You send a photo of your ID card to your accountant, a bank statement to your partner, a temporary password to a colleague. All of this is transmitted via WhatsApp, often without a second thought. The end-to-end encryption, displayed at the start of each conversation, gives the impression that these exchanges are secure. The reality is more nuanced, and certain blind spots deserve attention.
Cloud Backup: The Link That End-to-End Encryption Does Not Cover
End-to-end encryption protects messages during transit. In practical terms, neither WhatsApp nor Meta can read the content of a conversation while it is in transit. The problem arises afterward.
When you enable automatic backup on Google Drive or iCloud, the chat history leaves the scope of transit encryption. By default, these copies do not benefit from the same level of protection. They are stored on Google or Apple servers, subject to their own access conditions, including in the event of a judicial requisition.
WhatsApp has been offering an end-to-end encrypted backup option for several months, protected by a password or a 64-digit key. You can activate it in the app settings, under Chats then Backup. Those analyzing WhatsApp security with Bewise detail this mechanism and its concrete implications well.
The catch: if you lose this password, the backup becomes unrecoverable. WhatsApp cannot reset it for you. The operational advice is therefore twofold: enable backup encryption, then store the secret in a reliable password manager that is accessible in case of a phone change.
WhatsApp Metadata: What Meta Collects Even with Encryption
People often focus on the content of messages. The content is encrypted, true. What is not encrypted are the metadata: who speaks to whom, at what time, from which device, how often, in which group.
This information is enough to create a detailed behavioral profile. An employer who exclusively communicates with a recruitment agency between 12 PM and 2 PM, a patient who contacts a specialist at regular intervals: the metadata tells a story that encryption does not mask.
Meta uses this metadata to feed its advertising ecosystem. WhatsApp’s privacy policy states that certain data is shared with other entities in the group (Facebook, Instagram). GDPR limits this practice in Europe, but does not eliminate it entirely.
What Metadata Reveals Without Reading a Single Message
- The contact network: the list of numbers with which one exchanges, the frequency and duration of interactions, the groups to which one belongs
- Connection habits: active hours, time spent on the app, type of device and operating system version
- Indirect location: the IP address at the time of connection allows estimating the geographical area, even without enabling location sharing
GDPR Fine and Transparency: What European Regulation Changed
In 2021, the Irish Data Protection Commission imposed a fine of 225 million euros on WhatsApp. The complaint was about the failure to comply with transparency obligations under GDPR, not about the content of the messages themselves.
WhatsApp did not sufficiently inform users about how their data was processed and shared with Meta. The issue was the lack of clarity, not a technical flaw.
The Court of Justice of the European Union subsequently confirmed, in February 2026, that binding decisions from the European Data Protection Board could be challenged directly before European courts. WhatsApp’s appeal on the merits was still under review at that date. This litigation shows that the regulatory battle is not only about what WhatsApp does with your data but also about what the app tells you about it.
WhatsApp Privacy Settings: Settings to Check Now
Rather than listing generic advice, we focus on settings that have a real impact and that most users leave by default.
Two-Step Verification
Accessible in Settings, then Account. You set a six-digit PIN that is requested periodically and whenever registering the number on a new device. This is the most effective protection against account hijacking, a common phishing technique where a third party attempts to register your number on their own phone.
Profile and Status Visibility
By default, the profile photo, status, and last seen time are visible to all contacts. You can restrict each of these elements to “My Contacts” or “Nobody” in the privacy settings. This is not a gimmick: the last seen time, combined with other information, facilitates social engineering.
Disappearing Messages
You can enable automatic disappearance of messages after 24 hours, 7 days, or 90 days, on a conversation-by-conversation basis or by default for all new chats. For exchanges containing sensitive documents (ID cards, bank details), the disappearing mode limits the exposure window in case of unauthorized access to the phone.
- Enable end-to-end encrypted backup and store the password in a dedicated manager
- Set up two-step verification with a six-digit PIN
- Restrict the visibility of the profile photo, status, and last seen time
- Use disappearing messages for any sensitive document sending
WhatsApp offers a higher level of protection for message content than many mainstream messaging services. The concrete limit lies with metadata, unencrypted cloud backups by default, and the lack of transparency regarding data sharing with Meta. Real security depends as much on the settings you enable as on the encryption itself.
