Apple fixes iPhone bug that exposed deleted messages to police

Apple has released a software update for iPhones and iPads to fix a bug that allowed law enforcement to recover messages that users believed had been deleted, raising fresh concerns about digital privacy.

The issue stemmed from how notifications were handled on Apple devices. Even when messages were deleted or set to disappear automatically in apps like Signal, their contents could remain stored in the device’s notification database for up to a month. 

This meant that, under certain circumstances, authorities could retrieve those messages using forensic tools.

In a security notice, Apple acknowledged the flaw, saying that “notifications marked for deletion could be unexpectedly retained on the device.”

The problem came to light after a report by 404 Media revealed that the Federal Bureau of Investigation had been able to extract deleted Signal messages from an iPhone. 

The report said the messages had been captured via notifications and stored in the phone’s internal database even after they were erased within the app.

Following the revelations, Signal President Meredith Whittaker called on Apple to address the issue, stating that notifications for deleted messages should not persist in any operating system database.

Apple’s update resolves the bug and has also been extended to devices running older versions of its operating system, including iOS 18.

The company has not publicly explained why notification contents were stored in this way, but the fix indicates it was unintended behavior.

The incident has sparked concern among privacy advocates, particularly because disappearing messages are widely used by journalists, activists and others who rely on secure communication. 

Apps such as Signal and WhatsApp offer features that automatically delete messages after a set period, designed to protect sensitive conversations if a device is lost or seized.

Experts say the episode highlights how even small software flaws can undermine privacy tools, underscoring the importance of regular updates and transparency in how user data is handled.