Where Google-verified phone and address come from — Mediator

Where Google-verified phone and address come from

If your Google phone or address isn't filled in after login, it's likely stored under Google Account → Personal info (security/recovery) instead of your Google profile. Only fields on your Google profile page are exposed to apps via the People API.

Mediator asks Google for two things at login: the standard sign-in claims (name, email, picture), and — if you granted the extra scopes on the consent screen — the profile fields from Google's People API (birthday, gender, phone, address, organization).

If your phone or address row on the Profile page stays empty even though the number/address is clearly on your Google account, the cause is almost always this:

Two different places on Google

Google surfaces your phone in two distinct locations, and only one of them is visible to apps like Mediator.

Location Visible to People API?
Google profile — public/contact info you deliberately publish ✅ Yes
Personal info / Security — recovery phone, 2FA phone, account-level info ❌ No

Google keeps the security/recovery number strictly out of the People API by design — a recovery number is a security asset, not profile data. The Phone row you see at Personal info is usually surfaced from that security source, which is exactly why it looks like Google has your number but the People API returns null.

Fix — add the number to your Google profile

  1. Open your Google profile page.
  2. Find the Contact info section.
  3. Click Phone → Add (or Address → Add).
  4. Enter the number/address. It can be the same one you already use for recovery — the two entries are independent, that's fine.
  5. Google will ask a visibility question. Pick Only you — People API sees it regardless of that setting for apps you've explicitly consented to; the visibility only affects public-web search.

Verify

Log out of Mediator and log back in with Google. The Profile page will now show the phone/address with a small ✓ verified badge next to it — that badge means Google itself signed off on it via metadata.verified.

Why we can't just "ask harder"

Mediator already requests every documented scope (user.phonenumbers.read, user.addresses.read, user.birthday.read, …) and Google grants them fine — you can see the granted scopes on your profile page under the raw Google payload. The People API still returns null for phoneNumbers when no profile-source phone exists. There is no scope, header, or query parameter that pulls a recovery/2FA phone into that response; Google intentionally keeps them separate.

If none of this helps, contact us through Delete my data (same page also has an email form for support requests).