Last year, a German hospital was fined 460,000 euros for a GDPR violation. The cause was not a data breach in the traditional sense. A staff member used Google Translate to translate patient records from Turkish to German. The patient's medical history, diagnosis, and treatment notes were sent to Google's servers for processing.

The hospital argued the translation was necessary for patient care. The regulator argued that sending identifiable health data to a US tech company without explicit consent violated GDPR Article 9. The regulator won.

This is not an edge case. It is the logical outcome of a simple fact that most people overlook: every time you use a cloud-based translator, the text you translate is sent to and processed on someone else's server.

What Happens to Your Translated Text

When you type or speak into Google Translate, the data travels to Google's servers, is processed by their neural machine translation system, and the result is sent back to your device. Google's privacy policy states they may use this data to "improve Google services."

What does "improve services" mean in practice? It means your translated text can be used to train future translation models. It means patterns in your translations are analyzed. It means the data exists on Google's servers, subject to US law, including potential government data requests.

Microsoft Translator has a similar model. iTranslate routes through cloud APIs. DeepL processes on their servers (they do state they delete data after translation, but the data still leaves your device).

For casual translations, "what does this menu item mean," this is a reasonable tradeoff. For anything sensitive, it is not.

The Sensitive Translation Problem

Consider what people actually translate:

Medical information — Patients translating symptoms, diagnoses, prescriptions, lab results
Legal documents — Contracts, immigration forms, court communications
Business communications — Negotiations, internal strategy discussions, financial terms
Personal messages — Private conversations with family, romantic partners, friends
Government interactions — Tax forms, visa applications, social services communications

Every one of these categories involves information that people reasonably expect to be private. Every one of them is routinely run through cloud translation services by millions of people who do not realize where their data is going.

A 2024 Cisco survey found that 48% of employees paste confidential company data into AI tools, including translation services. A separate study by Cyberhaven found that 11% of data pasted into ChatGPT (which shares infrastructure concepts with cloud translators) was confidential.

The problem is not that Google or Microsoft are doing something malicious. The problem is that the architecture itself creates risk. Data in transit can be intercepted. Data at rest can be breached. Data on third-party servers is subject to legal jurisdictions you did not choose.

The On-Device Alternative

On-device translation eliminates this entire category of risk by never sending data anywhere.

The concept is simple: instead of your phone being a thin client that sends text to a cloud server, the translation models run directly on your phone's processor. Your voice is recognized locally. Your text is translated locally. Your camera captures are processed locally. Nothing leaves the device.

Until recently, this was not practical. Translation models were too large and phones were too slow. That has changed. Modern phones ship with neural processing units (NPUs) that can run quantized AI models at production-quality speeds. Models like Gemma (2B parameters), Whisper, and Parakeet deliver quality comparable to cloud services while fitting in phone memory.

Traverba is built entirely on this architecture. All 108 languages, voice recognition, camera OCR, screen translation, and even group conversations over Bluetooth run without any server connection. The privacy guarantee is not a policy promise ("we will not look at your data"). It is an architectural guarantee (your data physically cannot leave your device because there is no server to send it to).

Who Needs Private Translation Most

Healthcare workers and patients — Medical translation is one of the most common use cases, and one of the most sensitive. A nurse using Google Translate to communicate with a non-English-speaking patient is transmitting protected health information to Google's servers. With on-device translation, the conversation stays in the room.

Lawyers and legal professionals — Attorney-client privilege does not extend to third-party servers. Translating privileged communications through cloud services arguably waives privilege. On-device translation keeps privileged information privileged.

Business professionals — Trade secrets, negotiation positions, financial data, and strategic plans regularly get translated. Cloud translation means a copy of that information exists outside your organization's control.

Immigrants and refugees — Some of the most vulnerable translation users are people communicating with immigration authorities, filling out asylum applications, or translating legal documents that determine their future. These individuals often have the least ability to assess privacy risks and the most to lose from data exposure.

Journalists and activists — In countries with surveillance concerns, cloud translation creates a record of what you are reading and communicating about. On-device translation leaves no trace.

Domestic violence survivors — Translating communications about safety planning, shelter locations, or legal options through cloud services creates a data trail that could be accessible through shared accounts or legal discovery.

The Compliance Angle

For organizations, the compliance implications are clear:

GDPR (EU) — Sending personal data to US cloud servers requires adequate safeguards. The Schrems II decision invalidated Privacy Shield, making US cloud processing legally complex for EU data.
HIPAA (US Healthcare) — Protected health information processed by cloud translation services requires a Business Associate Agreement with the translation provider. Google does not offer BAAs for Google Translate.
FERPA (US Education) — Student records translated through cloud services may violate FERPA's disclosure restrictions.
Attorney-client privilege — As noted above, cloud translation of privileged communications creates privilege waiver risks.

On-device translation sidesteps all of these because no data is transmitted to any third party.

The Quality Question

The obvious objection: does on-device translation sacrifice quality for privacy?

Two years ago, the answer was a clear yes. On-device models were noticeably worse than cloud models.

In 2026, the gap has narrowed dramatically. For the most common language pairs (English to Spanish, Chinese, French, German, Japanese, Korean, Portuguese, Arabic), on-device models deliver quality that most users cannot distinguish from cloud translation in everyday use. The gap remains for rare language pairs and highly specialized domains, but for 90% of real-world translation needs, on-device quality is production-ready.

Traverba specifically routes languages to specialized models (Parakeet for English, Qwen3 for CJK, Whisper for broad coverage) rather than using a single one-size-fits-all model. This per-language optimization closes much of the remaining quality gap.

What You Can Do Today

Audit your translation habits. What are you actually translating? If it includes anything sensitive (medical, legal, financial, personal), you have a privacy exposure.
Try an on-device translator. Traverba is free and works offline with 108 languages. Apple Translate works on-device for ~20 languages. Test them on your common use cases.
Set organizational policy. If you manage a team, establish which translation tools are approved for which sensitivity levels. Cloud translation for public content is fine. Cloud translation for confidential data is a policy violation waiting to happen.
Think about the people you translate for. If you translate for patients, clients, students, or other vulnerable populations, their data deserves the same protection as yours.

The translation industry is undergoing the same privacy reckoning that email, messaging, and search went through. The technology for private translation exists today. The question is whether we choose to use it.

Traverba is a free on-device translator supporting 108 languages with full offline capability. No data leaves your phone. Available on Google Play and App Store. Learn more at traverba.com.

Why Your Translator App Should Not Phone Home