WhatsApp claims to use end-to-end encryption for all conversations. This protection covers text messages, voice calls and media exchanges. It relies on the Signal Protocol, an open-source protocol regularly audited by security researchers. However, encryption does not cover every layer of information associated with using the app, leaving several blind spots that default settings do not address.
WhatsApp cloud backups: the weak link encryption doesn’t protect
End-to-end encryption applies to messages in transit between two devices. As soon as a backup is sent to iCloud or Google Drive, it falls outside this protection.
By default, cloud backups are not end-to-end encrypted. They remain readable by the storage provider and could potentially be accessed in response to a court order or if the cloud account is compromised.
WhatsApp offers a dedicated option to encrypt these backups. On October 30, 2025, Meta announced the addition of passkeys (fingerprint, facial recognition or screen lock) to secure this process, with a gradual rollout. You still need to enable it manually: go to Settings, then Chats, then Chat backup, and turn on end-to-end encrypted backup.
One often-overlooked aspect of data privacy on WhatsApp goes beyond simply exchanging messages: a backup is a complete copy of your chat history, including photos and documents. Leaving it unencrypted is like keeping an unprotected duplicate of all your conversations on a third-party server.
WhatsApp metadata: what encryption doesn’t hide
Meta cannot read the content of your messages. However, it collects and processes metadata, including the phone numbers of your contacts, timestamps, how often you use the app, profile information and your IP address during calls. This information paints a detailed picture of how you use the service.
The European initiative Klicksafe notes that WhatsApp processes this metadata under its terms of service. Encryption protects the content, not the context of the communication. Knowing who is talking to whom, when and from roughly where already provides a usable map of social connections.
Protecting your IP address during calls
During a voice or video call, participants’ IP addresses are exchanged by default. This information can reveal their approximate location. WhatsApp lets you route calls through its servers to hide your IP address: go to Settings, then Privacy, then Advanced, and turn on “Protect IP address in calls.”
This relay slightly reduces audio quality. The trade-off is acceptable for standard calls, but it’s worth knowing that this option is turned off by default.
Advanced chat privacy and its practical limitations
Announced by WhatsApp on April 23, 2025, the Advanced Chat Privacy feature addresses a specific risk: the unwanted sharing of conversation content. It prevents chat exports and participants from automatically downloading media.
This option is intended for sensitive groups, such as support groups or small professional circles. It is not an encryption feature, but a way to control what happens after content is received.
Its main limitation is technical: nothing stops a participant from taking a photo of the screen or manually copying a message. The feature discourages automated sharing, not deliberate sharing. Each user or group admin must choose to turn it on.
Meta AI and access to WhatsApp conversations
Meta AI’s integration into WhatsApp raises a direct question: can the assistant read private conversations? According to Meta’s published help pages and terms, the assistant only accesses messages that a user sends directly to it or explicitly mentions it in.
Using Meta AI is therefore a deliberate action, separate from regular messaging. User-to-user conversations are not shared with Meta AI unless someone explicitly chooses to do so.
The distinction matters in group chats: if a participant mentions Meta AI in a group, the assistant can access the relevant message. Other group members should be aware of this, even though end-to-end encryption still applies to conversations between people in that same group.
Settings to check to limit your exposure
Several settings are worth checking regularly, in addition to those already mentioned:
- Two-step verification adds a six-digit PIN whenever you register on a new device. Find it under Settings, then Account, then Two-step verification. Without it, an attacker who intercepts your verification SMS can take control of your account.
- You can limit who sees your profile photo, status and last seen time to your contacts only. By default, this information is visible to all WhatsApp users, making it easier for strangers to profile you.
- Group privacy settings let you control who can add your number to a group. Go to Settings, then Privacy, then Groups, and choose “My contacts” or “My contacts except” to prevent unwanted additions.
- Adding an email address to your account provides an additional recovery method if you lose access, independent of your phone number.
European regulations and data sharing with Meta
The Digital Markets Act (DMA) imposes interoperability and data-processing transparency obligations on Meta. In the European Economic Area, WhatsApp follows a specific privacy policy governing data sharing with other Meta entities.
Sharing metadata between WhatsApp and Facebook or Instagram for advertising purposes has been restricted in Europe since the GDPR came into force, followed by the DMA. European users benefit from a more protective regulatory framework than users in other regions, but the line between data needed to operate the service and data used for commercial purposes remains a point of contention between Meta and regulators.
WhatsApp’s privacy settings do not replace the need to stay vigilant across the wider ecosystem. A protected WhatsApp account that backs up to an unencrypted cloud, combined with a Meta account used without restricting data sharing, offers only partial protection. Consistency across each service’s settings remains the deciding factor.
