One of the privacy features WhatsApp promises users is end-to-end encryption. Now, a new lawsuit is challenging this promise head-on.
Filed in a US federal court in San Francisco, the case brings together plaintiffs from Australia, Brazil, India, Mexico, and South Africa who say WhatsApp’s privacy promises don’t match how the system actually works. This lawsuit's major contention centres on end-to-end encryption, a feature WhatsApp has made foundational to its identity.
Inside the app, users are told that “your personal messages, photos, calls, and more stay between you and the people you choose.” The lawsuit argues that this assurance is misleading, alleging that Meta and WhatsApp “store, analyse, and can access virtually all of WhatsApp users’ purportedly ‘private’ communications.” The plaintiffs cite “whistleblowers” as the source of this evidence.
If these claims are true, that would cut directly against the expectation many users have built their private and professional conversations around. The plaintiffs frame this as a breach of trust affecting billions of people who believed their chats disappeared once delivered.
Meta has dismissed the allegations outright. In a statement, spokesperson Andy Stone said: “Any claim that people’s WhatsApp messages are not encrypted is categorically false and absurd. WhatsApp has been end-to-end encrypted using the Signal protocol for a decade. This lawsuit is a frivolous work of fiction.”
He added that the company intends to pursue sanctions against the plaintiffs’ counsel. Still, the lawsuit lands at an uncomfortable moment for Meta. It arrives months after WhatsApp’s former head of security filed his own legal action, alleging unresolved cybersecurity issues and retaliation. At the same time, rivals are seizing the opportunity to question WhatsApp’s credibility.
Telegram CEO Pavel Durov publicly mocked WhatsApp’s security claims, saying, “You’d have to be braindead to believe WhatsApp is secure in 2026. When we analysed how WhatsApp implemented its ‘encryption,’ we found multiple attack vectors.”
Elon Musk also weighed in, casting doubt on WhatsApp and Signal while promoting X’s messaging tools, writing, “WhatsApp is not safe and Signal is controlled by the woke mob. Use 𝕏 Chat.” His comments prompted a response from WhatsApp chief Will Cathcart, who said:
“This is totally false. WhatsApp can’t read messages because the encryption keys are stored on your phone and we don’t have access to them. This is a no-merit, headline-seeking lawsuit brought by the very same firm defending NSO after their spyware attacked journalists and government officials.”
Kelechi Edeh
Encryption debates often sound abstract, but the stakes are personal. These apps hold family conversations, business negotiations, political organising, and intimate moments. The lawsuit forces a broader question into the open: is privacy defined by cryptography alone, or by how companies architect, operate, and govern the systems around it?
