Google Quietly Links Phone Numbers to All Secondary Android Accounts, Raising Significant Privacy Concerns

The discovery of this feature has led to a flurry of activity within the Android community, with users sharing their experiences and attempting to decode the logic behind the rollout. Many expressed frustration that a change with such significant privacy implications was implemented quietly, rather than through a clear, transparent notification that allowed users to choose whether or not to participate. The "self-verification" label itself has become a point of contention, as it implies the system is acting on its own behalf rather than on behalf of the user’s explicit wishes.

For those who wish to regain control over their information, there is a path to disable the feature, though it requires navigating through several layers of the Android settings menu. Users can typically find the toggle by navigating to the "Google" section within their system settings, selecting "All services," and then locating "Phone number verification." From there, the option to "Verify phone numbers automatically" can be disabled. However, the community has noted that the specific labels and paths for these menus can vary depending on the device manufacturer and the version of the Android "skin" being used, such as Samsung’s One UI or Google’s own Pixel UI.

Perhaps more concerning are reports from some users stating that the "Verify phone numbers automatically" setting has a tendency to re-enable itself. While it is unclear if this is due to system updates, Google Play Services refreshes, or specific app triggers, the prospect of a "zombie setting" that refuses to stay off adds an extra layer of maintenance for privacy-conscious individuals. This necessitates a level of "babysitting" that many users find unreasonable for a modern operating system.

It is also important to note that simply toggling the setting to "off" does not retroactively undo the links that have already been created. If a phone number has already been verified and attached to a secondary account, the user must manually intervene to remove it. This process involves visiting the "Personal Info" section of the specific Google Account via a web browser or the Google app, navigating to "Contact info," selecting "Phone," and then deleting the number from the profile. For a user with multiple accounts, this can be a tedious and time-consuming process, further highlighting the friction introduced by the initial automated action.

Google has defended the practice as a move toward practical efficiency. In an era where digital security is paramount, the company argues that having verified recovery methods and ensuring the seamless operation of communication tools like RCS is in the best interest of the user. From Google’s perspective, the automation of these processes removes the burden of manual setup and ensures that critical safety and communication features are always ready when needed.