After researchers raised data privacy concerns, Clubhouse says it is taking steps “to prevent Clubhouse clients from ever transmitting pings to Chinese servers”

The audio chat app “Clubhouse” went viral among Chinese-speaking audiences. Stanford Internet Observatory examines …

Stanford Internet Observatory 2021-02-14

Context & Ripple Effects

Clubhouse’s privacy response follows a brief period in which Chinese-speaking users treated the app as a venue for cross-border conversation, reflected in its rapid uptake among mainland China users, before the service was blocked in China. The routing issue therefore matters not only as a technical finding but as a trust test around a politically sensitive user base.

Related coverage later reports audio and metadata appearing on a third-party website, indicating that Clubhouse’s security scrutiny extended beyond the reported client-to-server pings.

First-order effects

Clubhouse must change the client behavior implicated by the researchers’ concerns, aiming to stop the affected network requests from reaching Chinese servers.
Users and researchers gain a concrete, testable privacy commitment from Clubhouse rather than a general assurance about its data handling.

Second-order effects

Clubhouse’s later security safeguards put pressure on the company to treat network routing, audio, and metadata exposure as connected parts of one security posture rather than isolated incidents.
For users who joined during the app’s China-accessible window, confidence in Clubhouse becomes tied to whether its stated technical controls can be independently verified.

Third-order effects

Cross-border social services are being pushed to make data-routing architecture part of their trust model, particularly when access controls and user communities span conflicting national boundaries.
If this pattern persists, security scrutiny of communication platforms will increasingly focus on observable client and infrastructure behavior, not only on stated privacy policies.

The trend: Privacy governance for cross-border communication apps is shifting toward verifiable controls over where client data is sent and how platform metadata is secured.

Discussion

@elegant_wallaby David Thiel on x
New piece from @stanfordio regarding @joinClubhouse, @AgoraIO and user privacy. This has potentially serious implications for government-targeted users, particularly in China and Hong Kong. 🧵⤵️ https://cyber.fsi.stanford.edu/ ...
@mattyglesias Matthew Yglesias on x
Not going to dignify this with a link, but the difference between Clubhouse and something like Facebook is that **nothing** can “spread unchecked” on Clubhouse because it's live audio to people who opted-in to the room with no algorithmic promotion to anyone. https://twitter.com/…
@willoremus Will Oremus on x
Clubhouse's privacy issues may run much deeper. A new report from @stanfordio finds “easy to uncover” flaws in data handling that “pose immediate security risks to Clubhouse's millions of users, particularly those in China.” https://cyber.fsi.stanford.edu/ ...
@elenacryst Elena Cryst on x
🗞️📰 EXTRA EXTRA READ ALL ABOUT IT!!! Fascinating work combining our team's incredibly deep security expertise with our breadth of global perspectives. Can't believe I'm this energized to be working late on a Friday night! kudos @stanfordio team! https://twitter.com/...
@kentbye Kent Bye VoicesOfVR on x
Just heard @alexstamos announce this @stanfordio report digging into how @joinClubhouse is using a Chinese servers & is sending username & channel info in plaintext that's easy to intercept & extrapolate metadata on who is talking to who. https://twitter.com/...
@thatclarafied Clara on x
This happened to me yesterday. A creep I went on a date with once in London 3 years ago followed me on Clubhouse. He's already been blocked for doing the same on every other platform. I was livid when I discovered he could find me on CH. https://twitter.com/...
@stanfordio @stanfordio on x
📢 New work out today from our Tech team & China research team: @joinClubhouse app recently became popular in 🇨🇳. We looked at its data security practices & found a potential risk to mainland Chinese users. 🔗 https://cyber.fsi.stanford.edu/ ... Here are our key findings 👋🧵⤵️ (1/8)
@taylorlorenz Taylor Lorenz on x
“What if you didn't give Clubhouse access to your contacts, specifically because you didn't want all or any of them to know you were there? I regret to inform you that Clubhouse has made it possible for them to know anyway & encourages them to follow you.” https://www.vox.com/...
@roxannetaylor Roxanne Taylor on x
I am enjoying Clubhouse but sorry to see the challenges Black doctors are having as the Work Overtime to Combat Clubhouse Covid Myths - Bloomberg https://www.bloomberg.com/...
@munkeatlooi Mun-Keat Looi on x
Was wondering when a covid Clubhouse story would arrive, but this is great. https://www.bloomberg.com/...
@williamturton William Turton on x
Dozens of Black doctors have taken it upon themselves to dispel Coronavirus misinformation on Clubhouse. Some have been harassed and bullied for doing so: https://www.bloomberg.com/...
@jeremyburge Jeremy Burge on x
I loathe this prompt on Clubhouse and just about any modern social app. A casual tap to share every private contact you know about everyone. There has to be a better way https://onezero.medium.com/... https://twitter.com/...
@tfoil2 @tfoil2 on x
DON'T ALLOW “Granting an app access to your contacts is ethically dicey... Some social networks even use this sort of info to start building secret dossiers on people who don't use the app... At least 2 additional ways Clubhouse appears to take users' contact data further...” htt…
@kantrowitz Alex Kantrowitz on x
Clubhouse invites going for $125 on eBay https://twitter.com/...
@willoremus Will Oremus on x
I asked Clubhouse exactly what data it collects on your contacts, how it uses that data, what data it's storing on people who aren't even on Clubhouse (like your weed dealer who it somehow knows has 83 friends on Clubhouse). The company did not respond. https://onezero.medium.com…
@karissabe Karissa Bell on x
One of the first things I noticed when I joined Clubhouse was that my “contact” with the most connections was... an old doctors office I haven't visited in 10+ years. Still felt weird about it and this sums up why https://onezero.medium.com/...
@mattyglesias Matthew Yglesias on x
@OsitaNwanevu Well, yes, if you want to say that Clubhouse replicates the basic flaws of human existence that's fine. But I think Twitter and especially Facebook pose a unique kind of danger in terms of the ultra-rapid diffusion of crazy ideas & hate speech.
@jilliancyork Jillian C. York on x
Here's an idea: How about Clubhouse/Andreesen Horowitz pays these doctors to dispel misinfo? https://twitter.com/...
@phil_lewis_ Philip Lewis on x
Dozens of Black doctors and medical professionals have taken it upon themselves to combat the myths and misinformation about COVID-19 on Clubhouse “I do my [12 to 14 hour] shift, wash my face, change my clothes and then get on the app.” https://www.bloomberg.com/...
@williamturton William Turton on x
We asked Clubhouse what it is doing to prevent the spread of harmful Coronavirus misinformation on its platform. The company declined to comment. https://www.bloomberg.com/...
@stanfordio @stanfordio on x
(2) .@joinClubhouse user IDs (not their username — more like a unique serial number) are transmitted in plaintext over the internet, making them trivial to intercept. Chatroom IDs (again, more like serial number) also transmitted in plaintext. (3/8) https://twitter.com/...
@edmundlee Edmund Lee on x
.@joinClubhouse has a lot of celebs, execs and, of course, VCs, on all the time. The talk is often frank, making it a compelling platform. BUT ... China apparently has FULL ACCESS to user IDs and raw audio. @stanfordio has compelling evidence: https://cyber.fsi.stanford.edu/ ...
@ccp_china_watch @ccp_china_watch on x
Shanghai-based Agora supplies back-end infrastructure to the Clubhouse App. Agora would likely have access to users' raw audio, potentially providing access to the Chinese government. 1/2 via @Byron_Wan https://cyber.fsi.stanford.edu/ ...
@yaqiu @yaqiu on x
Clubhouse - or Silicon Valley broadly - is either willfully ignorant of data protection risks pertaining to any entities in China or doesn't care enough to think this is a problem. The US needs better laws to force companies to care about user privacy. https://cyber.fsi.stanford.…
@wongmjane Jane Manchun Wong on x
This is the exact reason why I am reluctant to release any product that touches on Clubhouse's private API related to audio data, or the approach https://cyber.fsi.stanford.edu/ ...
@andreaslandwehr Andreas Landwehr on x
The Stanford Internet Observatory has confirmed that Agora, a Shanghai-based provider of real-time engagement software, supplies back-end infrastructure to the #Clubhouse App https://cyber.fsi.stanford.edu/ ...
@hkanji Hussein Kanji on x
In this blog post, we investigate the possibility of Chinese government access to Clubhouse audio, both via Agora and Clubhouse app itself https://cyber.fsi.stanford.edu/ ...
@melissakchan Melissa Chan on x
I'm shocked a Silicon Valley startup didn't think through its security and thought working with a Chinese company would not bring scrutiny. It took an outside org, @stanfordio, to confirm Clubhouse's relationship with Agora, and more in this 👀 report: https://cyber.fsi.stanford.e…
@melissakchan Melissa Chan on x
One point of clarification in this fantastic @stanfordio report is that it was Clubhouse's decision not to have it on the app store in China. Was wondering about that. But why did it take an outside org to get Clubhouse to take extra security measures? https://cyber.fsi.stanford.…
@bobbyallyn Bobby Allyn on x
“In at least one instance, [Stanford researchers] observed [Clubhouse] room metadata being relayed to servers we believe to be hosted in the PRC, and audio to servers managed by Chinese entities and distributed around the world” https://cyber.fsi.stanford.edu/ ...

Chronicles