Is WhatsApp safe?
Safe to use with care: personal chats and calls are end-to-end encrypted by default, but scammers use WhatsApp heavily and Meta still gets data about how you use it.
WhatsApp’s personal messages and calls are end-to-end encrypted, so only you and the other person can read or hear them, and this is on without any setting.
The real risks are scams and account takeovers: strangers pretending to be family, fake jobs and investments, and people tricking you into sharing the six-digit code that lets them log in as you. Meta also receives data about your account and device.
WhatsApp is owned by Meta. Outside Europe and the UK the service is run by WhatsApp LLC in California, and its privacy policy says information may be moved to and processed in the United States. WhatsApp Ireland Ltd is the company European regulators deal with.[1][2]
The real risks
What WhatsApp itself says it collects, what regulators and courts have found, its security record and the scams that borrow its name. Each line links to the page it comes from.
What it collects
From WhatsApp’s own privacy policy:
- Your mobile number and profile name (required), plus an optional profile photo and “about” text.[1]
- Phone numbers from your address book, if you choose to upload contacts and the law allows it.[1]
- Usage and log information, such as your activity, settings, interactions and “last seen”.[1]
- Device and connection details: hardware, operating system, app version, mobile network, language, time zone, IP address and device identifiers.[1]
- Precise location only with your permission; otherwise a general location worked out from your IP address and phone number area code.[1]
- Messages are not kept once delivered. Undelivered messages are held encrypted on its servers for up to 30 days.[1][3]
- For ads in Status and Channels: country code, age where applicable, device language, city or country, and what you follow or tap in those tabs. Personal messages, calls and groups are not used.[4]
App store label. Apple’s label lists no data “used to track you”. Data “linked to you” includes coarse location, phone number, email, contacts, purchase history, payment info, user ID, device ID and product interaction, some of it for third-party advertising and analytics.[5]
Regulators and courts
Fines, orders, investigations and lawsuits, newest first. A lawsuit is what the side bringing it alleges until a court decides.
| When | What happened |
|---|---|
| WhatsApp and Meta asked a US federal court to hold NSO Group in contempt, alleging NSO kept creating WhatsApp accounts and sent one-click malicious links through WhatsApp after the injunction. These are allegations; no ruling was found.[6] | |
| The court refused NSO Group’s request to pause the injunction during its appeal, allowing a final 45-day delay so NSO could ask the appeals court instead.[7] | |
| A US federal judge ordered NSO Group to stay off WhatsApp for good and cut the jury’s punitive damages from US$167,254,000 to US$4,002,471. The US$444,719 compensatory award stood.[8] | |
| A jury ordered spyware maker NSO Group to pay WhatsApp damages for using its Pegasus spyware against over a thousand WhatsApp users in 2019, after a judge had already found NSO liable for hacking.[9][8] | |
| Ireland’s Data Protection Commission fined WhatsApp Ireland €5.5 million for relying on the wrong legal basis to use people’s data for service improvement and security. WhatsApp has appealed.[10][11] | |
| Ireland’s Data Protection Commission fined WhatsApp Ireland €225 million for not clearly telling users and non-users how their data was used, including sharing with other Facebook companies. WhatsApp has appealed.[2][11] |
Breaches and security flaws
3 flaws in WhatsApp are on CISA’s list of flaws used in real attacks. Each was fixed in an update, so the answer is to keep the app up to date.
- CVE-2025-55177, added 2 Sep 2025: WhatsApp Incorrect Authorization Vulnerability.
- CVE-2019-18426, added 23 May 2022: WhatsApp Cross-Site Scripting Vulnerability.
- CVE-2019-3568, added 19 Apr 2022: WhatsApp VOIP Stack Buffer Overflow Vulnerability.
Changes that matter
- : WhatsApp’s current privacy policy took effect. It says WhatsApp shares information with other Meta companies, including to show offers and ads across Meta’s products.[1]
Scams that use WhatsApp
- Someone pretending to be family or a friend
- A message claims to be from your child, a friend or a well-known business, then asks for money or personal details. Check by calling them on a number you already have, or start a video call, before paying anything.[12]
- Verification code takeover
- Someone asks you to forward a six-digit code WhatsApp just sent you. That code lets them register your number. WhatsApp says never share it, even with friends or family.[13][12]
- Fake jobs and “task” work
- An unexpected message offers easy paid work liking videos or rating products. Small early payouts build trust, then you are told to deposit money to unlock your earnings, which never come.[14][12]
- Investment and crypto offers
- A stranger promises low-risk, high returns, often in crypto, stocks or property. Promised returns and pressure to move fast are the tell.[12]
- Romance that turns to money
- Someone builds a close relationship over chat, cancels plans to meet at the last minute, then asks for a loan or money.[12]
- Paying to use or unban WhatsApp
- WhatsApp is free. Anyone asking you to pay to keep using it or to unban your account is after your money or details.[12]
What to do
In order, with the place to find each one in WhatsApp.
- Turn on two-step verification.Settings → Account → Two-step verification → Turn on. Create a strong password and add an email address you can get into, so a stolen code alone can’t take your account.[15][16]
- Add a passkey.Settings → Account → Passkeys. You then log back in with your fingerprint, face or screen lock instead of an SMS code.[16]
- Run the Privacy Checkup.Settings → Privacy → Privacy Checkup. It walks through who can contact you, who sees your photo and last seen, chat privacy, and account protection.[17]
- Silence unknown callers.Settings → Privacy → Calls → turn on Silence unknown callers. Calls from numbers not in your contacts won’t ring but still show in the Calls tab.[18]
- Limit who can add you to groups.Settings → Privacy → Groups → choose My contacts. Others then have to send you an invite, which expires after three days.[19]
- Check linked devices.Tap ⋮ (More options) → Linked devices. Tap any computer or tablet you don’t recognise and choose Log out.[20]
- Encrypt your backups.Settings → Chats → Chat backup → End-to-end encrypted backup. Choose a passkey, password or 64-digit key. WhatsApp can’t reset it if you forget.[21]
- Keep WhatsApp updated.Install updates from the App Store or Google Play promptly. WhatsApp’s security advisories list flaws fixed in new versions, including one in 2025 it says may have been used against specific people.[22][23]
When not to use it
- Don’t send money or codes to anyone on WhatsApp until you’ve confirmed who they are by calling them on a number you already know.[12]
- For a sensitive one-to-one or group chat, turn on Restricted chat (⋮ → View contact → Restricted chat) to stop exports, auto-saving media and linked devices in that chat.[24]
What HARD couldn’t verify
Claims you may see elsewhere that HARD couldn’t confirm from a primary source on 7 Nov 2026, so they aren’t in the record above.
- Claims that WhatsApp reads personal messages to target ads: WhatsApp’s own pages say personal messages, calls and status are not used for ads, and no regulator has found otherwise.
- Reports of other spyware campaigns against WhatsApp users in 2025 come from news coverage and researchers; HARD did not confirm them from a WhatsApp or regulator page.
Questions
Is WhatsApp safe?
Yes, with care. Personal chats and calls are end-to-end encrypted by default, so WhatsApp can’t read them. The bigger risks are scams and people tricking you into handing over your login code. Turn on two-step verification and a passkey.
Is WhatsApp end-to-end encrypted?
Yes. Personal messages, photos, voice notes, calls and status updates are end-to-end encrypted automatically. Payments, and chats with some businesses that use Meta to store or answer messages, are not; WhatsApp shows this inside the chat.
Is WhatsApp safe from hackers?
Most account hacks happen when someone gets your six-digit code, so never share it and turn on two-step verification. WhatsApp has fixed serious flaws in the past, some used by spyware against targeted people, so keep the app updated.
Can WhatsApp read my messages?
Not personal chats. WhatsApp says only you and the other person hold the keys, and messages are deleted from its servers once delivered. It does see account details, device information and how you use the app.
Does WhatsApp share my data with Facebook?
Yes, some. Its privacy policy says it shares information with other Meta companies, including for offers and ads. WhatsApp says your phone number isn’t shared with Meta for ads in Status and Channels, and personal messages aren’t used.
Is WhatsApp safe for kids?
The App Store rates it 13+. Chats are private, but strangers can message anyone whose number they have, so set groups to My contacts, silence unknown callers and talk to children about scams and requests for codes.
Messaging on HARD: Is Telegram safe?. All of them: Is it safe?
References
Primary sources only: WhatsApp’s own pages, regulators, courts and app stores. Each was checked on 7 Nov 2026.
- WhatsApp. WhatsApp Privacy Policy, 4 Jan 2021. whatsapp.com, checked 7 Nov 2026
- Data Protection Commission (Ireland). Data Protection Commission announces decision in WhatsApp inquiry, 2 Sep 2021. dataprotection.ie, checked 7 Nov 2026
- WhatsApp Help Center. About end-to-end encryption. faq.whatsapp.com, checked 7 Nov 2026
- WhatsApp Help Center. About ads in WhatsApp Status and Channels. faq.whatsapp.com, checked 7 Nov 2026
- Apple. WhatsApp Messenger on the App Store. apps.apple.com, checked 7 Nov 2026
- US District Court, Northern District of California. WhatsApp v. NSO Group, plaintiffs’ motion for contempt (Dkt. 854), 8 Jun 2026. storage.courtlistener.com, checked 7 Nov 2026
- US District Court, Northern District of California. WhatsApp v. NSO Group, order denying motion to stay permanent injunction (Dkt. 824), 19 Dec 2025. storage.courtlistener.com, checked 7 Nov 2026
- US District Court, Northern District of California. WhatsApp v. NSO Group, order re motion for permanent injunction and remittitur (Dkt. 802), 17 Oct 2025. storage.courtlistener.com, checked 7 Nov 2026
- Meta. Winning the Fight Against Spyware Merchant NSO, 6 May 2025. about.fb.com, checked 7 Nov 2026
- Data Protection Commission (Ireland). Data Protection Commission announces conclusion of inquiry into WhatsApp, 19 Jan 2023. dataprotection.ie, checked 7 Nov 2026
- Data Protection Commission (Ireland). Fines. dataprotection.ie, checked 7 Nov 2026
- WhatsApp Help Center. About suspicious messages and scams. faq.whatsapp.com, checked 7 Nov 2026
- WhatsApp Help Center. Received verification code without requesting it. faq.whatsapp.com, checked 7 Nov 2026
- US Federal Trade Commission. Paying to get paid: gamified job scams drive record losses, 12 Dec 2024. ftc.gov, checked 7 Nov 2026
- WhatsApp Help Center. How to manage two-step verification settings. faq.whatsapp.com, checked 7 Nov 2026
- WhatsApp Blog. One billion people are now protected with passkeys on WhatsApp, plus more account security features, 25 Aug 2026. blog.whatsapp.com, checked 7 Nov 2026
- WhatsApp Help Center. About privacy checkup. faq.whatsapp.com, checked 7 Nov 2026
- WhatsApp Help Center. How to silence unknown callers. faq.whatsapp.com, checked 7 Nov 2026
- WhatsApp Help Center. How to change group privacy settings. faq.whatsapp.com, checked 7 Nov 2026
- WhatsApp Help Center. How to check devices linked to your account and unlink a device you don’t recognize. faq.whatsapp.com, checked 7 Nov 2026
- WhatsApp Help Center. How to back up your chat history. faq.whatsapp.com, checked 7 Nov 2026
- WhatsApp. 2025 WhatsApp Security Advisories. whatsapp.com, checked 7 Nov 2026
- WhatsApp. WhatsApp Security Advisories archive. whatsapp.com, checked 7 Nov 2026
- WhatsApp Help Center. About restricted chat. faq.whatsapp.com, checked 7 Nov 2026