{
  "slug": "whatsapp",
  "category": "messengers",
  "name": "WhatsApp",
  "description": "Messenger owned by Meta for text, voice and video calls, groups and channels, tied to a phone number. Personal chats and calls use the Signal Protocol for end-to-end encryption.",
  "website": "https://www.whatsapp.com",
  "license": null,
  "platforms": [
    "android",
    "ios",
    "windows",
    "macos",
    "web"
  ],
  "jurisdiction": {
    "code": "US",
    "name": "United States",
    "eyes": "Five Eyes",
    "eu": false,
    "gdpr": false,
    "cloud_act": "provider"
  },
  "pick": false,
  "pick_reason": null,
  "disclosure": null,
  "grade": "F",
  "score": 22,
  "coverage": 100,
  "summary": "WhatsApp scores 22 out of 100 (grade F) on the messengers criteria. It meets 1 of 8 criteria: end-to-end encrypted by default. It partly meets independent audit. It does not meet open source, no trackers or telemetry, no ads or data sales, no phone number needed, metadata protection and decentralized. It is based in the United States: Five Eyes member; subject to the US CLOUD Act.",
  "url": "https://privacyratings.com/messengers/whatsapp/",
  "markdown": "https://privacyratings.com/messengers/whatsapp/index.md",
  "answers": {
    "open_source": {
      "title": "Open source",
      "weight": 3,
      "answer": "no",
      "evidence": null,
      "note": "Closed source."
    },
    "no_trackers": {
      "title": "No trackers or telemetry",
      "weight": 3,
      "answer": "no",
      "evidence": "https://www.whatsapp.com/legal/privacy-policy",
      "note": "Exodus finds no third-party tracker libraries, but the app collects usage, diagnostic and performance data that cannot be turned off and shares information with other Meta companies."
    },
    "no_ads": {
      "title": "No ads or data sales",
      "weight": 2,
      "answer": "no",
      "evidence": "https://www.whatsapp.com/legal/privacy-policy",
      "note": "Ads are shown in Status and Channels, and information is shared with Meta companies, including for marketing."
    },
    "independent_audit": {
      "title": "Independent audit",
      "weight": 2,
      "answer": "partial",
      "evidence": "https://www.nccgroup.com/media/phzpm0qv/_ncc_group_metaplatforms_e008327_report_2023-11-14_v10.pdf",
      "note": "NCC Group published a full review of the key transparency library only; no audit of the app or service is published."
    },
    "transparency_report": {
      "title": "Transparency report",
      "weight": 2,
      "answer": "n/a",
      "evidence": null,
      "note": "Only applies to hosted services with a website to test."
    },
    "user_notice": {
      "title": "Tells users about requests",
      "weight": 1,
      "answer": "n/a",
      "evidence": null,
      "note": "Only applies to hosted services with a website to test."
    },
    "tls": {
      "title": "TLS configuration",
      "weight": 2,
      "answer": "n/a",
      "evidence": null,
      "note": "Only applies to hosted services with a website to test."
    },
    "security_headers": {
      "title": "Security headers",
      "weight": 1,
      "answer": "n/a",
      "evidence": null,
      "note": "Only applies to hosted services with a website to test."
    },
    "web_standards": {
      "title": "Modern web standards",
      "weight": 1,
      "answer": "n/a",
      "evidence": null,
      "note": "Only applies to hosted services with a website to test."
    },
    "e2ee_default": {
      "title": "End-to-end encrypted by default",
      "weight": 3,
      "answer": "yes",
      "evidence": "https://www.whatsapp.com/privacy",
      "note": "Personal messages, group chats and calls are end-to-end encrypted by default; public channels are not."
    },
    "no_phone_number": {
      "title": "No phone number needed",
      "weight": 2,
      "answer": "no",
      "evidence": "https://www.whatsapp.com/legal/privacy-policy",
      "note": "A mobile phone number is required to create an account and is shown to contacts."
    },
    "metadata_protection": {
      "title": "Metadata protection",
      "weight": 2,
      "answer": "no",
      "evidence": "https://www.whatsapp.com/legal/privacy-policy",
      "note": "The server sees who talks to whom, and the privacy policy lists activity, contacts and connection data that WhatsApp collects."
    },
    "decentralized": {
      "title": "Decentralized",
      "weight": 1,
      "answer": "no",
      "evidence": null,
      "note": "One central service run by Meta."
    }
  },
  "tests": {
    "ssllabs": null,
    "observatory": null,
    "internetnl_web": null,
    "internetnl_mail": null,
    "trackers": null,
    "tested_at": "2026-10-01T06:38:22.700Z"
  },
  "last_modified": "2026-10-01T06:56:31Z"
}