The little green lock that's supposed to keep your WhatsApp messages private? A new lawsuit says it might not be doing what Meta promised.
An international group of users has sued Meta Platforms, claiming the company can "store, analyze, and can access virtually all of WhatsApp users' purportedly 'private' communications" despite years of assurances that end-to-end encryption (a security method where only you and your recipient can read messages) keeps conversations sealed tight.
The class-action complaint, filed in San Francisco federal court on Friday, challenges the core promise that's helped WhatsApp become the world's most popular messaging app with over 2 billion users. Plaintiffs from Australia, Brazil, India, Mexico, and South Africa argue that when you see "only people in this chat can read, listen to, or share" your messages, that's not the whole story.
The Backdoor Claim
The lawsuit goes beyond typical privacy concerns. It alleges Meta has built what amounts to a "backdoor" that grants it access to messages on user devices, effectively bypassing the security it touts as absolute. The complaint, citing unnamed whistleblowers, suggests the company can access content before encryption or after decryption happens on your phone.
Meta's response? Emphatic denial. Spokesperson Andy Stone dismissed the suit as "frivolous" and "absurd," noting WhatsApp has used the Signal protocol for end-to-end encryption for a decade. The company even threatened sanctions against the plaintiffs' attorneys.
What's Really at Stake
Even if Meta can't read your actual messages, the lawsuit highlights a less-discussed privacy concern: metadata. This includes who you talk to, when, from where, and for how long — details that privacy experts warn can paint an intimate portrait of your life.
The timing is notable. Recent security research exposed vulnerabilities affecting WhatsApp's 3.5 billion registered accounts, and concerns are mounting over WhatsApp Business operations and Meta AI integration that may not enjoy the same encryption protections as personal chats.
What You Can Do Now
While the lawsuit works its way through court, here's how to protect yourself:
Lock down your settings: Review who can see your profile photo, status, and last-seen timestamp in WhatsApp's privacy controls. These are visible by default.
Skip the cloud backup trap: Chat backups to Google Drive or iCloud aren't end-to-end encrypted unless you manually enable it using a passkey — a feature Meta rolled out in late 2025.
Watch the metadata: Remember that even with encryption, WhatsApp collects your phone number, device type, IP address, and who you contact. This information can be shared across Meta's platforms if you enable Account Center integration.
Consider alternatives: Apps like Signal offer similar features with less corporate data collection, since they're not tied to an advertising-driven company.
The case will likely hinge on whether plaintiffs can produce technical evidence of the alleged backdoor — a tall order when dealing with proprietary code. But win or lose, it's forcing an overdue conversation: Can a company built on data collection be trusted with your most private conversations?
For now, that green lock might offer less protection than you think.