Facebook Messenger

Is Facebook Messenger safe?

Messenger is much safer for the content of your chats than it was before December 2023, when Meta turned on end-to-end encryptionEnd-to-end encryptionEncryption in which only the sender and the recipient can read a message. The company running the service cannot see its content.More in the glossary by default for personal messages and calls. Nobody, Meta included, can read those messages unless someone in the chat reports them. The weakness is everything around the message. Messenger is part of Meta's advertising business, and its App Store label lists precise location, contacts, browsing history and photos as data linked to you and used for third-party advertising.

We score it 47/100: better than the Facebook app it grew out of, well behind WhatsApp and far behind Signal.

What is encrypted and what is not

Meta's help pages define personal messages as one-to-one and group chats between personal accounts, the kind you have with family and friends. Those are being moved to end-to-end encryptionEnd-to-end encryptionEncryption in which only the sender and the recipient can read a message. The company running the service cannot see its content.More in the glossary by default, and Meta still describes it as "in the process", so the label in chat settings is what counts.

Several kinds of chat are not end-to-end encrypted:

• chats with businesses and professional accounts, including customer service
• Marketplace conversations with buyers and sellers
• job messages
• conversations with Meta AI inside Messenger

Meta says it does not use the content of personal messages to personalise ads. It does use the rest of what Messenger collects. Encrypted history is synced between devices through Secure Storage, protected by a PIN or recovery code. When Meta closed the Windows and Mac desktop apps on 15 December 2025, it told users to switch Secure Storage on first so they would not lose chats kept only on the desktop.

What Messenger collects

Apple's privacy label for Messenger is one of the longest we have seen. Under third-party advertising, Meta lists purchases and other financial information, precise and coarse location, physical address, email, name, phone number, contacts, photos and videos, search history, browsing history, user and device identifiers, product interaction and advertising data, all linked to your identity. The same list repeats for Meta's own marketing, analytics and personalisation.

Like Threads, Messenger has no "Used to Track You" section on the label, so Meta is not declaring cross-app tracking through Apple's system. The data still ends up in the same advertising profile as your Facebook account.

Scams on Messenger

Most harm on Messenger comes from fraud, not from hacking. The patterns are familiar. A Marketplace buyer asks you to confirm a code or pay a "delivery fee". A hijacked friend's account asks to borrow money urgently. A fake airline or bank support page moves the conversation into a private chat. Encryption cannot help with any of these, because you are talking to the scammer directly.

Meta began testing scam warnings in Messenger in October 2025. When a new contact sends a message that looks like a common scam, such as a suspicious job offer, Messenger offers to send recent messages for an AI review, then suggests blocking or reporting. It expanded the feature to more countries in March 2026. Meta said in March 2026 that it had taken down 10.9 million Facebook and Instagram accounts linked to criminal scam centres.

Meta's regulatory record

Messenger shares Meta's record. The FTC imposed a $5 billion penalty and a 20-year privacy order on Facebook in 2019. Ireland's Data Protection Commission fined Meta €1.2 billion in 2023, €265 million in 2022 after data scraping, and €251 million in 2024 over a 2018 breach. In May 2023 the FTC said Meta had broken its order, including by misleading parents about Messenger Kids, where from late 2017 to mid-2019 children could join group chats and group video calls with contacts parents had not approved. The FTC proposed banning Meta from making money from minors' data. Meta has contested the proposal.

How to use Messenger more safely

1. Open any chat's settings and check for the "End-to-end encryptedEnd-to-end encryptionEncryption in which only the sender and the recipient can read a message. The company running the service cannot see its content.More in the glossary" label before sharing anything sensitive.
2. Set up Secure Storage with a PIN, and keep the recovery code somewhere safe.
3. Turn on two-factor authenticationTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary or a passkeyPasskeyA way to sign in without a password. Your device holds a key tied to one website or app and unlocks it with your fingerprint, face or PIN.More in the glossary in Accounts Center. Hijacked accounts are used to scam your friends.
4. Never send a verification code to anyone, and treat any Marketplace request to pay outside Facebook's checkout as a warning sign.
5. In Messenger's privacy settings, limit who can send you message requests, so people you do not know cannot reach your main inbox.
6. In Accounts Center, review ad preferences and the activity Meta receives from other websites and apps.

How we scored it

Security (72) is Messenger's strongest factor thanks to default encryption, held back by the gaps for business, Marketplace and Meta AI chats. Privacy (30) is low because of how much data the label links to you for advertising, and regulatory record (10) reflects Meta's fines and orders. Scams and harmful content (45) sits between WhatsApp and Facebook.