WhatsApp isn't as private as you assume

20 Jul, 2026

Summary

This article was written to challenge the assumption that WhatsApp offers total privacy.

Total privacy is easy to assume when sending encrypted messages through WhatsApp. Whilst WhatsApp cannot read your messages, it does collect the metadata connected to your calls and messages. This could be used to infer your identity and your interactions with others.

With WhatsApp having such a large market share, it is difficult to imagine how total privacy might exist. However, there is a lesser known alternative to WhatsApp that offers the same service with increased privacy. Increased awareness of how your data is used will encourage greater adoption of alternatives.

What is encryption?

With over 3 billion active users worldwide¹, most of us are familiar with the instant messaging app WhatsApp. WhatsApp is owned by Instagram and Facebook owners, Meta. If you are familiar with WhatsApp, then you might be aware that messages and calls sent through WhatsApp are end to end encrypted. But what is encryption?

Encryption uses algorithms to make readable data unreadable in transit. Encryption keys are created when the data is scrambled and only authorised users with encryption keys can unscramble the message. This means that when you send a WhatsApp message, the contents can only be read by you and the recipient, and not by the service providers.

To put it into more practical terms, let's assume that you are writing a secret letter to your friend. You do not want anyone but your friend to understand the message in the letter, so you write the message using a secret code, say one character to the right of the intended character. Your friend already has a separate sheet of instructions explaining how to read the code, which you gave to them earlier. In this example, the unreadable letter is your message, and the instructions are your key. You then send your letter via post to your friend.

In transit, the postman decides to open and read your letter. However, the characters in the letter are scrambled and he cannot make sense of the message. He puts the letter back in the envelope and delivers it to your friends address. Your friend opens the letter, and using the instructions you gave them, decodes the meaning of the letter.

This is encryption in it's most basic form. Naturally this is a lot more complex when applied to an instant messaging platform, but the intent is the same, to protect your personal information from unauthorised viewers.

"When you control the mail, you control... information" - Newman

Why your personal information might not be as secure as you think.

Reasonably, you might think that if your messages are encrypted then your conversations are being conducted in private and no identifying information can be taken. This isn't the case when you use WhatsApp. This is because WhatsApp collects your metadata.²³

Whats is metadata? Metadata is the data about a file that isn't the file itself. For instance, when you take a photo with your smart phone, metadata including the date, time, location and device name is also created.

Whenever you use WhatsApp, you will likely be providing the following metadata:³

• Information about your activity including:
  • Your WhatsApp settings
  • Your interactions with businesses on WhatsApp
  • Time
  • Frequency and duration of your activities
  • Crash and diagnostic logs
  • Whether you have used a feature (i.e. messages, calls)
  • Status
  • Groups including group name, picture and description
  • Payments or business features
  • "Last seen"
  • When you last updated your "about" information
• Device information such as:
  • Device model
  • Operating system (i.e. Android, iOS, Windows)
  • Battery level
  • Signal strength
  • App version
  • Browser information
  • Mobile network
  • Phone number
  • Mobile operator
  • Internet service provider
  • Language
  • Time zone
  • IP address
  • Device identifiers
• Cookies on web platforms such as WhatsApp for web or desktop

This information is what you provide passively just by using WhatsApp and does not include data that you provide willingly such as:

• Your name
• Your profile picture
• Your phone number
• Your contact list
• Transaction data if you use payment services

Individually, this information seems trivial, particularly if you are not familiar with computer terminology. For instance, did you know that 'IP Address' stands for Internet Protocol Address? An IP address is a unique identifier created when you connect to the internet. It is unique to your device and can be used to pinpoint your general location.⁴

Did you also realise that if you and your contacts both provide your contact list to WhatsApp, then WhatsApp could infer your mutual connections? WhatsApp also collects the frequency and duration of your interactions, so not only could WhatsApp infer who you talk to and where you are both based, but how often and for how long you talk with any one person and their relationship amongst your shared contacts.

In the unlikely event that the authorities take notice of you, Meta could legally be obligated to handover your metadata. Investigators won't necessarily need to see the exact messages you have written, they can make inferences of their own which can be used as evidence in court.

I discuss at length in my previous article why providing such a large pool of personal data to Big Tech companies is not a good idea, so I will not repeat myself here, and in fairness WhatsApp alone does not use your information for targeted advertising.³

However, if you use other Meta platforms such as Instagram or Facebook, and you connect your Meta account to WhatsApp, Meta will use your metadata to generate targeted advertising and train Meta AI.³

"Move fast and break things" - Mark Zuckerberg

What can I do to increase my privacy when instant messaging?

The most obvious and immediate solution would be to delete your WhatsApp account. However, with over 3 billion active users, doing this would quickly isolate you from your contacts. As much as I value data privacy, I value my relationships more. Deleting WhatsApp clearly isn't viable.

But wait, doesn't everyone have the option to send SMS messages from their phones? Surely this is an easy alternative to WhatsApp?

No. Whilst SMS has greater coverage than WhatsApp, it is far less secure than WhatsApp. SMS doesn't offer end to end encryption, so SMS messages can be read by you, your recipient, and everyone in between. This also makes it very easy for bad actors to intercept your messages for scamming purposes.

So where does that leave us? A big win for your data privacy would be to unlink your Meta account from WhatsApp. This would prevent the active use of your data from targeted advertising and AI training.

To do this, you will need to open WhatsApp, press the three dots in the top right corner, select settings, scroll down to the bottom and select accounts centre. From here, you can control access to your Meta account.

Afterwards, take the time to review the app permissions granted to WhatsApp on your phone. Does WhatsApp really need access to your location? Make sure that the permissions provided are only those needed for you to use the app.

Okay, so what next? Well, not a lot more actually. Most of WhatsApp's security features are designed to protect you from scams, and not from WhatsApp itself. Outright deletion isn't an option, unless you don't mind being a social pariah, and unlinking your Meta account only goes so far.

So what then? Well, the most effective alternative lies in a middle ground between total deletion and nothing at all. That is, a gradual shift to an alternative platform over a longer period of time. How this looks in practice is that you will take up the use of another platform alongside WhatsApp, and encourage your contacts to make the move away from WhatsApp. Once enough of your contacts have made the move, you can comfortably delete WhatsApp without losing social access.

It might surprise you that there is an alternative available, which offers a similar, or if not better quality of service than WhatsApp.

The alternative

Signal is run by an independent not for profit that has been around since 2013.⁵ The app itself is very minimal, with a focus on a clean messaging and calling experience. As a result, expect the app to look less busier than WhatsApp, but at no sacrifice to the quality of calls and messages.

Like WhatsApp, Signal is end to end encrypted. In fact, WhatsApp's own encryption is based on Signal's design.⁶ Metadata isn't collected by Signal, and in fact the only piece of data required by the Signal app is your telephone number.

In the event that Signal is legally obligated to hand over your metadata to the authorities, all they can provide is your phone number (and your name and profile picture, should you wish to include these in your profile). This can be verified as the code for the Signal app is open source, meaning the app's code is publicly available for anybody to audit.⁷

Additionally, Signal's status as a not for profit organisation provides little incentive to take your metadata in the first place.

The drawback to Signal is of course the number of active users. Signal hasn't confirmed how many active users it has, but a conservative estimate places the number of active users at 70 million⁸, which pales in comparison to WhatsApp's 3 billion. Major change always starts small, but if you value your privacy then you need to adopt the alternatives early and encourage your contacts to make the move too.

Switching won't be easy. Even though it takes less than two minutes to set up Signal, many of your contacts will not want to take on the additional mental legwork, as doing so invites uncomfortable conversations about how their data is being used elsewhere.

This is where you need to be brave. You need to stick to your principals and not waver. When people are open to the idea, discuss the benefits of data privacy with them. When people are less open to the change, provide them other incentives to switch. For instance, tell your contacts that you will only be contactable on Signal going forward. If you don't feel comfortable doing this, then you could always just buy them a drink in exchange for creating a Signal account.

Of course, you are still going to be using WhatsApp for a long period of time whilst this transition takes place. Unless you are prepared to cut off social connection overnight, the long game is the only way to implement a more privacy respecting messenger.

Unfortunately, the modern world is such that everything is intertwined. Our attitudes to data privacy have been built on years of infrastructure and marketing, and undoing this will take a similarly long time. You won't be alone, but if we value something enough then you need to be willing to go against the grain, otherwise nothing will ever change.

Sources

#source&interpret