Google Is Silently Linking Your Phone Number to Every Android Account
In short: In mid-October 2026, Android users widely discovered that Google Play Services automatically verifies a device's phone number and links it to every Google account signed in on that device by default — without a separate consent prompt. The mechanism runs in the background; many people only learn about it after the fact, from a "number verified" email. The feature can be switched off manually, but that doesn't undo links already created between accounts — those have to be removed one by one. For anyone keeping a personal and a work account, or several pseudonymous profiles, on the same phone, this is a direct deanonymization risk — a topic we've covered in our guide on disabling Google tracking.
What users actually found
Reports started spreading across forums and tech outlets around October 14–15, 2026: Google Play Services matches a SIM card's phone number to every Google account the user is signed into on a device — both current and future ones — without an explicit opt-in request. Add a new account on the same phone later, and the system automatically links the same number to it; swap the SIM card, and the new number gets just as quietly attached to all existing profiles.
Google frames this as necessary for sign-in, account recovery, and cross-device communication features — the number serves as a backup identity-verification channel. But users never actually consent to the linking itself: the option is on by default, and the only way to notice it firing is often accidental, such as a verification email landing on an unfamiliar account.
Why this is a privacy problem, not just an inconvenience
The core risk is cross-account correlation. If a device carries a personal, a work, and a pseudonymous Google account — say, for forums or an alternative social platform — a shared phone number technically ties all of them into a single profile, even if the accounts never overlapped by name, email, or activity. For journalists, activists, people running anonymous blogs, or simply those keeping personal and professional life apart, this erases exactly the separation those separate accounts were meant to preserve.
It also widens the advertising and analytics profile: a phone number is one of the most durable user identifiers, surviving a cookie wipe or a device change, and linking it across multiple accounts makes it easier to merge scattered data points into one record.
How to check and disable the linking
Automatic verification can be turned off in your Google Account settings: go to "Personal info" → "Phone" and disable automatic number verification for new sign-ins. The key limitation: disabling it only stops future linking. If the number is already attached to several accounts, it has to be removed manually from each profile individually through the same "Contact info" → "Phone" path.
It's also worth periodically checking the list of devices and linked numbers under your account's security settings — this is one of the rare cases where a background platform feature is noticeable only through indirect traces rather than an explicit notice.
What this means for data protection more broadly
The Google case is a specific instance of a broader pattern: large platforms merge signals — phone number, device, IP address, behavior — by default, in places where users assumed separation. A VPN can't undo a phone number link inside Google's own ecosystem — that happens at the account level, not the network level — but it closes an adjacent identification channel: it hides your real IP address and ISP from the sites and services you connect to through the LiMP VPN app. That reduces the number of independent identifiers that can be used to tie your activity across profiles, even after a phone number has already merged the accounts. See the LiMP VPN features page for a full breakdown of what a VPN protects and what remains on the user's side.