Messengers
WhatsApp privacy rating
Messenger owned by Meta for text, voice and video calls, groups and channels, tied to a phone number. Personal chats and calls use the Signal Protocol for end-to-end encryption.
Summary
WhatsApp scores 22 out of 100 (grade F) on the messengers criteria. It meets 1 of 8 criteria: end-to-end encrypted by default. It partly meets independent audit. It does not meet open source, no trackers or telemetry, no ads or data sales, no phone number needed, metadata protection and decentralized. It is based in the United States: Five Eyes member; subject to the US CLOUD Act.
Score 22 out of 100. How scoring works
Criteria
- No
-
No
No trackers or telemetry Weight 3 of 3
Are the website and apps free of third-party trackers, with any analytics anonymous and any telemetry off by default?
Exodus finds no third-party tracker libraries, but the app collects usage, diagnostic and performance data that cannot be turned off and shares information with other Meta companies.
-
No
No ads or data sales Weight 2 of 3
Is the product funded without advertising, ad targeting or selling user data?
Ads are shown in Status and Channels, and information is shared with Meta companies, including for marketing.
-
Partial
Independent audit Weight 2 of 3
Has an independent security or privacy audit been published within the last three years?
NCC Group published a full review of the key transparency library only; no audit of the app or service is published.
-
Yes
End-to-end encrypted by default Weight 3 of 3
Are all chats, including groups, end-to-end encrypted by default?
Personal messages, group chats and calls are end-to-end encrypted by default; public channels are not.
-
No
No phone number needed Weight 2 of 3
Can an account be created without a phone number?
A mobile phone number is required to create an account and is shown to contacts.
-
No
Metadata protection Weight 2 of 3
Does the service minimize who-talks-to-whom metadata (for example sealed sender or no user identifiers)?
The server sees who talks to whom, and the privacy policy lists activity, contacts and connection data that WhatsApp collects.
-
No
Decentralized Weight 1 of 3
Can people run their own server or talk peer to peer?
One central service run by Meta.