Is WhatsApp Safe? A Closer Look at WhatsApp Privacy and Security

An intro to WhatsApp

WhatsApp is a free messaging app that allows users to send text messages, make voice and video calls, and share various forms of media via their smartphone using an internet connection.

Fun fact: The name WhatsApp is a play on the words “What's up”.

The app was initially launched in 2009 by two former Yahoo! employees, Jan Koum and Brian Acton, and was started as an alternative to SMS.

Now, as well as text, the app supports voice calls and the sending and receiving of all sorts of media, including photos, videos, documents, and even location pins.

With its user-friendly interface and cross-platform compatibility, WhatsApp has become a go-to choice for communication among individuals, families, and businesses alike. As of January 2023, WhatsApp boasts over two billion active monthly users worldwide.

Image source: Statista

In 2014, WhatsApp was acquired by Facebook in a $19 billion deal which was, at the time, the largest acquisition of a venture-capital-backed company in history. Although Facebook has its own chat app, Messenger, the two run as separate entities.

One of the main differences between the apps is that WhatsApp has end-to-end encryption by default, whereas Messenger doesn't... Not yet anyway.

With Facebook (now Meta)'s reputation for data sharing, the acquisition of WhatsApp did cause alarm and a mass user exodus. Rival messaging app Telegram claimed to receive 8 million new subscribers around the time of the merge.

But since, then, the dust has obviously settled and WhatsApp continues to draw in new and faithful users. Enough to make it the world's most popular messaging app by a very large margin.

But just because something is popular doesn't mean it's trustworthy.

Let's see if WhatsApp's popularity is justified...

Is WhatsApp safe?

Let's take a look at WhatsApp privacy features and how they stack up.

End-to-end encryption

One of the most celebrated features of WhatsApp is its end-to-end encryption (E2EE). In fact, WhatsApp was one of the first chat apps to use it as default for all messages.

If you're at all privacy-conscious then you'll know that E2EE is a good thing. But if you're new to all this, then let us break it down for you.

End-to-end encryption, often shortened to E2EE, means messages are encrypted on the sender's device and can only be decrypted by the intended recipient's device.

So, for chat apps, this means that all texts, calls, photos, or other shared content are only visible to the sender and the recipient.

No one, not even WhatsApp, can access the contents of your conversations on the app.

WhatsApp's end-to-end encryption is based on the open-sourced Signal Protocol, widely regarded as one of the most secure encryption methods available. It provides high-level protection against unauthorized access, intercepted messages, or eavesdropping by third parties.

Backups

The other good news is that WhatsApp doesn't store your messages on its servers once they are delivered. Instead, they are stored locally on the sender's device and the recipient's device. In doing so, it reduces the risk of data breaches or unauthorized access.

Bear in mind though, that if you decide to backup up your chats through WhatsApp's cloud backup feature then they will be stored on third-party servers, namely the iCloud or Google Drive.

In this case, your WhatsApp messages could potentially be subject to their respective privacy policies and security measures which might not be as robust.

Disappearing messages

Disappearing messages is another standard feature that privacy-focused individuals look for and you'll be pleased to know that it's present in WhatsApp.

This is a type of message “self-destruct” function that allows users to control the lifespan of their messages. Users can set messages to disappear after a set period of time, 24 hours, 7 days, or 90 days, deleting the messages from their device and the recipients. To find out how it works and how to implement disappearing messages, click here.

Chat lock

Another WhatsApp privacy feature that users may be interested in is the ability to turn on “chat lock”. This allows users to password-protect their most personal chats so they can't be seen by anyone else using their device. You can also lock the whole app using face, touch, or fingerprint lock. These can be especially useful features for anyone who shares a device, or in abuse situations where an abuser has access to a victim's phone.

Additional WhatsApp privacy features

There are a few other tweaks that you can make to WhatsApp's settings that can make the app even safer and even more private. With a “View Once” function you can set photos and videos to disappear after they're opened. You can choose who sees your profile photos and your status updates, and leave group chats silently without notifications to the others in the chat.

Is WhatsApp safe to send private photos?

Whether you want to send cute videos of your kids to family and friends or intimate photos to your partner, you will want to be sure that no one but the intended recipient sees your photos.

So, is WhatsApp safe to send private photos?

WhatsApp end-to-end encryption is applied to photos and other media shared through the app. So, any media you send will only be seen by you and the recipient. If you trust the recipient, then WhatsApp provides a fairly secure platform to share private photos.

Just be aware of the backups that we mentioned above. Even if you choose not to back up messages, the recipient might. In that case, the images you've shared may end up on a server with questionable security.

The “View Once” feature can also make WhatsApp safe to send private photos. When you select this function, any media you send will disappear after opening and won't be saved to the recipient's media gallery.

As long as the recipient of view once media is using the latest version of WhatsApp, then they also won't be able to take a screenshot of it.

But, keep in mind that there are always other ways to record “view once” photos. A recipient could take a photo or video using another device before it disappears.

Always exercise caution when sharing sensitive photos or any personal information online, even with people you trust.

WhatsApp's Privacy Policy

To answer the question “Is WhatsApp safe to use?” we need to look beyond the app features and get into the fine print of WhatsApp privacy, safety, and security policies.

There are a few glaring issues.

First of all, although WhatsApp does have E2EE for its messages it's basically mining tonnes of metadata from those same messages. And secondly, the fact that it doesn't offer encrypted backups is a potential security and privacy risk.

It also requires data sharing with Meta, a company not well-known for respecting user data!

Plus, before you even get to use the service, in order to create an account, WhatsApp requires a phone number and basic account info such as a profile username.

Privacy noobs might think that's fairly standard, but in fact, not all encrypted chat apps require this information. Session, for example, doesn't.

The WhatsApp privacy policy outlines the information the app collects, how it is used, what it shares with third parties, and for what purpose. Since privacy policies are pretty dense material, we've tried to sum up the data that WhatsApp collects with a bullet list:

• Your phone number
• “About” info
• Your profile photo
• IP addresses used
• Your device details
• Contacts' phone numbers
• WhatsApp groups that you're a member of
• Blocked/blocking contacts
• App usage, including what service you use, how you interact with other users, time, frequency, and duration
• Performance logs, crashes, and reports
• Connection information
• Location data (when using location-related features)

Keep in mind this is just a quick summary. For the full details of all the information WhatsApp collects about its users, we recommend checking out the full privacy policy.

While they do need your contacts to provide the service, they don't keep logs of who you contact, and they don't share your contacts with Meta.

While WhatsApp and Facebook (Meta) may not read message content or see who you're messaging, the above metadata gives them plenty of information. They know who you are, how much you message, when, for how long, how often, from where, what type of messages you send, and what devices you use.

Think about this in real life...

You're in a cafe typing a message on your smartphone, and a stranger comes up to you and asks,

“What's your name?

“What are you sending?”

“How often do you do that?”

“Are you still talking right now?”

“When will you finish messaging?”

“What type of phone are you using to message?”

Most likely, you'd tell that person to mind their own business. And you'd be right to. Because it's nobody's business but yours. But this invasion of privacy is openly practiced by WhatsApp. It's up to you to decide whether you're okay with that or not.

What data does WhatsApp share?

For some of its services, WhatsApp uses third-party providers. In order for those to work correctly, they need to share some user data. For example, say you want to share your location with your friend, your precise location will be routed through a third party.

WhatsApp also shares certain information with its parent company, Meta. According to WhatsApp FAQs on the matter, this includes but is not limited to:

• your account registration information
• transaction data (if you use Facebook Pay or Shops in WhatsApp)
• service-related information
• information on how you interact with businesses
• mobile device information
• your IP address

The information collected as detailed in the WhatsApp privacy policy (mentioned above) is also the type of information that may be requested and shared with law enforcement. Thanks to end-to-end encryption, WhatsApp is unable to share message content, even if it was requested by law.

It's worth noting that there are government attempts to remove or weaken E2EE in the name of child protection and fighting terrorism. So far, WhatsApp is resisting and has said that it would rather leave certain markets than risk the privacy of its users.

WhatsApp's past privacy issues

To answer “Is WhatsApp safe?” you must also look at the company's privacy history. WhatsApp may be the biggest chat app in the world, but that doesn't mean that they are immune to hacks or making mistakes. Here are the incidents that put user privacy at risk.

GDPR breaches

WhatsApp Ireland was recently fined €5.5 million (just under $6 million) by Ireland's Data Protection Commission (DPC) for breaching the EU's General Data Protection Regulation (GDPR).

The fine initially stemmed from a complaint made by a WhatsApp user. the user argued that the app forced them to consent to the processing of their personal data for service improvement and security, which they deemed a GDPR violation.

After investigations, the DPC didn't uphold the forced consent claim but instead found WhatsApp to be in breach of other transparency obligations.

WhatsApp was hit with the relatively low fine (considerably lower than the usual Meta fines!) and ordered to bring its data processing operations into compliance within six months.

WhatsApp is currently challenging the decision and plans to seek an annulment of the fine before the Court of Justice of the European Union.

This wasn't the first GDPR fine for WhatsApp though. Back in 2021, the messaging app was fined for similar transparency issues also by the Irish protection agency. That time they fined WhatsApp a whopping €225 million which, at the time was the second largest GDPR fine to date.

WhatsApp data breach

In November 2022, nearly 500 million mobile phone numbers of WhatsApp users were being sold on a hacking forum. A report by Cybernews revealed that a hacker was in possession of a database containing 487 million WhatsApp user mobile numbers from 84 countries.

Researchers confirmed that the sample provided by the seller did contain active WhatsApp user numbers. It's thought that the data was obtained through scraping, which violates WhatsApp's Terms of Service. Such information could be exploited for phishing attacks such as smishing and vishing which could lead to other cybercrimes such as identity theft or fraud.

Is WhatsApp safe?: The Verdict

Is WhatsApp safe to use? Well, that depends on what you are happy sharing.

Despite its strong encryption and additional privacy features, the WhatsApp privacy policy raises some concerns. While message content remains encrypted, the app collects metadata that provides valuable information about users, including their activity, device details, and IP addresses. Plus, WhatsApp shares that data with Meta and third-party providers.

WhatsApp has also faced a couple of privacy issues in the past, the most worrying of those, being a data breach exposing millions of users' mobile phone numbers.

Ultimately, whether to use WhatsApp or not depends on your personal comfort level with its privacy, security practices, and track record. As with any online platform, exercising caution when sharing sensitive information or private photos is crucial.

It's always a good idea to weigh up your options and consider alternative messaging apps. Find out how Whatsapp compares to the other popular end-to-end encrypted apps: Compare the Best Encrypted Chat Apps.