What happened
The EFF warns that cloud‑based trusted execution environments (TEEs) do not provide the same privacy guarantees as end‑to‑end encryption. When AI features offload message data to TEEs, the content leaves the device and is exposed to unencrypted third‑party servers. Users and developers should avoid automatic data transfers to TEEs to preserve privacy.
Why it matters for trust and compliance
- Its status is published. It is enacted but may not be in force yet. Check the effective date before planning around it.
- The article highlights that relying on TEEs for AI processing undermines the privacy of secure messaging, urging user control and developer restraint.
Who is affected
technology controller processor developer platform Signal WhatsApp Apple Google
Recommended actions
- Check that privacy notices describe the practices this addresses.
- Revisit retention schedules and data minimisation for the data involved.
- Map the security requirements to existing controls and close gaps.
- Inventory AI or automated decision systems in scope and their assessments.