WhatsApp is used by more than 2 billion people across 180 countries, making it the world's most popular messaging platform. Its end-to-end encryption — powered by the Signal Protocol — genuinely protects message content. But message content is only one piece of the data picture. WhatsApp's 2021 privacy policy update sparked global outrage when it clarified just how much other information the platform collects, shares with Meta, and retains indefinitely.
What WhatsApp Actually Collects
Despite end-to-end encryption on message content, WhatsApp collects: your phone number, contacts list (uploaded to Meta servers), profile information, usage data (when you use the app, for how long, how often), device identifiers (IMEI, MAC address, mobile network info), IP address (which reveals approximate location), and transaction data if you use WhatsApp Pay. It also collects metadata: who you communicate with, when, and how frequently — even though not what you said.
This metadata is arguably more revealing than content. Former NSA Director Michael Hayden said in 2014: "We kill people based on metadata." Knowing you called a cancer clinic at 11pm, then a lawyer the next morning, tells a detailed story without a single word of content.
The 2021 Privacy Policy Controversy
In January 2021, WhatsApp announced that users must accept expanded data sharing with Meta (Facebook) or lose access to the app. The update required sharing business interaction data, IP addresses, and phone number to improve Meta ad targeting. Regulators in Turkey, India, Germany, and the UK opened investigations. India alone had 500 million WhatsApp users affected. The policy was subsequently modified — but the underlying data collection practices remained largely intact.
Backups Are the Biggest Gap
WhatsApp messages are end-to-end encrypted in transit — but when backed up to Google Drive or iCloud, they leave the Signal Protocol environment. Until 2021, Google Drive backups were stored unencrypted. Even now, while WhatsApp offers optional E2E encrypted backup, it is not enabled by default. Law enforcement regularly requests message history from iCloud and Google Drive backups rather than WhatsApp itself — because those companies are legally compelled to comply.
The lesson: encryption protects the pipe, not the endpoints. For truly private conversations, the best approach remains platforms that store no content at all — where there is nothing to back up, subpoena, or breach.