A preview to render,
your IP to the sender.

Google Messages is the app behind the chat-bubble icon on most Android phones — the texting app almost nobody picks by name, carrying your SMS and RCS chats. A link preview is a small convenience: send someone a URL and the chat shows a title, a description and a thumbnail instead of a bare address. The question that decides whether it is private is simple — who fetches the page? If a server in the middle fetches it, the link's owner sees the server. If your own phone fetches it, the link's owner sees you: your network, your device, your timing.

The same app, the same ordinary chats — on a very large number of phones. A link arrives from a saved contact, in a conversation opened once before; no one has to touch anything.

In Google Messages the preview is built on the device. The app extracts the URL, and — once the usual conditions are met — makes an ordinary HTTPS request to that address from your phone. The request does not pass through a Google proxy. That is the whole mechanism; everything else is about when it fires.

Each phone fetches the link by itself to build the preview. Nothing lights up, nothing asks. Across every conversation, the requests all arrive at one place: the server that owns the link.

Here is the honest part, and it is where the earlier version of this report overreached. The very first handler, when the message lands, often only writes a deferred placeholder and returns without any network request. The actual fetch is driven by an observer that starts when the conversation becomes interactive — when you open the chat. That observer is tied to a background scope with no visible shut-off when you leave, which is why, after a chat has been opened once, later links in it can be fetched while the screen is locked and the app sits in the background.

On the server that owns the link, the requests simply pile up: the recipient's IP address, the user-agent and timestamps a few minutes apart — lines the recipient never agreed to write.

One line is a coarse data point. The preview is stored per message, not per URL, so the same link sent again in a new message is fetched again. A sender who is a saved contact can therefore send the same link on a schedule and collect a fresh reading each time — a rough trail of which network the recipient is on, and when.

An IP address is not a street address, but over repeated messages it narrows to a city and a network, and it shows when a device comes and goes. That is the privacy cost of a preview that is fetched by the phone instead of a proxy.

This was reported to Google in March 2026. Google triaged and closed the report on 2026-03-17, as recorded in the timeline below. The behaviour described here is still present in the release installed on the test device when it was re-examined on 29 October 2026. This page states what the code and a single device test actually support — and, just as deliberately, what they do not.