Google Quietly Links Your Phone Number Across All Signed-In Accounts

An Overlooked Privacy Change

According to Android Authority, Google is quietly linking users' phone numbers across all signed-in accounts. This change isn't announced through a prominent pop-up notification—it's buried in system-level automated processes. The topic garnered 264 points and 64 comments on Hacker News, indicating that the tech community is paying close attention.

What Exactly Is Happening

Android Authority's report points out that Google is expanding its phone number verification mechanism from a single account to all signed-in accounts on the same device. In other words, if you're signed into multiple Google accounts on one Android device, a phone number bound to one account may be automatically linked to the others.

The impact of this approach: users previously assumed that identity information was isolated between different accounts, but in reality, Google has already broken down that barrier at the system level. For users who use different accounts to separate work from personal life, or who manage multiple identities on the same device, this silent linking behavior could cause unexpected privacy exposure.

Why This Deserves Caution

Phone numbers are strong identity markers. Once a phone number is linked across multiple Google accounts, it means Google can more easily build cross-account user profiles. These profiles not only include your search history, YouTube viewing history, and Gmail contacts, but may also connect your behavior across different accounts through the phone number as an anchor point.

The discussion on Hacker News (64 comments) reflects several typical concerns: first, whether users have the right to know about and opt out of this linking; second, whether this practice violates data protection regulations in various regions; third, if one account is compromised, whether the linked phone number could become a springboard for attackers to breach other accounts.

Cross-account user profiling is one of the core capabilities of data-driven platforms. Its basic logic is: when the same person generates behavioral data across different accounts, if the platform can find a common identifier (such as a phone number, device ID, or browser fingerprint) to connect these accounts, it can build a more complete and precise user profile than a single account allows.

The value of this profiling lies in improving ad targeting precision and recommendation system effectiveness, but the cost is that users' identity isolation is broken. For example, a user might search for sensitive health information with one account and handle work emails with another—once a phone number links the two, these behaviors fall into the same profile. At the regulatory level, laws like GDPR require platforms to have a legal basis when linking user data across accounts, and to guarantee users' right to be informed and right to object. This is also a key reason why this incident has raised compliance questions.

Relationship to Google's Existing Privacy Strategy

In recent years, Google has been pushing toward "account unification"—from the early Google+ real-name mandate, to later cross-service data integration, to now automatic phone number linking. Each step has been accompanied by user concerns about privacy boundaries.

What's different this time is the word "silently." Android Authority's headline directly used "silently linking," indicating that this association was not accompanied by a clear user consent process. For privacy-conscious users, this is more unsettling than the feature itself.

Silent linking in privacy discussions specifically refers to a platform merging previously separate identity markers or data records without clearly informing users or obtaining their active consent. It contrasts with the "opt-in" model—the latter requires users to actively authorize, while silent linking is enabled by default and users often only discover it after the fact.

This practice is technically feasible because operating system-level services (such as account managers and device authentication frameworks) inherently hold underlying cross-account access permissions without needing to go through the application-layer user interface. This is precisely why Android Authority characterizes this behavior as "silent," suggesting it bypasses conventional privacy authorization processes. For privacy-conscious users, the lack of informed consent is more controversial than the feature itself.

What Users Can Do

Currently, the report does not provide an official opt-out mechanism. Judging from the tech community's reaction, users are advised to regularly check their Google account privacy settings, particularly options related to "Personal Info" and "Security." If you're signed into multiple accounts on your device, consider reducing the number of simultaneously signed-in accounts, or using different devices to isolate different identities.

This incident also reminds us: in the mobile operating system ecosystem, isolation between accounts may be merely superficial. Underlying system services have the ability to break down these barriers without users' knowledge.

Industry Perspective

The proliferation of phone numbers as an identity verification method itself brings the risk of privacy centralization. When the same phone number can unlock multiple accounts, its security weight becomes extremely high. Google's silent linking this time is effectively reinforcing the phone number's role as a "master key"—good for convenience, but a double-edged sword for privacy and security.

The 264 points and 64 comments on Hacker News show that this is not a niche topic. In the era of AI and big data, the ability to link identity markers directly determines how well platforms understand their users. Google choosing to push this silently may be because it knows that if it publicly solicited feedback on this association, it would likely face strong opposition.

Phone numbers as identity anchors carry the risk of being irreplaceable and unchangeable. Unlike email addresses or usernames, phone numbers are typically tied to real-name carrier registration, have high switching costs, and are used as the sole means of account recovery and two-factor verification in many scenarios. Once a phone number becomes a common linking point for multiple accounts, it becomes a single point of failure: an attacker only needs to control this one identifier to potentially take over all linked accounts through the "forgot password" process.

This is also why the security community has long advocated "don't use phone numbers as the sole verification factor." The design intent of multi-factor authentication (MFA) is precisely to prevent a single identifier from bearing excessive security weight, while cross-account phone number linking is doing the exact opposite—reinforcing this centralization.

One-line Summary

Google was found silently linking phone numbers across all Google accounts on the same device, raising privacy concerns.

Paragraph Summary

According to Android Authority, Google is silently linking users' phone numbers across all signed-in Google accounts on the same Android device. This change comes without prominent user notification or consent—it's hidden in system-level automated mechanisms. As a strong identity marker, cross-account phone number linking means Google can more easily build cross-account user profiles, connecting behavioral data from Search, YouTube, Gmail, and other services. The topic received 264 points and 64 comments on Hacker News, reflecting the tech community's concentrated concerns about informed consent, opt-out mechanisms, compliance, and cascading account security risks. The report currently offers no official opt-out solution, and users are advised to check privacy settings or reduce simultaneous multi-account sign-ins.