- Android RCS Archival allows businesses to archive and read RCS and SMS messages on managed corporate mobiles.
- End-to-end encryption remains active in transit, but messages are accessible on the device controlled by the company.
- It only applies to managed work phones, not personal mobiles, and does not affect apps like WhatsApp or Telegram.
- The change reignites the debate in Europe about workplace privacy and the control of digital communications.
The expansion of managed corporate phones has completely changed how we communicate at work. It's no longer just about calls and emails: companies are distributing mobile phones configured by the IT department, with their own policies, apps, and controls, so employees can handle customer service, coordinate teams, or work remotely.
In this context, instant messaging has become a key element. More and more Android users are abandoning the old SMS and MMS and switching to the RCS (Rich Communication Services) standard , integrated into Google Messages, which offers an experience very similar to WhatsApp or Telegram . But the arrival of a new feature called Android RCS Archival has raised serious concerns about the extent to which your company can read your chats on your work phone.
What is Android RCS Archival and what changes for your messages?
The RCS protocol modernizes traditional SMS messaging: it allows you to send photos, videos, long messages, typing indicators, read receipts, and create groups , all from the native Android messaging app. For years, it has been presented as the "native and secure" alternative to traditional messaging apps.
Google has been incorporating security and encryption improvements into RCS, including end-to-end encryption in many cases, which reinforced the perception that these chats were more private than a simple SMS or corporate email.
With the new Android RCS Archival feature , this landscape changes for enterprise mobile devices. On Android devices managed by the organization (especially Google Pixel and other models compatible with Android Enterprise ), the company can install an archiving application that directly accesses the messages stored on the phone . Every time you send, receive, edit, or delete an RCS message, the tool saves a timestamp copy .
End-to-end encryption remains active while the message travels between devices, so no one can intercept it in transit. The key point is on the corporate mobile device itself: upon arrival at the terminal, it is decrypted, and that's where the company, which controls the device, can read and archive the content just as it already does with email, corporate apps, or security policies.
As the company explained, this new capability “ offers employees all the benefits of RCS , such as write indicators, read receipts, and end-to-end encryption between Android devices, while ensuring their organization meets regulatory requirements.” In other words, it's presented as a compliance and auditing solution , not a mass surveillance tool, although the practical effect for employees is that chats are no longer truly private.
Only on work phones, but with a profound impact on workplace privacy
One of the points Google emphasizes most often is that Android RCS Archival only applies to company-managed devices . This means corporate phones that the IT department controls using management solutions (MDM, Android Enterprise, etc.). Your personal phone is not affected by this change , even if you use the same Google Messages app.
This means the new feature affects RCS messages and, if enabled by the company, traditional SMS and MMS messages sent or received on that work device. For highly regulated sectors—such as banking, insurance, energy, or public administration—this extends to RCS the same type of logging that already exists for corporate emails and SMS.
However, many employees still believed that text messages were "different" and that, thanks to encryption, the company couldn't see the details of what was being said in these chats. As security analysts point out, this expectation doesn't align with technical reality: encryption protects the content while it's being sent, but once decrypted on the device, anyone who controls that device can access it.
Google insists that this archiving capability is optional and intended for regulated industries , and that users will see a clear notification when it's active. Even so, the controversy is brewing, because in practice it opens the door for any organization that manages corporate phones to adopt this system , beyond just the financial or public sectors.
From the employee's perspective, the conclusion is quite clear: if you're writing from a work phone under company control, you shouldn't assume your RCS chats are confidential , even if the app displays the end-to-end encryption icon.
This is how archiving works: your messages, even if deleted, are saved.
Behind Android RCS Archival lies a relatively simple yet powerful technical model. The company installs an authorized archiving app on the phone , which has access to the local database where Google Messages are stored. Each time a relevant action occurs—sending, receiving, editing, or deleting a message—the system generates a copy that is sent to the corporate record systems.
This means that even deleting a chat or editing text doesn't erase any trace left on the organization's servers. In fact, compliance companies like CellTrust, Smarsh, and 3rd Eye have already announced compatibility with this feature, designed to help companies respond to audits, regulatory requirements, or internal investigations.
The system works based on a key principle: encryption is not broken in transit . The archiving app acts just before the message is sent encrypted or just after it arrives and is decrypted, always within the device controlled by the company . From a legal standpoint, it's very similar to what already happens with corporate email, where the organization maintains complete copies of work correspondence.
Google maintains that this is " a reliable, Android-compatible solution that allows message archiving and also works with SMS and MMS ." The company also emphasizes that, when archiving is active, the user will see a visible on-screen notification indicating that messages are being saved for compliance purposes.
The feeling this leaves for many employees is that the work phone is no longer a neutral space . Just as few people would send highly sensitive information via corporate email today, RCS messaging on a managed mobile phone effectively falls into the same category of monitored channel.
What's happening with WhatsApp, Telegram, and other messaging apps?
A recurring question following the announcement is whether this feature also allows the company to spy on the content of other messaging apps installed on the phone, such as WhatsApp, Telegram, or Signal. The answer, in principle, is clear: no. Android RCS Archival is designed for the phone's native messaging system (RCS, SMS, and MMS) and does not provide direct access to the encrypted content of external apps.
The technical difference is significant. RCS and SMS messages are integrated into the operating system and managed by Android (or iOS, in the case of Apple), so it's relatively easy for a corporate archiving app to access that data using the provided APIs.
In contrast, services like WhatsApp, Signal, and Telegram are OTT (over-the-top) platforms that control message encryption and decryption themselves. Their databases may be included in a device backup, but they are not required to be exposed to the corporate archiving system in the same way as SMS or RCS.
In fact, the change introduced by Google specifies that the scope is limited to SMS and RCS . If you use apps like WhatsApp or Telegram for private chats from a corporate mobile device, the company does not automatically gain access to the content of those messages through Android RCS Archival.
That doesn't mean there aren't other risks: many companies already discourage or even prohibit the use of unauthorized apps for professional communications , precisely because they hinder regulatory compliance and record-keeping. Paradoxically, the more "official" channels are monitored, the more tempting it can be for employees to resort to these alternative methods to talk to colleagues outside the company's control.
Privacy, law and remote work: the European context
The arrival of Android RCS Archival coincides with an intense debate in Europe about the privacy of digital communications , both in personal and professional settings. On the one hand, the General Data Protection Regulation ( GDPR ) and specific rules on communications privacy (such as the ePrivacy Directive) set clear limits; on the other, governments and regulators are calling for more tools to investigate crimes and ensure compliance in sensitive sectors.
In Spain and the rest of the European Union, access to the content of communications is only permitted with a court order , and platforms have an obligation to cooperate when legally required. In the case of end-to-end encrypted communications between individuals, even with a court order, many companies claim that they technically cannot break the encryption to deliver the message content. Court order
Meanwhile, the debate surrounding regulatory projects like those popularly known as Chat Control 1.0 and Chat Control 2.0 has focused on the extent to which platforms should be allowed—or even required—to analyze private messages for child sexual abuse material. Although these initiatives focus on personal communications and not corporate mobile devices, they share a common thread: the clash between privacy protection and security or compliance objectives.
While these regulations continue their legislative process, the deployment of tools like Android RCS Archival effectively introduces an additional layer of internal surveillance in the workplace . It's not about a public authority directly accessing your chats, but rather about the company itself, citing regulatory obligations or corporate policies, being able to review communications that many believed to be strictly private.
At a time when teleworking, hybrid models, and mobile customer service are commonplace, these kinds of changes force us to rethink where professional life ends and personal life begins when everything happens through the same device.
The message for anyone using a work mobile phone in Spain or other European countries is quite straightforward: that phone isn't yours, it belongs to the company , and any communications you have from it—including RCS chats and SMS messages—can be recorded and reviewed if there's an active archiving policy. If you don't want something to end up in an internal report, an audit, or on a corporate server, it's probably not a good idea to write it from your office phone, no matter how modern and "encrypted" the messaging system may seem.
