Meta kept your Messenger conversations readable for over a decade while their other app (WhatsApp) had encryption since 2016. They chose ad revenue over your privacy for seven extra years. Meta told Congress that Messenger messages are private. In 2022, a Nebraska mother and her 17-year-old daughter were charged with illegal abortion — and the key evidence was their Facebook Messenger conversations, which Meta handed to police with a search warrant. The daughter was sentenced to 90 days in jail and two years probation. Meta complied with 76% of all government data requests in 2023. "Private" means "private until a detective asks.".
What they claim: 'Nobody during delivery, including Meta, can see or listen to what's sent or said.' (Post-E2E)
What we found: Even with E2E, Meta collects: full contact graph, timestamps, frequency, message/call logs, device info, IP, location, link previews (server-side), read receipts, typing indicators, contact lists, app install history.
What they claim: Messenger requires standard communication permissions.
What we found: com.facebook.orca requests: camera, microphone, contacts, location, SMS, phone/call info, storage, calendar, Wi-Fi info, device ID. Constellation Research: 'unprecedented and frightening.' In 2014, Facebook forced separate Messenger app installation.
What they claim: 2012 FTC consent decree: agreed not to misrepresent privacy. 2019: $5B fine with CEO compliance certification.
What we found: Violated 2012 order within months. Cambridge Analytica exposed 87M profiles including Messenger inboxes via read_mailbox. $725M settlement. 2023: FTC found Meta STILL in violation. Used 2FA phone numbers for advertising. Meta challenged FTC's authority.
What they claim: Messenger Kids: safe, parent-controlled messaging for children ages 6-12.
What we found: 2019 bug let children chat with unapproved adults. Facebook didn't disclose publicly. FTC (2023) found Facebook 'misrepresented' parental controls. Proposed ban on monetizing data from under-18s.
What they claim: Meta positions Messenger as private. 'End-to-end encrypted messages ensure only you and the people you're communicating with can see what's sent.'
What we found: Messenger operated with ZERO E2E for 12+ years (2011-2023). WhatsApp (also Meta) had it since 2016. Even post-Dec 2023, group chats, business conversations, Marketplace messages, Meta AI chats remain unencrypted.
What they claim: 'Keeping messages private is our priority.' Meta's messaging privacy commitments.
What we found: In 2022, Meta provided a 17-year-old's abortion-related DMs to Nebraska police from plaintext storage, enabling felony charges. Meta complied with 76% of 476,802 government data requests globally (88% US).
What they claim: 'The content of messages between people is not used for ads targeting.' (2018)
What we found: Facebook confirmed scanning Messenger content (links, photos, moderator review). Class action proved URL scanning profiled web activity. Link previews: Meta servers fetch every URL shared (Mysk 2020). Disabled in Europe only.
What they claim: Meta maintains security of user accounts and data.
What we found: View As breach (2018): 29M accounts, EUR 251M GDPR fine. 533M user leak (2021): Facebook didn't notify users. Google Project Zero: audio call eavesdropping ($60K bounty). Originull cross-origin bypass.
What they claim: 'We do not use the content of your private messages to train our AIs unless you choose to share.'
What we found: Meta AI integrated into Messenger. Others in your group chat CAN share your messages with Meta AI without your consent. Policy warns to 'be mindful before sharing sensitive information.'
What they claim: Meta committed to user privacy in EU markets and DMA compliance.
What we found: Designated gatekeeper for Messenger (Sept 2024). Required third-party interoperability. Reversed cross-app messaging between Instagram and Messenger. Ongoing 'pay or consent' investigations. Penalties up to 20% global turnover.