More and more of our online activity is being tracked, stored, shared, and sold. We're in a constant battle to protect our data and we need more than just the best VPNs – we need a whole privacy arsenal.
The best encrypted messaging apps represent one of these tools and WhatsApp is amongst the most popular.
The app offers end-to-end encrypted messages, calls, and videos, and WhatsApp says not even it can see them.
But WhatsApp has now introduced ads into its app, breaking its founding values. Forbes reported that the introduction of targeted advertising was a factor in co-founder Brian Acton leaving the company in 2017.
Alongside ads, WhatsApp has a metadata problem. It's true that your messages are end-to-end encrypted and WhatsApp can't see them – but it can see your metadata.
All this adds up to a growing privacy problem for WhatsApp. Is it time to move to a more secure and private messaging service?
Breaking privacy promises?
On June 16, WhatsApp announced that ads were coming to the platform for the first time. Meta – which owns WhatsApp, Facebook, and Instagram – said these would appear in WhatsApp's "Updates" tab.
This tab is home to WhatsApp's "Channels" and "Status" features, which allow users to subscribe to, and see updates from, friends and public channels.
Meta has said no ads will appear anywhere else on the app. So if you don't access the "Updates" tab, your experience won't change.
But regardless of whether or not an individual user actually sees ads, their introduction is a concerning move and raises a number of privacy questions.
How are these ads implemented? What data are they using? How targeted are they? Anywhere targeted advertising is present, personal data is being exploited.
Meta says it has "built these features in the most privacy-oriented way possible." It says "limited" personal data will be used, and includes a user's country or city, language, the "Channels" they're following, and how they interact with ads seen.
Your phone number will reportedly never be shared or sold to advertisers. Meta said your personal messages will not be used to generate the ads you see.
Meta also said that if you have added WhatsApp to Meta's Account Centre, it will use your ad preferences and information from all your Meta accounts.
Meta oversees a technological monopoly and it's highly likely you will have an account on at least one of its services – if not many. This therefore raises the question of data sharing across Meta platforms.
Data sharing across Meta platforms
WhatsApp's Help Center says "access to WhatsApp personal data is restricted so it cannot be used by other Meta apps – including for ads." It lists user numbers, user safety, and optional features as exceptions to this rule.
If you connect WhatsApp to your Meta Account Centre, then more data will be collected.
As well as the data collection listed in WhatsApp's privacy policy, the following data will be collected by WhatsApp:
- Device and connection information
- Usage and log information about how WhatsApp in Accounts Centre is performing
WhatsApp will also receive data from other Meta companies, including:
- Account information and identifiers
- Device and connection information
- Your age (as stated on other Meta accounts)
When you add WhatsApp to your Accounts Centre, Meta receives the following data:
- Account information, including phone number and profile picture
- Age information (if provided)
- User content, including status updates
- Device and connection information
- Usage and log information
- "Channel" usage data
Meta says it will use the data it collects on you to "provide, personalise and improve its products and services and this is described in its privacy policy. Your data will be used to show you ads, measure performance, and provide personalized features.
According to Meta's Full Year 2024 Results, the company's revenue was approximately $164.5 billion and its net income was approximately $62.3 billion.
It has been reported that Meta's Facebook and Instagram advertising accounts for approximately 98% of its revenue. Ads mean big bucks for Meta, and now WhatsApp is getting in on the act.
Let's talk metadata
There are some ways you can protect your personal data from being collected and used by Meta's advertising, such as opting out of optional features and not linking WhatsApp to your Accounts Centre.
Metadata could be described as data about data. It can reveal information about who you are communicating with, including:
- Geolocation
- IP address
- Date and time of messages
- File size
- Device identifiers
- Who sent and received messages
However, metadata is something that can't be avoided. WhatsApp (and Meta) is collects a lot of it and, as detailed in WhatsApp's privacy policy, it now shares data with Meta.
The privacy policy was updated in 2021, but it was reported that this sharing of data had been taking place since 2016.
WhatsApp remains end-to-end encrypted and your messages are secure. WhatsApp says your messages are stored on your device, and not typically stored on its servers.
But this security doesn't extend to metadata. The data about who you communicate with, the time, date, and location you're doing it, and from what device can be seen and shared.
With metadata, the actual content of the message becomes redundant. Anyone who is the target of authorities can be identified, and potentially prosecuted, through metadata alone.
Its collection also poses a danger to activists, whistleblowers, journalists, or anyone living under internet censorship. Identification of these individuals could have devastating consequences.
Recent proposals to extend Swiss surveillance laws have come under fire because metadata isn't protected. Switzerland has long been known as a privacy-focused country and this is a dangerous step to take.
Swiss-based VPN providers Proton VPN and NymVPN, along with secure messaging app Threema, have been very vocal in their opposition to this law change. But privacy providers have clashed over the law – most notably Proton VPN and Infomaniak.
Metadata should never be collected and when it is, privacy is at risk. The most private VPNs never collect, store, or share any of your browsing data – and this includes metadata.
At most, your connecting IP address, device ID, and/or payment information is known. But nothing is collected once you're connected to the VPN and this data is never shared. This is assessed during audits of no-logs policies, but it's important to know the difference between no-logs and zero-logs VPNs.
Privacy providers react
Proton has been very vocal in its opposition to WhatsApp's metadata collection. On X (Twitter) its account can be seen replying to WhatsApp's tweets and ads about its privacy.
Tom's Guide contacted Proton to discuss the erosion of WhatsApp's privacy credentials. Raphael Auphan, COO of Proton, said:
"Put simply, this is a major privacy red flag."
"WhatsApp was marketed to users as a secure, ad-free space. Now, Meta is trying to squeeze profits from the one platform it hadn't fully monetised. It's bait-and-switch tactics in action."
"Metadata can still be used to create a detailed picture of you and your patterns – your locations, activities, who you're talking to, language data, and how often. These can all be used to profile users to profit off them."
"A huge risk is erosion of trust. WhatsApp was once seen as a private space – ads signal a shift towards surveillance-based monetisation."
"Put simply, this is a major privacy red flag."
Raphael Auphan, Proton COO
"Users may not fully understand how much can be gained from metadata, which is not protected by encryption, and it's on Meta to explain that. But also, once the infrastructure for targeted ads is in place, it's only a matter of time before that data is used more aggressively or leaks."
Alternatives to WhatsApp
WhatsApp is incredibly popular – especially in the UK and Europe – but there are more private and secure alternatives. We've listed a few below:
Signal
Signal is a popular, free-to-use messaging app that is protected by excellent encryption. Its Signal Protocol is open source, allowing it to be inspected by anyone but the app itself hasn't been audited.
It keeps little to no metadata – something proven in court – and all messages, videos, calls, and group chats are covered by end-to-end encryption.
Signal's big downside is the fact it requires a phone number to sign up and match contacts.
Threema
Threema is based in Switzerland and end-to-end encrypts all your messages, calls, groups, and videos. It claims you can message anonymously and collects very little metadata. Its apps are all open source and have undergone independent audits.
You don't need a phone number or email address to sign up but Threema's big downside is it's not free. There's a one off payment of $6, which isn't eyewatering in the grand scheme of things, but may be a contributor to Threema's smaller user base.
Session
Session is based on Signal and has some of the most privacy-focused features of any of these apps.
It's end-to-end encrypted, hides IP addresses, and collects almost no metadata. It's been audited and doesn't require a phone number or email address – you're instead provided with a random Session ID.
Session operates a decentralized onion network – like Tor – and this greatly improves the app's security, privacy, and anonymity.
The biggest problem with Session is there have been reports of bugs in the past.
Other WhatsApp-altermatives are Wire, Element, Olvid, and Telegram. However Telegram isn't end-to-end encrypted by default and there are concerns around metadata collection.
Proton has produced a detailed comparison of some of the best WhatsApp alternatives.
Is it time to ditch WhatsApp?
If you're concerned about your privacy, then yes. The privacy foundations WhatsApp was built on have been eroded away and it is now becoming another cog in the Meta anti-privacy machine.
Your messages remain secure and encrypted (for now) but the rest of your data is at risk. Ads are the latest introduction and it's unlikely Meta will stop there. Meta profits off your data and has poor data privacy practices.
But there are alternatives to WhatsApp that can be used alongside a VPN to protect yourself and your data online.
We test and review VPN services in the context of legal recreational uses. For example: 1. Accessing a service from another country (subject to the terms and conditions of that service). 2. Protecting your online security and strengthening your online privacy when abroad. We do not support or condone the illegal or malicious use of VPN services. Consuming pirated content that is paid-for is neither endorsed nor approved by Future Publishing.
You must confirm your public display name before commenting
Please logout and then login again, you will then be prompted to enter your display name.