WhatsApp

Is WhatsApp safe?

Your messages are safe from Meta's eyes. Your habits are not. WhatsApp uses the same end-to-end encryptionEnd-to-end encryptionEncryption in which only the sender and the recipient can read a message. The company running the service cannot see its content.More in the glossary as Signal, switched on for every personal chat and call, so neither Meta nor a hacker on your Wi-Fi can read what you write. But Apple's privacy label for the app now lists data "used to track you" for third-party advertising, and Meta has paid or been ordered to pay large privacy fines. We score it 67/100.

For most people the practical danger is neither Meta nor spyware. It is a stranger with a convincing story asking for money or a six-digit code.

What Meta collects

Apple's App Store label lists a long set of data linked to you: phone number, email, contacts, payment information, purchase history, coarse location, user content, identifiers and diagnostic data. Coarse location, user ID, product interaction and advertising data are used for third-party advertising. This reflects the arrival of ads and promoted channels in the Updates tab in 2025. Personal chats remain ad-free.

That metadata is the gap between WhatsApp and Signal. Encryption hides the content of a message. It does not hide that you messaged a divorce lawyer at 2am every night for a week.

How strong is the security?

The core design is sound. Encryption is on by default, two-step verificationTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary adds a PIN to re-registration, and you can encrypt backups with your own password or key. The weak spots have been the app's code, which spyware companies have attacked.

In 2019, NSO Group used a WhatsApp calling flaw to install Pegasus spyware on the phones of about 1,400 users, including journalists and human rights workers. WhatsApp sued. In May 2025 a US jury awarded $167 million in punitive damages plus $444,719 in compensation, and on 17 October 2025 Judge Phyllis Hamilton permanently barred NSO from targeting WhatsApp, while cutting the total award to just over $4 million. Attacks like this target a small number of high-value people, not ordinary users.

Fines and court cases

Year	Regulator	Penalty	Issue
2021	Irish DPC (after EDPB ruling)	€225 million	Not telling users how data is shared with Meta companies
2023	Irish DPC	€5.5 million	Relying on contract to force acceptance of terms
2024	Competition Commission of India	Rs 213.14 crore	The 2021 "accept or leave" privacy policy

WhatsApp is appealing the €225 million decision, which the EU's top court sent back to the General Court. In India, an appeals tribunal lifted a five-year ban on sharing WhatsApp data with Meta for advertising in November 2025, and in February 2026 the Supreme Court told Meta during hearings that "you can't play with privacy".

Scams you will actually see

WhatsApp is where many scams end up because it is on almost every phone. The common patterns:

• "Hi Mum" or "Hi Dad". A message from an unknown number claims to be your child with a new phone and an urgent bill to pay.
• Code theft. A contact's hijacked account asks you to forward a code "sent by mistake". It is your registration code.
• Investment groups. You are added to a group of "traders" sharing profits in crypto or shares. The other members are often fake.
• Job offers. Paid tasks such as liking videos, which turn into requests to deposit money.

In March 2026 Dutch intelligence services warned that the same hijacking techniques were being used against WhatsApp and Signal accounts of officials and journalists, including requests for codes and malicious device-link QR codes.

How to make WhatsApp safer

1. Turn on two-step verificationTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary in Settings > Account > Two-step verification and add an email for PIN recovery.
2. Encrypt backups in Settings > Chats > Chat backup > End-to-end encryptedEnd-to-end encryptionEncryption in which only the sender and the recipient can read a message. The company running the service cannot see its content.More in the glossary backup.
3. In Settings > Privacy > Groups, choose My contacts so strangers cannot add you to scam groups.
4. In Settings > Privacy > Calls, turn on Silence unknown callers.
5. Check Linked devices regularly and log out of anything you do not recognise.
6. Verify any money request by calling the person on the number you already have.

How we scored it

Security (86) is strong thanks to default end-to-end encryptionEnd-to-end encryptionEncryption in which only the sender and the recipient can read a message. The company running the service cannot see its content.More in the glossary, but privacy (58) is pulled down by Meta's data collection and ad tracking, and the regulatory record (42) by three large fines in three jurisdictions. Scams and harmful content score 60. If you can persuade your contacts to switch, Signal is the more private choice. Telegram is not, because most of its chats are not end-to-end encrypted.