WhatsApp says no one can see your messages, but the FBI gets a list of everyone you talk to every 15 minutes. If you have iCloud backup on (most people do), they get the actual messages too. WhatsApp encrypted your messages in transit but stored them unencrypted in the cloud for five years. They fixed it, but hid the switch so deep in settings that 9 out of 10 people still have unprotected backups.
What they claim: WhatsApp is a secure messaging platform that protects users from surveillance.
What we found: CVE-2019-3568 (CVSS 9.8): NSO Group Pegasus zero-click buffer overflow via missed calls. 1,400 targets in 51 countries. CVE-2025-55177 (CVSS 8.0): zero-click spyware targeting ~200 people (2025). CVE-2022-36934: video call RCE. CVE-2019-11932: GIF double-free RCE.
What they claim: We collect limited information — only what's needed to operate the service.
What we found: Apple privacy label reveals 16 data categories collected: contacts, location, purchase history, financial info, email, phone number, user content, usage data, diagnostics, device ID, advertising data, search history, browsing history. Compare: Signal collects virtually nothing.
What they claim: Meta claims Incognito Chat processes conversations in a "secure environment Meta can't see" using hardware-encrypted TEEs, providing "a completely private way to chat with AI"
What we found: During an Incognito Chat session, web search queries generated by Meta AI exit the TEE and travel through Meta infrastructure to external search providers. Queries are capped at 100 characters and limited to 5 per prompt, but Meta has not independently verified that these queries are unlinked from user identity. The TEE processes text only — no images, voice, or media. Regular Meta AI conversations outside Incognito mode are processed under Meta's standard privacy policy with "few limits" on how they improve models.
What they claim: Meta frames Incognito Chat as a "privacy milestone" demonstrating its commitment to user privacy across its platforms
What we found: Meta launched Incognito Chat on 13 May 2026 — five days after quietly removing end-to-end encryption from Instagram DMs, reversing a commitment Meta had made publicly since 2019. The EFF called this "a broken promise." Malwarebytes published a piece titled "Meta's confusing new approach to chat privacy." One platform gets a privacy feature while another loses one the same week. Meta has paid over $7 billion in privacy penalties including $725M (Cambridge Analytica) and $1.4B (Texas biometric data).
What they claim: WhatsApp FAQ: 'No one outside of this chat, not even WhatsApp, can read or listen to them.'
What we found: FBI 'Lawful Access' document (Jan 2021, FOIA) reveals WhatsApp provides pen register data every 15 minutes in near-real-time. With warrants: contacts + reverse contacts. If iCloud backup enabled: full message content via Apple. Meta disclosed data in 78%+ of law enforcement requests in 2024.
What they claim: Facebook/WhatsApp promised the FTC and EU during the $19B acquisition (2014) that WhatsApp would operate standalone with no data linking.
What we found: Aug 2016: WhatsApp began sharing data with Facebook for ad targeting — auto-opt-in. EU confirmed data-matching capability existed in 2014 but was hidden. EU fined Facebook EUR 110M (2017). Jan 2021: mandatory data sharing or account deletion. EU/UK users received different terms.
What they claim: WhatsApp doesn't share your personal data with Facebook to target ads.
What we found: Enabling Meta's Accounts Center allows cross-platform behavioral profiling across WhatsApp, Instagram, and Facebook for advertising. India: NCLAT overturned the ban on ad-related data sharing. Business chat data can be used by Meta for marketing.
What they claim: End-to-end encryption ensures only you and the person you're communicating with can read or listen to what is sent.
What we found: Cloud backups to Google Drive and iCloud were completely unencrypted from 2016-2021. The E2E backup fix (Oct 2021) is opt-in, buried in settings — ~90%+ of users have NOT enabled it (Wire analysis). On iPhone, iCloud Backup (default on) backs up WhatsApp separately and unencrypted.
What they claim: Meta positions its Private Processing infrastructure as secure, with AMD SEV-SNP processors, NVIDIA H100 Confidential Compute, and Cloudflare binary transparency ensuring "not even Meta" can access conversations
What we found: Trail of Bits' 12-engineer-week pre-launch audit found 28 issues including 8 high-severity vulnerabilities. The most critical (TOB-WAPI-13): configuration files were loaded after the cryptographic attestation measurement, meaning a malicious Meta insider could inject an environment variable like LD_PRELOAD to load arbitrary code without breaking attestation. Another finding: attestation could be replayed indefinitely without per-session nonces, allowing a compromised server to impersonate a legitimate processing node. All were patched before launch, but Trail of Bits concluded: "TEEs are not a silver bullet."
What they claim: End-to-end encryption is always activated for all WhatsApp conversations.
What we found: WhatsApp Business API (Cloud API) decrypts messages during processing — Meta servers see plaintext. 200M+ businesses use WhatsApp Business, 175M+ messages daily. In Jan 2024, 650,000 sensitive messages exposed through a single API bug.
What they claim: Phone numbers provide security and reduce spam.
What we found: Phone number required and permanently visible in all chats. Links identity to real name via SIM registration laws. Contact discovery loophole exploited by Vienna researchers to harvest metadata on 3.5B account identifiers (2025).
What they claim: WhatsApp says end-to-end encryption means only you and the person you're communicating with can read messages.
What we found: In January 2025, WhatsApp notified approximately 90 users across 24 countries that their phones had been targeted by Paragon Solutions' spyware through a zero-click exploit — no interaction required. Targets included journalists and civil society members. In 2019, NSO Group's Pegasus spyware exploited a WhatsApp vulnerability to infect 1,400 devices, including journalists, diplomats, and associates of murdered Washington Post columnist Jamal Khashoggi. WhatsApp sued NSO Group. The encryption protects messages in transit — it doesn't protect the phone itself.
What they claim: WhatsApp promotes end-to-end encryption as its core privacy feature
What we found: Meta embedded Meta AI directly into WhatsApp with no option to remove it. The AI button appeared in the search bar and chat interface. While Meta stated AI conversations are separate from encrypted chats, the integration means Meta's AI can be invoked within encrypted conversations — creating ambiguity about what data reaches Meta's servers. Users cannot uninstall Meta AI from WhatsApp without uninstalling WhatsApp itself.
What they claim: WhatsApp markets end-to-end encryption as its core privacy feature, stating "only you and the person you're communicating with can read what's sent."
What we found: In May 2026, security researchers at Mysk discovered WhatsApp stores chat databases in unencrypted plaintext within shared app group containers on macOS and iOS. These containers are shared across Meta apps (Facebook, Instagram, WhatsApp), meaning other Meta apps could theoretically access WhatsApp messages without user consent. Combined with macOS CVE-2026-28910 (App Sandbox bypass), the locally stored data is exposed.
What they claim: WhatsApp provides consistent privacy protections globally.
What we found: EU users get GDPR/DMA protections (EUR 200M fine Apr 2025). India: NCLAT overturned data sharing ban. South Africa: missing protections vs EU/UK policy. Same app, different privacy tiers.