SubprojectZero
Investigations
Privacy2026-08-15

WhatsApp: What They Know, What They Share With Meta

By Ellis Blackwood · Subproject Zero

You send a message. It feels private. End-to-end encryption is a shield, a promise whispered in the dark. It is a powerful concept. It means no one can read your words. Not the company. Not anyone else.

But a message is more than just words. It carries shadows. Traces. Who you spoke to. When. For how long. This unseen data tells its own story. A story that is collected. A story that is shared.

Quick answer

While WhatsApp uses end-to-end encryption for the content of your messages, it collects and shares significant metadata, device information, and usage patterns with its parent company, Meta, for various purposes, including advertising and service integration.

What exactly does WhatsApp collect about you?

Your message content itself remains end-to-end encrypted. This means only you and your recipient can read it. WhatsApp cannot. Meta cannot. This is a genuine strength. But the conversation does not end there. Every interaction generates a wealth of other information. This is metadata.

Consider what you provide just by using the app: your phone number, your profile name, your status message. Then consider what the app observes: your IP address, your device model, your operating system, battery level, signal strength. It logs how often you use the app, which features you engage with, the groups you join, the businesses you interact with. It can infer your general location, even if you do not share precise GPS data. If you upload your contacts, it knows everyone in your address book, whether they use WhatsApp or not.

This extensive collection dates back to the 2014 acquisition by Facebook, now Meta. WhatsApp was once an independent platform, built on a promise: 'No Ads! No Games! No Gimmicks!' That promise was systematically eroded. The incentives shifted. You are no longer just a user. You are a data point. One of over 2 billion active users globally, each contributing unique data points that build a comprehensive digital profile.

How is your data shared with Meta's 'Family of Companies'?

WhatsApp's privacy policy states that it shares information with other Meta companies. This 'Family of Companies' includes Facebook and Instagram. The stated reasons are broad: to operate, provide, improve, understand, customize, support, and market their services and offerings. It is about connecting your identity across their vast digital empire.

This data fusion allows Meta to refine its advertising profiles. The explicit goal is to show you more relevant ads across Facebook and Instagram, even if you do not see them directly within WhatsApp chats. Your interactions, your network, your habits — all feed a global advertising machine. It means your private communications indirectly shape the commercial messages presented to you elsewhere.

Why 'Accept or Leave' is not true consent

You remember the pop-up. The new terms. The ultimatum: accept, or lose access. This is not consent in any meaningful sense. True consent implies a free choice, an actual alternative without significant penalty. For billions, WhatsApp is the primary digital communication channel. It is how you talk to family. It is how you coordinate with colleagues. It is how you stay connected to friends across continents.

To 'leave' means to sever vital ties. It means asking everyone in your network to move to an entirely different platform. The social cost is immense. The professional cost can be prohibitive. This dynamic creates a powerful lock-in. You comply because you must. The choice is an illusion. The design works against your autonomy, not for it.

What about your backups and disappearing messages?

Even when you embrace privacy features, the unseen mechanisms persist. WhatsApp offers a 'disappearing messages' option. Messages vanish after a set time. You might believe they are truly gone. But the metadata, the timestamps, the participants — these linger. They are recorded. They outlive the visible content.

Then there are backups. WhatsApp messages are end-to-end encrypted in transit and at rest on your device. However, if you choose to back up your chat history to cloud services like Google Drive or iCloud, those backups are typically not protected by WhatsApp's end-to-end encryption. They fall under the security policies of Google or Apple. A critical vulnerability remains hidden in plain sight. This choice, often enabled by default, can expose your entire communication history to new scrutiny, a forgotten archive waiting to be found.

You close the app. You move on with your day. But does the silence mean nothing is still being observed?

Share