After researchers raised data privacy concerns, Clubhouse says it is taking steps “to prevent Clubhouse clients from ever transmitting pings to Chinese servers”
what it is and how to get an invite Charlesarthur / The Overspill : Start Up No.1485: what “accept cookies” really means, why surfaces don't spread Covid, a Facebook smartwatch?, and more Jitendra Soni / TechRadar : Clubhouse rushes to fix security flaws possibly giving government access to unfiltered data Jody Serrano / Gizmodo : Clubhouse Will Strengthen Security After Researchers Find That Data Could Be Accessed by the Chinese Government Stephen E. Arnold / Beyond Search : Data Security: Clubhouse Security and Data Integrity Excitement? EditorDavid / Slashdot : After Researchers Raise Spying Concerns, Clubhouse Promises Blocks on Transmitting to Chinese Servers Jon Fingas / Engadget : Clubhouse is tightening security to address China spying fears Sanuj Bhatia / iPhone Hacks : Clubhouse Tightens Security Measures After Potential Backdoor to China Discovered Adam Rosenberg / Mashable : Clubhouse will issue security update over Chinese data-sharing concerns Malcolm Owen / AppleInsider : Clubhouse upgrades security over fears China could spy on users Daniel / Apple Terminal : Stanford researchers point out Clubhouse data may be accessed by the China government Kevin Shalvey / Insider : Clubhouse says it will review its policies after Stanford warned that data may be accessible to China's government Tweets: @stanfordio : (2) .@joinClubhouse user IDs (not their username — more like a unique serial number) are transmitted in plaintext over the internet, making them trivial to intercept. Chatroom IDs (again, more like serial number) also transmitted in plaintext. (3/8) https://twitter.com/... @stratechery : Clubhouse's Inevitability Clubhouse will do for audio what Twitter, Instagram Stories, and TikTok did for text, images, and video. https://stratechery.com/... Daniele Lepido / @danielelepido : “Clubhouse's core software relies on an old version of Agora's voice library,” told me @phretor, a senior researcher at Trend Micro. https://www.bloomberg.com/.... Vib / @ivibz : Clubhouse might just be creating the biggest audio dataset for deep fakes. IMHO https://twitter.com/... @business : Clubhouse, the popular app that allows people to create digital discussion groups, is reviewing its data security practices because of eavesdropping fears https://www.bloomberg.com/... @noahreservation : See this is why I only talk about hot sauce and Korean bbq on clubhouse https://twitter.com/... Hindustan / @httech : Looks like Clubhouse needs to check if their systems are ‘sound’! @joinClubhouse https://tech.hindustantimes.com/ ... OneZero / @ozm : There's no such thing as an apolitical social network because the personal is political, writes @WillOremus. https://onezero.medium.com/... Damon Beres / @dlberes : “What most of us really want from Facebook and other platforms, I suspect, is not “less politics” but less hate speech, less misinformation, less algorithmic bias toward shock and outrage and tribalism—in short, less of a distortionary effect on politics” https://onezero.medium.com/... Will Oremus / @willoremus : I wrote about the many problems with Facebook's plan to show users less political content—like defining what counts as “political.” https://onezero.medium.com/... Gregor Stuart Hunter / @gregorhunter : Clubhouse may be not safe for users in mainland China, Stanford Internet Observatory warns, confirming speculated connection to Agora Inc via webtraffic https://cyber.fsi.stanford.edu/ ... via @stanfordio Munkhnaran Bayar / @morientalist : “Stanford Internet Observatory has determined that a user's unique Clubhouse ID number and chatroom ID are transmitted in plaintext, and Agora would likely have access to users' raw audio, potentially providing access to the Chinese government.” https://cyber.fsi.stanford.edu/ ... Carly Miller / @carlymil : Clubhouse, The Great Firewall, security risks, and incredible technical analysis by the @stanfordio team👇 https://twitter.com/... Edmund Lee / @edmundlee : .@joinClubhouse has a lot of celebs, execs and, of course, VCs, on all the time. The talk is often frank, making it a compelling platform. BUT ... China apparently has FULL ACCESS to user IDs and raw audio. @stanfordio has compelling evidence: https://cyber.fsi.stanford.edu/ ... @ccp_china_watch : Shanghai-based Agora supplies back-end infrastructure to the Clubhouse App. Agora would likely have access to users' raw audio, potentially providing access to the Chinese government. 1/2 via @Byron_Wan https://cyber.fsi.stanford.edu/ ... @stanfordio : 📢 New work out today from our Tech team & China research team: @joinClubhouse app recently became popular in 🇨🇳. We looked at its data security practices & found a potential risk to mainland Chinese users. 🔗 https://cyber.fsi.stanford.edu/ ... Here are our key findings 👋🧵⤵️ (1/8) @yaqiu : Clubhouse - or Silicon Valley broadly - is either willfully ignorant of data protection risks pertaining to any entities in China or doesn't care enough to think this is a problem. The US needs better laws to force companies to care about user privacy. https://cyber.fsi.stanford.edu/ ... Jane Manchun Wong / @wongmjane : This is the exact reason why I am reluctant to release any product that touches on Clubhouse's private API related to audio data, or the approach https://cyber.fsi.stanford.edu/ ... David Thiel / @elegant_wallaby : New piece from @stanfordio regarding @joinClubhouse, @AgoraIO and user privacy. This has potentially serious implications for government-targeted users, particularly in China and Hong Kong. 🧵⤵️ https://cyber.fsi.stanford.edu/ ... Andreas Landwehr / @andreaslandwehr : The Stanford Internet Observatory has confirmed that Agora, a Shanghai-based provider of real-time engagement software, supplies back-end infrastructure to the #Clubhouse App https://cyber.fsi.stanford.edu/ ... Hussein Kanji / @hkanji : In this blog post, we investigate the possibility of Chinese government access to Clubhouse audio, both via Agora and Clubhouse app itself https://cyber.fsi.stanford.edu/ ... Melissa Chan / @melissakchan : I'm shocked a Silicon Valley startup didn't think through its security and thought working with a Chinese company would not bring scrutiny. It took an outside org, @stanfordio, to confirm Clubhouse's relationship with Agora, and more in this 👀 report: https://cyber.fsi.stanford.edu/ ... Melissa Chan / @melissakchan : One point of clarification in this fantastic @stanfordio report is that it was Clubhouse's decision not to have it on the app store in China. Was wondering about that. But why did it take an outside org to get Clubhouse to take extra security measures? https://cyber.fsi.stanford.edu/ ... Bobby Allyn / @bobbyallyn : “In at least one instance, [Stanford researchers] observed [Clubhouse] room metadata being relayed to servers we believe to be hosted in the PRC, and audio to servers managed by Chinese entities and distributed around the world” https://cyber.fsi.stanford.edu/ ... Elena Cryst / @elenacryst : 🗞️📰 EXTRA EXTRA READ ALL ABOUT IT!!! Fascinating work combining our team's incredibly deep security expertise with our breadth of global perspectives. Can't believe I'm this energized to be working late on a Friday night! kudos @stanfordio team! https://twitter.com/... Kent Bye VoicesOfVR / @kentbye : Just heard @alexstamos announce this @stanfordio report digging into how @joinClubhouse is using a Chinese servers & is sending username & channel info in plaintext that's easy to intercept & extrapolate metadata on who is talking to who. https://twitter.com/... Will Oremus / @willoremus : Clubhouse's privacy issues may run much deeper. A new report from @stanfordio finds “easy to uncover” flaws in data handling that “pose immediate security risks to Clubhouse's millions of users, particularly those in China.” https://cyber.fsi.stanford.edu/ ... Clara / @thatclarafied : This happened to me yesterday. A creep I went on a date with once in London 3 years ago followed me on Clubhouse. He's already been blocked for doing the same on every other platform. I was livid when I discovered he could find me on CH. https://twitter.com/... Taylor Lorenz / @taylorlorenz : “What if you didn't give Clubhouse access to your contacts, specifically because you didn't want all or any of them to know you were there? I regret to inform you that Clubhouse has made it possible for them to know anyway & encourages them to follow you.” https://www.vox.com/... Roxanne Taylor / @roxannetaylor : I am enjoying Clubhouse but sorry to see the challenges Black doctors are having as the Work Overtime to Combat Clubhouse Covid Myths - Bloomberg https://www.bloomberg.com/... Mun-Keat Looi / @munkeatlooi : Was wondering when a covid Clubhouse story would arrive, but this is great. https://www.bloomberg.com/...
Context & Ripple Effects
Clubhouse’s rapid uptake among mainland Chinese users created a cross-border audience before the service was blocked in China after an uncensored growth period. Stanford Internet Observatory’s findings that user IDs and audio could reach servers potentially accessible to the Chinese government turned that reach into a data-handling issue.
The company’s response focuses on the client-to-server path rather than access to the service itself. Later coverage of audio and metadata appearing on a third-party website shows that routing controls were only one part of Clubhouse’s broader security exposure.
First-order effects
- Clubhouse must change its clients’ network behavior to prevent the reported pings to Chinese servers, directly addressing the transmission path identified by the researchers.
- Users whose IDs and audio were implicated by the report gain a narrower stated safeguard against that specific server exposure.
Second-order effects
- Clubhouse’s later addition of safeguards after third-party exposure of audio and metadata puts pressure on the company to treat client routing, data access, and distribution controls as connected security work rather than isolated fixes.
Third-order effects
- If cross-border social services face similar scrutiny, data-routing architecture will become a product-level trust boundary: platforms serving politically sensitive audiences will be judged on where client data travels as well as what conversations they permit.
The trend: Cross-border communications platforms are being pushed to make data-location and transmission controls central to user trust when access spans conflicting jurisdictions.