Privacy Is Priceless. Signal’s Bill Is $50 Million a Year.

On November 16, 2023, Signal President Meredith Whittaker and Joshua Lund published an article titled “Privacy is Priceless, but Signal is Expensive.” It did not announce a new feature or a version update. It laid out the bill.

Signal is a nonprofit. It has no investors, no profit-driven board, and no advertising system. It relies on donations. Brian Acton provided an initial loan. Small donors provide more. The goal is to fund Signal through many ordinary people, avoid a single point of failure, and keep user data out of revenue.

Nonprofit does not mean cheap. Signal operates in an industry whose rules are set by trillion-dollar companies. By 2025, it expects to need about $50 million per year. That is lean compared with many messaging apps that do not respect privacy.

As of November 2023, infrastructure costs about $14 million per year:

Storage: $1.3 million
Servers: $2.9 million
Registration verification: $6 million
Bandwidth: $2.8 million
Additional services: $700,000

Storage.
Most tech companies store whatever they can. They build data warehouses, then data lakes, and suffer breach after breach. Signal’s default is end-to-end encryption and storing as little as possible. When you send a message, the Signal service temporarily queues the encrypted message. Once delivered, the message is removed from the queue. Undelivered data is automatically purged after a period of inactivity. Signal does not know whom you communicate with, and it cannot see your address book, groups, or profile names. Even so, temporary storage costs about $1.3 million per year.

Registration.
When users download Signal, register an account, or re-register on a new device, they receive an SMS or voice verification code. This confirms that the person holding the phone number is registering, and it prevents spam accounts. Signal routes verification codes through multiple telephony providers. Traditional carriers discovered that SMS is now mainly used for app registration and two-factor authentication, so they raised prices. There is also toll fraud: some network operators split revenue with fraudsters and generate fake traffic. Signal works with providers to detect and shut down fraudulent registrations. New ones keep appearing. Registration verification costs average about $6 million per year, the largest single infrastructure item.

Bandwidth.
Every app pays for bandwidth. Large companies own their own data centers, fiber, and networking equipment, and they make money by renting them out. Signal rents infrastructure from Amazon AWS, Google Compute Engine, Microsoft Azure, and others. Bandwidth costs about $2.8 million per year. Voice and video calls are the most expensive. By default, Signal routes end-to-end encrypted calls with people who are not in your contacts through a relay server to hide IP address information. Almost none of its competitors do this by default. This increases privacy, and it also increases bandwidth. The outbound bandwidth needed to support calls is about 20 PB per year, or 20 million GB. Call-related bandwidth alone costs about $1.7 million per year. That figure does not include engineers and server costs.

People.
Signal has three client teams: Android, Desktop, and iOS. It also has Signal Server, the RingRTC calling library, and the libsignal core library. Product and design teams, along with a localization team, coordinate more than 60 languages. A full-time in-house support team communicates directly with users, because Signal does not collect analytics or telemetry. In total, about 50 full-time employees work on Signal. LINE has about 3,100 employees, and the division behind KakaoTalk has about 4,000. About half of Signal’s operating budget goes to people: recruiting, salaries, benefits, HR, and taxes, about $19 million per year. It cannot offer equity or luxurious offices, but it tries to get as close to industry wages as possible. It does not believe that doing good should require precarity.

Privacy engineering.
Signal profile photos and names are always end-to-end encrypted. Signal cannot see them. Other messengers can. Implementing this was not a weekend project. It required developing new concepts such as profile keys and testing them across platforms. GIF search is the same. Most apps integrate a standard GIF search SDK. Signal engineers built privacy-preserving technology that hides search terms from Signal’s servers and hides who is searching from the GIF search engine. Later, they further obfuscated proxied connection traffic. When Meta acquired GIPHY, many apps were scrambling to deal with the privacy implications. Signal employees had already built this correctly years earlier. More recently, Signal added post-quantum resistance to the Signal Protocol. These projects add to engineering costs.

The future.
Signal’s goal is to be open source, private, and supported by small donations. Most consumer technology costs are subsidized by surveillance, so people assume “free” is the default. A handful of companies accumulate personal data and use it to shape lives and institutions globally. Signal wants to prove another possibility: privacy at the center, and an organization accountable to users, not to investors, growth, and profit.

By 2025, Signal needs about $50 million per year. It wants to be supported by a large number of small donors. Privacy is priceless, but Signal is expensive. The bill names no payer.