation.

Read on to learn why push notifications make you vulnerable—and how to hide your data from hackers, government agents and even the nosy pests sitting next to you on the bus.

Get Reader’s Digest’s Read Up newsletter for more tech, travel, cleaning, humor and fun facts all week long.

What kind of personal data could your phone’s push notifications include?

Most apps try to refrain from putting anything too unique or dangerous in a push notification. Your banking app won’t ever include your account number in a push notification, for example. The push notifications you need to worry about are the ones that come from messaging platforms, like the kind I mentioned earlier: text messages, emails and third-party messages from apps like WhatsApp or Slack.

Push notifications can give “a preview into people’s lives that they don’t really think about and that they don’t know they’re inadvertently disclosing,” McGladrey says. That’s because these notifications typically show the exact text of whatever message or email you’ve received. There’s no censor.

That’s not a problem when it’s just your friend texting you “LOL.” But things can get dangerous if, say, your spouse texts you their Social Security number, or a colleague emails you confidential info about work, and that info shows up on your phone’s screen loud and clear.

What’s the larger cybersecurity issue here, exactly?

Bad actors can get ahold of your private push notifications in a few different ways. Some are more complex than others, but they’re all a problem. Here’s what can happen.

Spyware can let hackers see your push notifications

Like the name implies, spyware can let outsiders see what’s happening on your device. It’s usually used to grab your usernames and passwords, but anything that appears on your screen is fair game. That includes push notifications.

In order for spyware to infect your device, you generally have to download an infected file or program. Most spyware will hide itself inside files or apps that look otherwise safe. Believe it or not, when it comes to smartphones, the most malicious spyware tends to be funded and deployed by governments, not lone hackers. China uses this sort of spyware, but so does the United States, Saudi Arabia and more. Governments use spyware to keep tabs on immigrants, journalists, whistleblowers and even human rights activists.

Apple refers to government-linked spyware as “mercenary,” and iPhones have a feature that will explicitly notify you if mercenary spyware is detected on the phone. Most Android phones keep an eye out for this too, though Google will notify you via email.

McGladrey also notes that putting spyware on someone’s phone is an emerging form of domestic abuse. “If you get into an abusive situation and they have access to your devices, [spyware can let an abuser] track their spouse’s movements and activity,” he explains. He adds that removing the spyware is especially risky in these situations, since the abuser will notice as soon as they stop receiving data.

Law enforcement can hack your smartphone

Smartphones have become the most popular way people make plans, talk to friends and store their data, and as a result, they’ve become priority targets for law-enforcement investigations. In fact, this article was inspired by one of these investigations. Earlier this year, reports surfaced that the FBI used an unspecified hacking process to pull deleted push notifications from a defendant’s iPhone. Yes, deleted notifications. The hack exploited a little-known location called the “push notification database,” which stored notifications even after the user deleted them. This let the FBI read messages the defendant had received from the encrypted messaging app Signal.

FYI, Apple has since patched that exploit and called the storing of deleted notifications a “bug.” When reached for comment, an Apple spokesperson didn’t confirm that this update removed the database entirely, but Klosowski believes it no longer stores deleted notifications. Google didn’t respond when asked whether Android devices have the same vulnerability.

In the U.S., however, law-enforcement groups still have access to Cellebrite devices, which can bypass security to copy all of your device’s data. This includes notifications and likely other messages you’ve sent as well. Lastly, border control agents in the U.S. and many other countries have the legal right to search through your phone, computer or other device when you’re entering the country.

Apple and Google see nearly every push notification you receive

When a smartphone app sends a push notification, it has to be routed through a server. That server is usually owned and operated by whoever makes your phone’s operating system: Apple if you’re using an iPhone, and Google if you’re using an Android.

Generally, no one from either company is reading this data. But both companies do retain records of when the notifications were sent, to whom and, occasionally, even what they contained. And when asked by law enforcement, both companies may give this data to investigators. It could also be vulnerable to hackers.

If you’re using a third-party smart device that can display your notifications, like the Meta Glasses, your data might be intercepted by even more companies. “It might be super helpful to have [your notifications] pop up on your glasses,” McGladrey says, “but are you OK with whoever manufactures those glasses getting access to your push notifications?”

Strangers can look over your shoulder and read your screen

OK, this one’s old-school, but it’s still a concern. Everyone’s had that moment where they see a stranger’s screen light up and instinctively glance at it. That’s especially true in crowded places like public transit or while waiting in line.

Most people know it’s rude to snoop and will look away. But others may take the opportunity to read your screen and the notifications plastered on it.

How can you turn off push notifications on an iPhone?

1. Open Settings.
2. Scroll down and tap “Notifications.”
3. To turn off all notifications, tap “Show Previews” and select “Never.”
4. To turn off notifications only for specific apps, select the app, one at a time, and do the following: Tap either “Allow Notifications” at the top of the app to turn it off, or uncheck all three “Alerts” options.

Can you also turn off push notifications on an Android?

Yes, but not all Android phones let you turn off all push notifications at once. Instead, you’ll likely need to turn them off for each app individually.

1. Open Settings, and tap “Apps.”
2. Scroll to select the app you want to disable push notifications for. You may need to tap “All apps” to see the entire list.
3. On the app’s page, tap “Notifications.”
4. Either tap the “Allow notifications” switch at the top to turn them all off, or uncheck the options below it.

Are there any other places you should turn off these notifications?

You may also want to do this on your computer. Here’s what to do for both Mac and Windows.

Mac

1. Open Settings, and click “Notifications” in the sidebar.
2. Click the “Show previews” option, and select “Never.”
3. You can also scroll down the page to disable notifications for specific programs.

Windows

1. Press the Windows key + I to open the Settings menu.
2. Click “System” in the sidebar, then “Notifications” in the menu that appears.
3. Click the “Notifications” switch at the top of the page to turn off all push notifications.
4. You can also scroll down to turn off notifications for specific programs.

Are there any other ways you should protect your push notifications?

If turning off all your notifications seems too extreme or if you want even more protection, there are a few extra steps you can take to stay safe.

• Use secure messaging apps. The best messaging apps feature “end-to-end encryption,” which means that no one besides you and your recipient can see the messages being sent—not even the company that makes the app. For text messages, encrypted apps include Signal and WhatsApp. For email, check out Proton Mail.
• Turn off message previews within your messaging apps. Signal, WhatsApp and Telegram let you turn off push-notification previews within the apps themselves. This means you’ll still receive a notification when someone messages you, but it won’t show the content of the message.
• Regularly audit and delete apps you don’t use. Every app records some amount of data about you. And the scope of that recording can change without your knowledge when the app is updated. If you have apps that you don’t use, it’s safer to delete them than keep them around for no reason. It’ll help you save storage space too.
• Turn off biometric locks. All modern phones and computers let you lock your device with a passcode, and most let you use biometrics (a facial or fingerprint scan) as well. This might be more convenient, but it’s not safer. This is because while law enforcement can’t force you to give them your passcode, the laws around biometrics are murkier. And a police officer can’t read your mind to learn your passcode, but they can hold your phone up to your face to get a scan. McGladrey notes that “the courts are generally still out” on whether this is legal, but it’s better to be safe than sorry.
• Use your device’s “lockdown mode.” Some devices, including all iPhones, have a special mode that will block message attachments, incoming calls from strangers, wired connections and more. This can help protect you from concerted spyware attacks.

Sources:

• Kayne McGladrey, CISSP, cybersecurity expert and senior member of the Institute of Electrical and Electronics Engineers; phone interview, August 2026
• Thorin Klosowski, senior security and privacy activist at the Electronic Frontier Foundation; email interview, August 2026
• Apple spokesperson; email conversation, August 2026
• The Guardian: “Spyware targets Uyghurs by ‘masquerading’ as Android apps – report”
• NPR: “ICE acknowledges it is using powerful spyware”
• The Guardian: “Saudis behind NSO spyware attack on Jamal Khashoggi’s family, leak suggests”
• Apple: “About Apple threat notifications and protecting against mercenary spyware”
• 404 Media: “FBI Extracts Suspect’s Deleted Signal Messages Saved in iPhone Notification Database”
• Apple: “About the security content of iOS 26.4.2 and iPadOS 26.4.2”
• The Intercept: “Use of Controversial Phone-Cracking Tool Is Spreading Across Federal Government”
• Washington Post: “Federal government is using data from push notifications to track contacts”

These Smartphone Apps Could Be Spying on You

How to Turn Old Phones into a Security Cameras

How to Use Your iPhone's Built-in Scanners

The post Warning! Your iPhone’s Notifications Are Full of Sensitive Info—Here’s How to Make Sure It Doesn’t End Up in the Wrong Hands appeared first on Reader's Digest.

from Reader's Digest https://ift.tt/eQRsxON