It’s important to note that the only time your communications are encrypted is when they’re in transit. They’re otherwise plain as day to see or hear. Thus, anyone who can open your phone can tap the app and access them (provided you don’t lock your phone or the WhatsApp app itself). And like any other message or photo that you send over the internet, nothing prevents the recipient from sharing your message with others by taking a screenshot or simply forwarding a photo to someone else.
With that, no form of messaging is 100% private. Not WhatsApp. Not other messaging apps like it, with or without encryption. If you want to keep something entirely private, whether it’s a photo or a message, don’t send it over the internet.
Does WhatsApp store your messages?
Generally no, yet understanding the specifics calls for diving into their privacy policy.
Once again, WhatsApp does not view your messages or listen to your calls. It only temporarily stores messages on their servers in the case of a few exceptions. As of April 2023, its policy states:
We do not retain your messages in the ordinary course of providing our Services to you. Instead, your messages are stored on your device and not typically stored on our servers. Once your messages are delivered, they are deleted from our servers.
In some cases, undelivered messages are kept in encrypted form on WhatsApp’s servers for up to 30 days or until the message is delivered. Also, WhatsApp may store media that you forward in a message temporarily in encrypted form on their servers to aid in more efficient delivery of additional forwards.
What info does WhatsApp share with Meta (Facebook and Instagram)?
Facebook (now known as Meta) purchased WhatsApp in 2014. Today, as one of the companies that falls under the Meta umbrella, WhatsApp “[R]eceives information from, and shares information with, the other Meta Companies.” Per WhatsApp’s privacy policy:
WhatsApp must receive or collect some information to operate, provide, improve, understand, customize, support, and market our Services, including when you install, access, or use our Services.
Also per its privacy policy, WhatsApp (and Meta) uses that information:
We use information we have (subject to choices you make and applicable law) to operate, provide, improve, understand, customize, support, and market our Services.
What does WhatsApp collect specifically? That may include location information if you’re using location-based services in the app. It may also include location information even if you aren’t using those services.
In addition to location information, it may also include the following:
- Hardware model and operating system information.
- App version and browser information.
- Mobile network and connection information (including phone number, mobile operator, or ISP).
- Language and time zone.
- IP address and device operations information.
- Identifiers, including identifiers unique to “Meta Company Products” associated with the same device or account.
- Usage and log information about your activity, including how you use their services, your services settings, how you interact with others using those services, and the time, frequency, and duration of your activities and interactions.
Why does WhatsApp collect this information? The company may use it for the “safety, security, and integrity” of the app experience. It may use that information for marketing purposes as well. (Think targeted ads.) Likewise, WhatsApp may share this information with select third parties for the same purposes.
So while WhatsApp may not know what’s in your messages, it potentially knows a great deal about you—like where you are, how you’re using their app, and for how long. And if you have a Facebook account, that may extend to your interests, what ads you’ve clicked on, which ones led to purchase, along with all the other information that Facebook knows about you.
This is the “value exchange” that we talk about in our blogs so often, where you gain the value of using a free app in exchange for something else, typically personal information that is used for marketing purposes. By agreeing to the terms of the user agreement you clicked when you first installed the app, you became a legally binding participant in this exchange.
A few steps for making your time on WhatsApp more private and secure.
Protect your privacy with a PIN.
For starters, you can keep a thief or snoop from getting into your phone altogether by setting a screen lock with a PIN, facial recognition, or gesture lock. Surprisingly, from our recent global research found that only 56% of adults said that they protect their smartphone with some form of a screen lock. If you find yourself among them, consider making a change. Locking your phone offers terrific peace of mind in the event your phone gets lost or stolen.
Additionally, WhatsApp also allows you to create a PIN for accessing the app itself. You can find this setting in Settings > Account > Two-Step verification. With both in place, you can effectively double-lock WhatsApp. As with any PIN, never give it out to anyone. Sharing it could compromise your security.
Enable security notifications.
WhatsApp has a setting that sends a notification in the event your security PIN code changes. If you have the app installed on multiple devices, you will need to enable it on those devices as well for it to work. You can enable this setting in Settings > Account > Security Notifications.
Lock down your privacy settings.
A quick trip to Settings > Privacy can limit what other WhatsApp users see and know about you. In that menu, you’ll see that you have several privacy options:
- Last Seen & Online
- Profile Photo
- About
- Groups
- Status
Setting these to “My Contacts” will prevent the broader WhatsApp user base from seeing this information about you. That includes potential spammers and scammers, thus taking this step can make you more private. So just in the same way we recommend that you set your social media accounts to “friends and family only,” we recommend doing the same here.
Turn off location services for WhatsApp.
Although WhatsApp can determine your location by other means, you can limit it from locating you with pinpoint accuracy by disabling location services for the app.
On an iOS device, you can do that by going into Settings > Privacy & Security > Location Services and then scrolling down until you find WhatsApp. From there, you can disable its permissions with a tap.
For Android, on your phone’s home screen, find the WhatsApp icon, then touch and hold it. Tap “App Info,” then “Permissions” then “Location.” Finally, select “Deny.”
Don’t talk to strangers—and don’t click their links.
As it is on so many platforms today, scammers abound. WhatsApp is no different, where scammers spin up bogus accounts and attempt to start conversations with other users. The way they go about it varies. They may try to kindle a romance scam, they may masquerade as a business representative, or even pose as a tax collector or other government official. The aim is always the same, though. They want to steal your personal information or trick you into forking over your money. Don’t take chances. Don’t talk to strangers.
Other scammers will send messages with malicious links. Just as you shouldn’t follow links or open files from strangers in other apps, don’t do open them on WhatsApp either. Those links are simply gateways to scam sites and malware.
Do you back up your WhatsApp chats? You’ll want to know this.
If you back up your WhatsApp message histories in the cloud with Apple or Google, they are not encrypted. Once again, you can encrypt them while they are in transit by using “End-to-End Encrypted Backup,” but the histories themselves are not encrypted when they are stored in the cloud.
For those who are particularly privacy-conscious, the idea of their messages, plus any attached photos and messages, being stored without encryption may give them pause. Even if that is in a relatively secure cloud service such as Apple’s or Google’s. Yet the risk of data breaches remains, as does the risk of a bad actor gaining access to one’s cloud account, such as through a stolen password.
So, for an increased degree of privacy and security, you may want to consider disabling cloud backup for your WhatsApp messages.
Protect your phone too.
Comprehensive online protection software can protect your phone in the same ways that it protects your laptops and computers. Installing it can protect your privacy, keep you safe from attacks on public Wi-Fi, and automatically block unsafe websites and links (like the ones that might come to you in a spammy WhatsApp message), just to name a few things it can do. In all, given how much of our lives center around our phone—shopping, finances, splitting a dinner bill with friends, and so on, protecting your phone and the things you do on it makes sense.
Know how to remotely lock or erase your phone.
There’s a good chance you’ve experienced that moment of panic—the moment when you think you’ve really lost your phone, followed by the deep relief when you finally find it. But what happens if your phone ends up getting lost or stolen? A combination of device tracking, device locking, and remote erasing can help protect your phone and the data on it.
Different device manufacturers have different ways of going about it, but the result is the same—you can you’re your phone, prevent others from using it, and even erase it if you’re truly worried that it’s in the wrong hands or simply gone for good. Apple provides iOS users with a step-by-step guide, and Google offers up a guide for Android users as well.
WhatsApp: Pretty private, to a point.
WhatsApp is indeed quite private when it comes to messages and voice communications when they are transmitted between people—yet not so much when it comes to other data that the app collects while you’re using it.
While much of that data collection occurs thanks to the terms of its user agreement and privacy policy, you can take a few steps to limit it to a degree. You can take yet more steps that can make the time you spend on WhatsApp more secure as well.
As with any free app, using it involves some sort of value exchange. Understanding what information the app does and does not collect can help you determine if that value exchange is right for you.
Stay Updated
Follow us to stay updated on all things McAfee and on top of the latest consumer and mobile security threats.
