WhatsApp and its parent company Meta Platforms are facing a new class‑action lawsuit in California that claims the messaging giant has misled users for years about the privacy and security of their encrypted conversations.
The suit, filed on Friday in the U.S. District Court for the Northern District of California, alleges that WhatsApp’s public assurances about end‑to‑end encryption do not match its internal data‑handling practices.
What the Lawsuit Claims
Filed on behalf of plaintiffs from Australia, Brazil, India, Mexico, and South Africa, the complaint accuses Meta and WhatsApp of:
- Storing copies of messages on company servers beyond what is needed for delivery
- Analysing message content for internal research, algorithm training, and advertising‑related functions
- Allowing employee and contractor access to unencrypted or decrypted messages
- Misleading users by repeatedly promoting WhatsApp as a secure, “end‑to‑end encrypted” messaging platform
The plaintiffs argue that WhatsApp’s marketing gives consumers the impression that Meta has zero visibility into message content, when, according to whistleblowers cited in the suit, the company “retains access well beyond what users are told.”
Meta Responds: ‘Categorically False’
Meta has rejected the allegations outright.
A spokesperson said:
“WhatsApp is end‑to‑end encrypted by default using the Signal Protocol. Only the sender and recipient can read messages. Meta does not have access to message content, and we will vigorously defend against these baseless claims.”
Meta insists it does not possess the decryption keys needed to access messages, and emphasises that cloud backups stored in iCloud or Google Drive are encrypted by those providers, not Meta.
Technical and Legal Landscape
WhatsApp adopted the Signal Protocol for end‑to‑end encryption in 2016, which ensures message content can be decrypted only on end‑user devices.
However, WhatsApp still collects metadata — such as timestamps, phone numbers, IP addresses, and usage information — which the lawsuit does not distinguish clearly from content.
Legal analysts note the lawsuit provides no new technical evidence demonstrating Meta can decrypt messages. Instead, it relies heavily on whistleblower statements alleging internal access. Past cases challenging encryption claims have struggled without forensic cryptographic proof.
If approved as a class action, the case could involve millions of WhatsApp users globally. Plaintiffs are seeking damages, changes to WhatsApp’s privacy disclosures, and injunctive relief.
Broader Privacy Implications
The case adds to growing scrutiny of Meta following global regulatory crackdowns between 2023 and 2025 on data use, targeted advertising, and transparency.
It also revives the debate over whether large messaging platforms can fully uphold end‑to‑end encryption while also meeting responsibilities around harmful content, moderation, and legal compliance.
Meta is expected to file a motion to dismiss in the coming weeks. A hearing date has not yet been scheduled.
