Is WhatsApp safe? What’s really happening with your data

WhatsApp’s security features include spam detection, security alerts, two-factor authentication, and end-to-end encryption. The latter ensures that only the communication parties can read messages sent through the platform – no one else, not even WhatsApp, has access. 

However, concerns remain over data sharing with Meta, malicious links sent by other users, social engineering attacks, and account takeover scams. 

So, is Whatsapp safe to use? Read on to learn what data is collected and how to protect your online privacy when using this app. 

How WhatsApp encryption works

Adopted in 2016, WhatsApp’s end-to-end encryption (E2EE) uses the Signal Protocol. It guarantees that all the content is locked in a secure encryption box and only the person you’re interacting with can “open” it.

WhatsApp automatically generates one public and one private cryptographic key for your device when you first install the app. The first key is shared with other users, the second one is kept on your device.

During the conversation, the public keys are automatically exchanged between devices (users don’t need to share them manually). Once a message is sent, it’s automatically encrypted using the recipient’s public key and becomes unreadable for anyone who tries to intercept it—even WhatsApp. The message is then decrypted once it reaches the recipient’s device.

What’s actually protected (and what’s not)

Although end-to-end encryption provides robust protection on WhatsApp, it doesn’t cover everything. No one but you and the recipient can access the content of your messages and calls (not even WhatsApp itself).

However, what’s not encrypted is your metadata, including but not limited to:

• Interaction patterns (who you message, when, from where)
• Your phone number
• IP address and location
• Profile info (photo, name, bio)
• Device info (model, operating system, etc.)
• Your contacts (hashed, if you grant access)
• Cloud backups (not encrypted by default, but you can enable it)

Though WhatsApp is good at protecting the content of your conversations, it doesn’t do so well with your identity data and communication patterns. With no encryption, this information can be accessed by Meta’s network for profiling, advertising, and legal requests. 

Privacy concerns: is WhatsApp really private?

The answer is both yes and no. WhatsApp can be considered private as it encrypts your conversations and doesn’t have access to them itself—so no one can intercept what you’re discussing in chats. However, it still collects a lot of your information—basically, all the metadata that isn’t encrypted. The app collects with who, when, and where you communicate, as well as your device info.

Such practices are explained by the app as to help run the service, detect abuse, and integrate with the rest of Meta’s infrastructure. However, considering Meta’s vague data sharing policies, you never know who your social graph and location are exposed to.

WhatsApp and Meta data sharing

Meta’s ownership of WhatsApp raises concerns for many users, mainly due to Meta’s history of data misuse and lack of strict federal privacy laws to regulate that. Here are the main concern points:

• Meta merges data from its networks (WhatsApp, Facebook, Instagram, etc.) to create an extensive deep behavioral and social profile; this profile is then used for ad targeting across the Meta ecosystem. Potentially, information collected from WhatsApp can be used to reach you on Instagram (e.g. based on your location, device info).
• Large data volumes circulating in one connected ecosystem means a larger and easier target for hackers (and Facebook has already experienced a breach).  
• Although WhatsApp gives some privacy control (e.g., profile visibility, backup encryption), there is no way to refuse metadata collection unless you’re in the EU.
• There is no clarity on how exactly collected data is used by Meta, particularly in business and ad tech integrations.

In 2021, WhatsApp faced a major backlash when it announced an update to its Privacy Policy. The Policy expanded the app’s data-sharing with Meta—users started receiving in-app notices informing them about the updated terms. The changes were mandatory, so users could continue using the app only if they accepted them.

While Facebook laid out the reasons behind the encreased data collection, the messaging was unclear and many users assumed that more of their personal information and chat contents would be shared. Meta delayed the rollout of the new policy and launched a massive PR campaign to clarify that the update concerned mainly business chats.

Nevertheless, the new terms were met with outrage and sparked one of the biggest privacy-driven shifts in messaging app history as users turned to WhatsApp’s competitors for better privacy. Signal’s downloads broke records both on the App Store and Google Play, while Telegram got 25+ million users in just a couple of days.

Privacy and safety vulnerabilities on WhatsApp

So, is WhatsApp secure for an average user? Like any other app, WhatsApp is not immune to safety issues. Here are the main ones often raised by users:

1. Metadata collection: WhatsApp collects a lot of metadata that reflects your interaction patterns and device info. While the content of your chats remains private, a lot of your personal details are still aggregated by Meta.
2. Data breaches: if Meta experiences a data breach, your metadata will also become vulnerable to hackers.
3. Malicious links and scams: unless, you’ve restricted your privacy settings, anyone can save your phone number in their contact list and message you. This is abused by scammers who send phishing texts or fake lottery messages that trick users into sharing sensitive information.
4. Account hacking and SIM swapping: it’s a common practice for intruders to manipulate mobile carriers into swapping your phone number onto a different SIM card and getting access to your communications. This way, hackers can overcome 2FA and take over your WhatsApp account.
5. Group chat vulnerabilities: scammers can create fake profiles and join WhatsApp group chats, posing as legitimate members. They will then have access to personal details of other participants. They can also send malicious links and files or get more sensitive info out of you.
6. Social engineering attacks: hackers pose as WhatsApp support and contact you with some “issue” with your account. They’ll ask you for your app’s verification code or other private details to break into your account.

Is WhatsApp safe for sending private photos?

Although WhatsApp has its own security downsides, it is still relatively safe for sending private photos when using the following security features:

• Disappearing messages: deletes any messages you receive/send as soon as you read/write them, so nobody can snoop on your private conversations even if they log into your account.
• “View Once” mode: as the name implies, this feature makes sure that any media is viewed only once. After that, it automatically disappears from chat. Another benefit of this feature is that it blocks screenshots.
• Private notifications: hides the content of the message so it won’t appear on your lock screen, allowing you to read the message only when you open the chat.

Cloud backups 

Cloud backups aren’t enabled by default, but WhatsApp users can set the app up to periodically back up their message history on iCloud (for iOS) or Google Drive (for Android). Backing up conversations means that you can save and restore them when switching devices or when recovering from data loss. 

Users can’t choose which conversation to include or exclude—backup usually contains all your chat history, including media like photos and videos (unless they have been sent using the “View Once” mode). 

Additionally, cloud backups aren’t encrypted by default, which means that service providers Apple and Google can have access to them. However, encryption can be enabled manually:

1. Go to “Settings”; 
2. Find “Chats”;
3. Click on “Chat Backup”;
4. Select “End-To-End Encrypted Backup”;
5. Tap “Turn on,” then follow the prompts.

When encrypted, Apple and Google will no longer have access to your backed-up WhatsApp content. Instead, these chats will be secured with a very long (64-digit) encryption key generated on your device.

How WhatsApp compares to other messaging apps

The main competitors of WhatsApp are currently Signal and Telegram.

Signal is a secure messaging app with a high focus on privacy and encryption. Developed by a non-profit foundation, Signal strives to be one of the most secure messaging platforms. The app uses end-to-end encryption, collects only a phone number and no other metadata, offers numerous security features, and has open-source code that anyone can check.

Telegram is one of the most popular messaging apps that’s convenient for day-to-day chatting and managing large groups and channels. The platform has numerous security features like two-factor authentication, Secret Chats, lock-screen, and others, but it doesn’t encrypt conversations by default.

WhatsApp vs. Signal vs. Telegram: feature comparison

Who should (and shouldn’t) use WhatsApp?

If you’re trying to understand how safe WhatsApp is based on your specific needs, here is a quick overview of its best and worst use cases:

WhatsApp might be a good messaging option for those who:

• Want secure message content (thanks to end-to-end encryption) but are comfortable with Meta collecting metadata;
• Need a free and easy way to connect internationally with no worries about SMS or call fees;
• Own a small business and want direct messaging with customers;
• Already use other Meta platforms like Facebook and Instagram.

The following users might want to consider WhatsApp’s alternatives:

• Privacy-conscious users who do not trust Meta with collecting their data or who want to limit their digital footprint in general; 
• Activists and journalists sharing sensitive data;
• Teams and companies seeking strong control over data storage, sharing, and compliance. 

How to use WhatsApp more securely

If you choose WhatsApp as your messaging platform, consider adopting the following security practices for higher protection: 

Enable 2FA

Two-step verification (2FA) adds an extra layer of security to access your WhatsApp account. Turning on this feature means any attempt to log into your profile must be accompanied by a six-digit PIN. PINs should be complex, not related to any public information (date of birth, name, etc.), and not be six consecutive digits.

To enable two-step verification:

1. Open WhatsApp “Settings” and choose “Account”;
2. Click on “Two-Step Verification”;
3. Tap “Enable” and create a unique six-digit passcode;
4. Enter an email address for code recovery;

Turn on encryption for cloud backups

The best practice is to avoid backups altogether. In case they are necessary, make sure you enable encrypted backups. Remember that chats stored in WhatsApp are protected with encryption by default, but backups located on Drive or iCloud servers lack that protection. 

To enable encrypted cloud backups:

1. Go to WhatsApp “Settings”;
2. Find “Chats”;
3. Choose “Chat Backup”;
4. Find “End-to-End Encrypted Backup” and then tap “On”.

Set disappearing messages

This feature ensures that exchanged messages are automatically deleted for both conversation partners after a specific period. So, in case your device is hacked or stolen, you can be sure that none of your secret interactions can be seen.

To activate the Disappearing messages feature in a given chat:

1. Tap the contact’s name at the top;
2. Choose “Disappearing messages”;
3. Select a period after which a message will be deleted.

Disable auto download for media

Enabling this feature means that the media you’re sent won’t be downloaded automatically upon receiving, but will require downloading manually for each file individually. Such a restriction prevents unwanted files and spyware from automatically saving on your phone.

Here’s how you enable it:

1. Open “Settings”
2. Go to “Storage and Data”
3. Find “Media Auto-Download”
4. Choose “No media” 

Regularly review linked devices

Doing this ensures that you know what devices your WhatsApp account is accessed on. If anyone secretly breaks into your profile on their device, you’ll be able to detect and deactivate it. 

For that, open “Settings”, then “Linked Devices”, and remove any device you don’t recognize. 

Manage privacy settings

You can control who sees your name, profile photo, bio, status (online or not), and last activity. The best option is to restrict anyone but your contacts from having access to this info to ensure maximum privacy. 

Go to “Settings”, then “Privacy” and choose your preferred restrictions.

How Onerep helps limit exposure beyond messaging apps

To add you to their contact list on WhatsApp or impersonate your acquaintances, scammers need to know your phone number at least. Add to that your name, address, family ties—and criminals can create believable scams you’re likely to fall for.

A good source of this information is data brokers. These sites collect your private information from numerous sources and expose various areas of your life: your job, your family, your hobbies, your financial situation, and more.

Onerep helps you keep all this info private by removing it from 214 data brokers. The service scans the sites to find the exact pages that disclose your details and requests to delete them on your behalf. Since brokers frequently update their databases and may republish the info later, Onerep runs regular scans to ensure that reappeared data is dealt with promptly.

Using Onerep to opt out of data brokers significantly improves your privacy and safeguards your identity from WhatsApp impersonation scams and numerous other threats, both online and offline.

FAQs

How safe is WhatsApp for sending private photos?

WhatsApp is safe for sending private photos when using security features like Disappearing messages, “View Once” mode, and private notifications. 

Can WhatsApp messages be hacked or read by Meta?

No, WhatsApp uses end-to-end encryption that ensures no one, not even WhatsApp and Meta, can read your messages. Meta collects other user data, including phone numbers, transaction data, service-related information, interaction patterns, and mobile device information.

Is WhatsApp safer than SMS or email?

Although WhatsApp is not immune to scams, it is still more secure than SMS and email due to end-to-end encryption and numerous additional privacy features like disappearing messages, disabled auto-download for media, and others.

Why do some people say WhatsApp isn’t private?

Meta, the current WhatsApp owner, collects a lot of user metadata and they are not transparent enough about how they use it and who they share it with. Additionally, Meta merges the data collected via its various platforms (including Instagram, Facebook) to create even more comprehensive user profiles that reflect user activity across various services. 

What is the safest messaging app?

Signal is considered to be the most secure messaging app as it has end-to-end encryption, collects only a phone number and no other metadata, has robust additional privacy features, and has open-source code. Among additional security features are hidden notification content, signal PIN, Relay Calls, and screen security.

Is WhatsApp a safe app?

WhatsApp is considered safe as all chats are protected with end-to-end encryption that ensures no one, including WhatsApp, can read your messages. However, one reason why WhatsApp is not safe could be that it collects extensive metadata, including who you interact with and how. Users can’t opt out of this data collection and Meta is a bit vague about who this information is shared with.

Is WhatsApp private?

WhatsApp is indeed quite private when it comes to protecting communications, as no one, even the app itself, can access and read your chats. Yet the same can’t be said about the metadata that WhatsApp collects and shares with the Meta network.

Is WhatsApp dangerous?

WhatsApp isn’t dangerous for personal communications as it encrypts chats, which prevents hackers from accessing and reading your conversations. Although it still has some risks associated with phishing scams, group chat vulnerabilities, and vague metadata sharing policy.