WhatsApp is a messaging application owned by Meta (acquired from the original founders in 2014 for $19 billion). Around 2 billion users worldwide. End-to-end encrypted by default for messages, voice calls, and video calls using the Signal Protocol since 2016. The integration was negotiated personally between Jan Koum and Brian Acton (then WhatsApp leadership) and Moxie Marlinspike (Signal’s lead developer); both Koum and Acton later left Meta over what they framed as misalignment on user privacy.
What it means in practice
The encryption claim is technically true and operationally narrow. Message and call content is E2EE: Meta cannot read what you send. Everything else is not. Meta sees who you message (the social graph), when you message them (timestamps), how often, group memberships (who is in what), profile photos, status updates, the contacts you uploaded from your phone book (yours and theirs), the IP address of every connection. Meta can be subpoenaed for all of the above. Backup behavior is the structural weakness: if you back up to iCloud or Google Drive without the optional E2EE backup setting (introduced 2021, opt-in, requires a separate password), the backup is plaintext-ish at the cloud provider, which makes it producible under legal process. The encryption defends content against Meta. The metadata defends nothing.
Who uses it, and against whom
Default messenger for billions outside the US. Adversaries: from local police executing search warrants on seized devices (the encrypted backup setting matters here), to commercial spyware operators using WhatsApp delivery vectors for Pegasus and Predator implants (Citizen Lab has documented multiple WhatsApp zero-clicks), to state actors who can subpoena Meta for metadata graphs even when they cannot reach content. For high-profile journalists and activists outside the US, WhatsApp is often the only practical channel because the source uses it; the operational answer is to keep WhatsApp for low-stakes conversation and move sensitive threads to Signal.
What you can change today
Three settings, ten minutes. First: Settings, Chats, Chat Backup, enable End-to-End Encrypted Backup with a strong password (write it down, store it offline; if you lose it the backup is gone). Second: Settings, Privacy, Disappearing Messages, set a default for new chats (24 hours, 7 days, or 90 days depending on threat model), then walk through existing sensitive chats and enable per-conversation. Third: Settings, Privacy, Read Receipts off if you do not want to leak when you read a message; Settings, Privacy, Last Seen and Online to “Nobody” or “My Contacts Except.” For higher-stakes contacts, ask them to install Signal and move the conversation there; WhatsApp’s metadata graph is the leak that most users do not see.
Related articles
- Client confidentiality in the digital age: the tools lawyers actually need.
- Digital security for journalists in 2026: the complete operational guide.
- A journalist was arrested in Kuwait for reposting a CNN video. The law used to charge him didn’t exist yet when he posted it.
- Border agents can search your laptop without a warrant.