MEGA Cloud Storage: Privacy & Security Review – Is It Really Zero-Knowledge?

MEGA Cloud Storage: Privacy & Security Review

MEGA is widely known for its zero-knowledge encryption, but how secure and privacy-respecting is it really for storing your files? MEGA uses client-side encryption (AES-128) for files and RSA-2048 for key exchange, meaning the service cannot access your file contents. However, metadata like file names, sizes, and timestamps are not encrypted, and the company is based in New Zealand, which has surveillance laws like the Telecommunications Interception Capability and Security Act. Additionally, MEGA scans files for copyright infringement and illegal content, which breaks true zero-knowledge. While MEGA is a solid choice for privacy-conscious users, it is not perfect.

What MEGA Offers: Strengths and Weaknesses

Strengths:

• End-to-end encryption (E2EE) for files in transit and at rest.
• 50 GB free storage (with time-limited bonuses).
• Cross-platform apps (Windows, macOS, Linux, iOS, Android).
• File versioning and trash recovery (30 days).
• Secure chat with E2EE.

Weaknesses:

• Metadata (file names, sizes) not encrypted.
• Server-side scanning for copyright/illegal content (breaks zero-knowledge).
• Based in New Zealand (Five Eyes member).
• No built-in VPN or Tor support.
• Limited customer support on free tier.

Privacy & Terms of Service Analysis

Encryption: MEGA uses zero-knowledge encryption for file content (AES-128) and key exchange (RSA-2048). However, file names, sizes, and timestamps are stored unencrypted. The web client uses TLS 1.2/1.3 for transport. MEGA claims it cannot access your files, but it can see metadata.

Data Centers: MEGA operates data centers in the Netherlands, Germany, Canada, and the US. For EU users, data may be stored in Europe, but the company is subject to New Zealand law, which is a Five Eyes member. This raises concerns under the CLOUD Act, as the US could potentially request data from MEGA's US-based servers.

File Scanning: MEGA scans files for copyright infringement (using automated tools) and illegal content (e.g., child exploitation). This means the server can access file hashes and possibly content, contradicting true zero-knowledge.

Telemetry: MEGA collects usage data (e.g., app crashes, device info) for improvement. You can opt out in settings.

How to Protect Your Privacy on MEGA

1. Enable Two-Factor Authentication (2FA): Go to Settings > Security > Two-Factor Authentication and set it up via an authenticator app.
2. Use Cryptomator or Rclone: For extra encryption, use Cryptomator (client-side encryption) or Rclone (with crypt remote) to encrypt files before uploading. This hides metadata and prevents server-side scanning.
3. Opt Out of Telemetry: In Settings > Privacy, disable "Send anonymous usage statistics" and "Send crash reports".
4. Secure Sharing: Use expiring links with passwords. Avoid sharing decryption keys via unencrypted channels.
5. Use a VPN: MEGA does not log IP addresses, but using a VPN adds an extra layer of anonymity.

CCPA / CPRA Compliance: How MEGA Stacks Up Against US Privacy Laws

MEGA is based in New Zealand, not the US, so it is not directly subject to the California CCPA or CPRA. However, if you are a California resident, MEGA states it will comply with CCPA requests for data access and deletion. Compared to US-based services like Google Drive or Dropbox, MEGA offers stronger encryption by default, but its metadata exposure and server-side scanning are weaker than true zero-knowledge services like Tresorit. Under the CPRA, MEGA would need to provide clear opt-out mechanisms for data sales (which MEGA does not engage in). Overall, MEGA provides better privacy than typical US cloud storage, but not perfect.

FAQ

Is MEGA truly zero-knowledge?

No, because MEGA scans files for copyright and illegal content, meaning it can access file hashes and possibly content. Metadata like file names is also not encrypted.

Can MEGA see my files?

MEGA cannot see file contents due to client-side encryption, but it can see metadata (names, sizes) and scans for illegal content, which breaks true zero-knowledge.

Is MEGA safe for sensitive data?

With additional encryption (e.g., Cryptomator) and proper settings (2FA, opt-out telemetry), MEGA is reasonably safe, but not recommended for top-secret data due to metadata exposure and Five Eyes jurisdiction.