What's Up With WhatsApp Privacy in 2026: EFF Then and Now

WhatsApp privacy in 2026: the short answer

WhatsApp is no longer the weak spot it was in 2015. Person-to-person messages are end-to-end encrypted, which means only the sender and the recipient can read them.[3] Meta began encrypting WhatsApp chats in 2016, a year after our original report.[4] Its new AI chats are text only, run in a sandboxed setup and are kept apart from your normal encrypted chats with other people.[3]

The old criticism was about policy, not code. In 2015 the Electronic Frontier Foundation gave WhatsApp one star in its Who Has Your Back report.[2] By 2017 the app had two stars, a warrant rule for message content and published law enforcement guidelines.[1] Some gaps EFF named then, such as advance notice to users, were still open in that report.[1] Many people search for WhatsApp as "what's up" or "whats up". This page answers the privacy side of that search: what the app protects today and what it does not.

Timeline: from one star to encrypted chats and AI

What changed since 2015

The biggest change is technical. In 2015 the content of your chats depended on WhatsApp policy. After encryption arrived in 2016, the company itself cannot read person-to-person messages, so a government demand for content has far less to work with.[3][4] EFF wrote in 2017 that WhatsApp does not store messages once they are delivered, and that undelivered messages are deleted from its servers after 30 days.[1]

Policy also moved. In its 2017 report EFF said WhatsApp publishes law enforcement guidelines, requires a search warrant for stored content and is covered by a transparency report from its parent company.[1] EFF still asked WhatsApp to promise advance notice to users before handing over data, and to clarify how third parties may use user data.[1] We found no newer EFF rating of WhatsApp in our searches, so we cannot say whether those gaps closed.

The 2026 picture is mixed across Meta apps. WhatsApp keeps encryption for chats between people, while Meta removed optional encrypted chats from Instagram Direct Messages on May 8, 2026.[3][4] Malwarebytes advises users to assume that Instagram DMs can now be read by Meta.[3] If privacy matters, the app you choose inside the Meta family now makes a real difference.

Risks and scams around WhatsApp in 2026 (our analysis)

Encryption protects messages in transit. It does not protect you from a scammer you chat with, a stolen phone or a fake app. These are the risks we see most often in our own reports and reader questions.

• Account takeover by code theft. Scammers ask you to forward the six-digit SMS code that WhatsApp sends during setup. Anyone who gets it can move your account to their phone.
• Fake WhatsApp builds. Modified apps promise extra features but ask you to install a file from outside the app store. They can read everything the real app protects.
• Impersonation of friends and family. A new number claims to be a relative with a lost phone and asks for money.
• Metadata. Encryption hides content, but who you talk to and when is still data. EFF urged clearer rules on third-party access to user data in 2017.[1]
• Confusion between Meta apps. Since May 2026, Instagram DMs are no longer end-to-end encrypted, so a sensitive talk moved there loses that protection.[3]
• AI chats. Meta says its WhatsApp AI chats are separate from your encrypted chats, so treat what you type to the AI as a different kind of data.[3]

Six steps to protect your WhatsApp privacy

1. Turn on two-step verification. Set a PIN in the account settings. Even if someone tricks you into giving up the SMS code, they also need the PIN to take over the account.

2. Never share a login code. No real support agent, friend or delivery company needs your WhatsApp code. A request for it is a takeover attempt.

3. Use only the official app. Install WhatsApp from the official app stores. Modified versions sit outside the protection that encryption gives and can leak your chats.

4. Check linked devices. Open the linked devices list and log out any computer or browser you do not recognise. This is a common way to read chats without touching your phone.

5. Verify every money request. If a contact asks for money from a new number, call them on the number you already know. Do not pay until you hear their voice.

6. Keep sensitive talk in encrypted chats. Person-to-person WhatsApp chats stay end-to-end encrypted, while Instagram DMs no longer are.[3] Pick the channel on purpose, and check whether your email appeared in a leak with our leak check.

What is still unknown

• Whether WhatsApp now promises users advance notice of government data demands. EFF said it did not in 2017, and we found no newer rating.[1]
• Whether EFF still publishes Who Has Your Back ratings for messaging apps. We found no edition newer than 2017 in our searches.
• How the separate AI chats will be handled if Meta expands them beyond text.[3]
• Whether Meta will make more changes to encryption across its apps after the Instagram decision.[4]

We will update this page when EFF, Meta or a regulator publishes something new on WhatsApp privacy.

Our original 2015 report

The text below is our report as first published in 2015. We keep it unchanged for the record; the sections above bring it up to date.

If you are looking for an app that is could track you, could collect specific data and then could share it according to its needs, you should download WhatsApp. In fact, we believe that the biggest part of those who will read this article are among those 800 million active users who have already downloaded it to their mobile devices. While we can't say that this program fails to do what it promises (help people to communicate), beware that it has recently been ranked the worst at protecting users' data. This title was given by the Electronic Frontier Foundation (EFF) in its fifth annual Who Has Your Back report, which analyzes 24 well-known companies, including Twitter, Facebook, Yahoo, WordPress and others.

According to EFF, WhatsApp mobile messaging app fails to:

"require a warrant before giving content to law enforcement";
"to provide advance notice to users about government data demands";
"publish information about its data retention policies, including retention of IP addresses and deleted content";
"host content nor do we have reason to believe it receives account closure requests domestically, and thus this category is not applicable".

No matter that WhatsApp belongs to Facebook, this app was rated separately. It earned four out of five stars. According to EFF, the main Facebook's problem is that "it does not provide transparency into ways it cooperates with the U.S. government to block content and remove accounts."

What are the leaders in EFF's ratings? It's Apple and Dropbox. Both of these companies received a 5-star rating this year.

More information about this annual report can be found here: Who has your back?

Related guides on 2-Spyware

• Check whether your email appeared in a leak
• Recent data breaches
• Virus and malware removal guides
• How to report phishing