WhatsApp Privacy Review

WhatsApp messages sent between personal account users are protected by the Signal encryption protocol. What we know for sure is that end-to-end encryption is enabled by default, which is a plus. However, there’s a caveat. You’ll need to enter your Settings tab and enable end-to-end encryption for chat backups sent to cloud services, too.

Without this option enabled, any chats you send to a cloud provider (Google, for instance) will be entirely readable by a third party. Why this isn’t enabled by default is a mystery, especially considering that anyone you chat with who uploads their own unencrypted backup will also capture the messages you’ve sent to them in plaintext.

If you’re particularly concerned about other WhatsApp users learning your IP address, you can disable link previews and route your calls exclusively through WhatsApp servers – neither of these features are enabled by default for convenience.

At first glance, the fact that WhatsApp backs up your contacts by default is a little worrying. However, WhatsApp claims that these backups are encrypted client-side and the keys never leave your device.

Otherwise, WhatsApp’s default settings are mostly sensible. It’s only when you start using some of WhatsApp’s less core features like Account Center integration and Meta AI that WhatsApp becomes a privacy concern.

WhatsApp collects a certain amount of metadata by default on all users, which you can find by requesting a copy of your own account status from inside the app.

It’s pretty standard stuff – which device you’re using WhatsApp from, the IP you last connected from, your profile picture, your phone number, and so on. It’s not great that WhatsApp collects this information, but it’s par for the course for all but the most serious privacy products.

There’s no way to turn this reporting off, so if you’re uncomfortable with it you’ll either have to mitigate some of the more personally identifying elements of the data you hand over (more on this in a moment!) or stop using WhatsApp altogether.

The most concerning aspect is Account Center integration, which combines your information across Meta services if you choose to add your WhatsApp account to Accounts Center. Our analysis of the WhatsApp app itself exposed at least thirteen different Meta libraries that Whatsapp uses, including com.facebook.adsmanager and com.facebook.analytics.

WhatsApp states in their policy that connecting your WhatsApp account to Accounts Center will apply your ad preferences across accounts. If you’re concerned about Facebook learning more about you through WhatsApp, we’d recommend you keep this feature turned off.

WhatsApp has gone through a series of privacy scandals over ties to Meta, including a 2021 update which clarified that business accounts are allowed to host messages you send to them on Meta’s servers for processing, essentially stripping any end-to-end protections.

Former WhatsApp security chief Attaullah Baig alleges that during his tenure, he observed systematic failures to appropriately protect user data from access by WhatsApp employees. According to his complaint, around 1,500 WhatsApp engineers were able to freely access user data without appropriate security controls in place to record their actions.

A Whatsapp spokesperson said Mr. Baig's complaint has already been dismissed by the Labor Department, and that it "misrepresent[s] the hard work of our team."

Strictly speaking, neither WhatsApp or Meta make money by selling user data. Instead, Meta’s business model relies on the ability to sell hyper-targeted ads that directly target a particular demographic.

The more information Meta platforms like Facebook and WhatsApp have about your life (which phone you use, when you’re usually online, which brands you’ve interacted with on Channels), the more accurately you can be profiled to judge whether you’re the best fit for a personalized ad.

While WhatsApp doesn’t share personal information with Meta for ads by default, turning on Accounts Center enables Meta to use the metadata it collects from WhatsApp for advertising purposes.

WhatsApp does include a bunch of useful privacy features beyond end-to-end encryption, including a few that are handy for physical privacy.

For example, any conversations you’d like not to appear on your main WhatsApp feed can be hidden behind a Locked Chats folder secured with your choice of device authentication method such as a password or fingerprint.

WhatsApp also allows you to decide how long a message appears for before it’s deleted permanently for all users, as well as send one-time-only photos, videos, and voice messages

If you’re still concerned about your messages being leaked, you can also turn on Advanced Chat Privacy, which makes it so you can’t export media or chat logs, and blocks any participant from invoking Meta AI.

There’s a lot of ways that Meta hoovers up data from WhatsApp.

If you:

• Interact with Business accounts
• Use the Updates tab
• Send messages through Meta AI

Then you’re almost certainly handing over content as opposed to metadata, all of which can be analyzed by Meta and handed over to third parties.

WhatsApp is also rolling out ads in the Status and Channels tabs. They’re shown to you based on a couple of semi-anonymized data points, such as your country code and age, device language, general location (WhatsApp specifies this could be as granular as a single city), or any engagement you’ve had with statuses or channels under the Updates tab including interaction with past ads.

Worst of all, integrating WhatsApp with your Facebook account though Accounts Center unifies your ad preferences across both Meta products.

At the bare minimum, you should:

• Enable encrypted backups to prevent cloud backup data from being accessible
• Enable "Advanced Chat Privacy" to disable AI features in chats and prevent conversation exports
• Enable two-step verification for account security
• Opt out of Account Center integration to prevent information combination across Meta services

Nuclear Option: You can delete your entire account by navigating through Settings > Account > Delete Account and entering your phone number to confirm.

This option deletes your account info and profile picture, deletes you from any WhatsApp groups, and removes your message history on the device you’re using. However, the deletion process takes 90 days from the moment you request it. WhatsApp can also arbitrarily retain any data for a longer period of time as long as there’s a legal justification for it.

Don’t interact with the Updates tab, don’t message business accounts, and don’t use Meta AI. Turning Advanced Chat Privacy on for each chat you’re in blocks Meta AI from being invoked. You may also consider using WhatsApp from a burner phone with a separate SIM if you’re concerned about your metadata being sent back to Meta. In that case, it wouldn’t hurt to use a trustworthy VPN or Tor to hide your IP address too.

If you want an alternative, Signal offers most of the same conveniences and privacy benefits as WhatsApp but without the Meta ecosystem integration. It’s almost fully open-source on both the client and server side, making it much easier to verify that Signal’s end-to-end encryption is trustworthy.