Approximately 2.5–3 billion monthly active users rely on WhatsApp because they’ve heard it’s encrypted. That part is true. Your messages travel in a locked box that Meta genuinely cannot open. But encryption only covers the contents of the box — not where it came from, where it went, how often you send boxes, or who you send them to. That’s what Meta actually wants.
The distinction matters more than most users realize.
What “end-to-end encrypted” actually means
End-to-end encryption means the message is scrambled on your device and only unscrambled on the recipient’s device. No server in between — including WhatsApp’s own servers — can read it. WhatsApp uses the Signal Protocol for this, the same protocol developed by Open Whisper Systems that Signal itself uses. On this specific point, WhatsApp is genuine.
What encryption does not cover: everything except the message content. That you messaged someone at 2am. How long the conversation ran. How often you talk. Your location, inferred from your IP address. Whether you read a message. None of that is encrypted. That data travels in the clear to Meta’s servers.
This is called metadata. And metadata is, in many ways, more useful for building a profile of your behavior than the messages themselves.
What WhatsApp tells Meta
Here’s the specific list from WhatsApp’s own privacy policy, without the legal softening:
Your phone number — tied to your Meta account if you have one. Your profile name and photo. Your device identifiers: IMEI number, advertising ID, and hardware model. Your contacts list, if you granted permission (and most users do, because that’s how WhatsApp finds people you know). Your approximate location, derived from your IP address even if you never share GPS data. Your usage patterns: when you’re online, how often you message, message frequency, read receipts, and which groups you’re part of.
The metadata picture this creates is detailed. Meta can infer your sleep schedule, your social circle, your closest relationships, and significant life events — all without ever reading a single word you sent.
What Meta does with it
Your WhatsApp metadata feeds the same ad targeting system that runs Facebook and Instagram. This means your WhatsApp activity influences the ads you see on platforms you may barely use — or don’t use at all.
If you’re in a WhatsApp group for a local hiking club, Meta infers you’re interested in outdoor activities. If you message someone daily for six months and then stop, Meta notices. If your usage spikes every Sunday evening, that’s a data point. None of this requires reading your messages. The behavioral signal is in the pattern.
The 2021 WhatsApp policy update made this explicit — users had to agree to data sharing with Meta or lose access to WhatsApp. In the EU, that update was reversed after regulatory pressure. EU users operate under slightly different terms with more restricted data flows. If you’re outside the EU, the full data-sharing relationship is in effect.
The backup problem
Here’s where WhatsApp’s encryption story gets complicated. When you back up your WhatsApp chats to Google Drive or iCloud, those backups sit outside WhatsApp’s encryption. Google and Apple can technically access them. Law enforcement can request them through those companies. The messages that were private in transit become accessible at rest.
WhatsApp added an opt-in end-to-end encrypted backup feature in 2021. It’s not on by default. To enable it: Settings > Chats > Chat Backup > End-to-end Encrypted Backup. You’ll set a password or a 64-digit encryption key — don’t lose it, because WhatsApp genuinely cannot recover it.
If you’ve never done this, your chat history is probably sitting unencrypted in a cloud account.
WhatsApp vs Signal vs Telegram
Signal collects almost nothing. Phone number at signup, and that’s effectively it. No metadata logging, no contact graph uploaded to a server, no ad business to feed. Signal is a nonprofit. Their revenue model doesn’t require knowing who you talk to.
Telegram is often lumped with Signal as a “private” alternative. It isn’t — at least not by default. Standard Telegram chats are not end-to-end encrypted. They’re stored on Telegram’s servers in a way Telegram can access. Only “Secret Chats” use E2E encryption, and those don’t sync across devices. Most people never use Secret Chats.
WhatsApp sits between them. Better than SMS (which is completely unencrypted and trivially intercepted). Better than standard Telegram. Worse than Signal on privacy. The gap between WhatsApp and Signal isn’t the encryption of messages — it’s the metadata.
When to use WhatsApp, when not to
For coordinating family gatherings, messaging friends, or planning events, WhatsApp is fine. The metadata Meta collects is real but probably not high-stakes for most personal conversations.
Some conversations you genuinely want private. Sensitive health discussions. Professional communications involving confidential information. Anything involving legal matters. Organizing political activity in countries where that carries risk. For those, use Signal. There’s no nuance here. Signal was built for this. WhatsApp wasn’t.
WhatsApp Business is a separate category worth understanding. When you message a business on WhatsApp, that business can read your messages and share your data with their own service providers and ad partners. The E2E encryption applies between you and the business, but that business decides what they do with what you said.
What you can do right now
Want to see what data brokers expose about you? See what a scan finds → shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist to get in early.