Google Play Services now auto-links phone numbers to all accounts on Android, raising privacy concerns

Google Play Services has introduced a default behaviour that automatically verifies phone numbers and links them to every Google account signed in on an Android device. According to TechRadar, this change impacts users who maintain multiple accounts, such as work or secondary profiles, by attaching their primary contact details to all of them. Cyber Security News notes that Google’s documentation confirms this applies to both existing accounts and those added later.

Root cause

The issue stems from a change in the default configuration of the Phone number verification feature within Android settings. Previously an opt-in function, it now activates automatically. According to Cyber Security News, Google updated its support documentation between August and October 2025 to reflect this default status, though an exact rollout date remains unconfirmed. The system links numbers to facilitate account sign-in, recovery, and emergency services, as stated in Google's support documentation.

Attack path

This is not a security breach or exploit, but a data aggregation mechanism. According to Cyber Security News, the system links numbers to facilitate account sign-in, recovery, and emergency services. However, for users keeping identities separate, this creates an unwanted correlation within Google’s systems. TechRadar reports that some users find the verification toggle re-enabling itself, suggesting the software may revert to the default state rather than allowing persistent user override.

Affected versions

• Android devices running Google Play Services with the default settings enabled.
• Devices running GrapheneOS if Google Play Services are installed, according to TechRadar.
• Any Android configuration where multiple Google accounts are signed in simultaneously.

Mitigation

• Navigate to Settings, then Google, and select All services.
• Locate Phone number verification and disable the ‘Verify phone numbers automatically’ toggle.
• Manually remove linked phone numbers from individual account profiles via the Personal info page.
• Monitor the toggle status, as users report it may revert to enabled automatically.

What it means for organisations

Teams managing corporate devices must assess whether this default behaviour compromises the separation between personal and professional identities. Organisations should verify if their Mobile Device Management policies can enforce the disabling of automatic verification. Security leads need to determine if linked phone numbers create false positives in identity monitoring or increase the risk of account takeover via shared recovery methods. Internal communications should clarify whether employees should use personal devices for work accounts given this data aggregation.

What to do and how to stay safe: Google

• Check the Phone number verification setting in your Google services menu and disable automatic toggles.
• Review each signed-in account’s contact information and remove phone numbers from non-primary profiles.
• Monitor your account activity for unexpected verification emails or changes to recovery details.
• Once the vendor provides an update or policy clarification, adjust your device configuration accordingly.

General security guidance from the TechSec Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Does this make my phone number public?

No, according to Cyber Security News, the documentation does not state that the number becomes publicly visible to everyone.

Can I stop this from happening?

Yes, you can disable the automatic verification toggle in settings, though some users report it re-enables itself.

Does this affect privacy-focused Android versions?

TechRadar reports that users on GrapheneOS have experienced the issue if they have installed Google Play Services.