WhatsApp Privacy Changes Trigger a Messaging-App Migration

WhatsApp began notifying its 2 billion users on January 4, 2021 about an updated privacy policy requiring acceptance by February 8, 2021 to continue using the app (a deadline later extended to May 15, 2021 after widespread backlash). The notification was poorly worded and generated mass confusion: many users interpreted it as WhatsApp announcing that it would begin sharing the content of private messages with Facebook for advertising purposes. Social media posts warning friends to switch to Signal or Telegram spread rapidly, often citing this misunderstanding. WhatsApp published blog posts attempting to clarify that message content remained end-to-end encrypted and invisible to WhatsApp’s servers — true since WhatsApp had implemented the Signal Protocol end-to-end encryption for all personal chats in April 2016. WhatsApp had been acquired by Facebook for approximately $19 billion in February 2014, and co-founders Jan Koum and Brian Acton (who left Facebook in 2018; Acton donated $50 million to found the Signal Foundation in January 2018 alongside Moxie Marlinspike) had originally committed to maintaining WhatsApp’s privacy properties. The January 2021 policy update was primarily about WhatsApp’s Business API: companies using WhatsApp to communicate with customers (for order confirmations, customer service, etc.) would be able to store those business-customer conversations on Facebook’s infrastructure and potentially use that data for Facebook advertising targeting.

The data actually being shared under the updated policy — for users outside the EU, where GDPR constraints applied separate treatment — included: phone number, profile name, profile photo, status, last seen, device identifiers, IP address, mobile network information, operating system and app version, battery level and signal strength, browser information, mobile network, and diagnostics data from WhatsApp’s servers. It also included information about groups a user belonged to (not the contents of group messages) and frequency of interaction with contacts. Crucially, the policy did not change what WhatsApp could access regarding message content — the Signal Protocol implementation meant WhatsApp’s servers handled only encrypted ciphertext for personal chats — but it expanded how WhatsApp’s non-content metadata could be used within Facebook’s advertising systems. The distinction between content privacy (strong, through E2E encryption) and metadata privacy (limited, since WhatsApp knew who communicated with whom and when) was difficult to communicate to a general audience, and the confusion drove millions to alternatives.

Signal, developed by the non-profit Signal Foundation (whose iOS and Android open-source clients use the Signal Protocol they developed), experienced extraordinary growth: approximately 50 million new downloads in January 2021 — more than in the previous three years combined — making it the most-downloaded app in the US App Store, Germany, France, India, and dozens of other countries. Elon Musk tweeted “Use Signal” on January 7, 2021, accelerating the migration. Telegram, the partially-encrypted messaging app (personal chats are optionally E2E encrypted but group chats use server-side encryption), also saw approximately 25 million new users in 72 hours in January 2021. The episode prompted regulatory action: Germany’s Hamburg data protection authority blocked Facebook from processing WhatsApp user data in February 2021 under GDPR, and WhatsApp policy rollout for EU users continued under existing (more restrictive) data sharing terms. The WhatsApp policy controversy contributed to ongoing EU investigations into Facebook’s data practices under GDPR. For security engineers and privacy advocates, the episode demonstrated the public education challenge around the distinction between content encryption and metadata collection — strong E2E encryption protects message content while still allowing the messaging service to accumulate a social graph of communication patterns that has significant advertising, analytical, and potentially surveillance value independent of message content.