Also @signalapp this part of your post is wrong. Both #gdpr and #ccpa define a phone number as being personal information (in CCPA it's a unique personal identifier). So *if* a user was affected, their personal data was in fact accessed. https://twitter.com/bentasker/status/1559449028970127360/photo/1