Meta faces lawsuit alleging it can access WhatsApp private messages despite end-to-end encryption claims

An international group of WhatsApp users has filed a lawsuit against Meta Platforms Inc accusing the company of misleading billions of users worldwide by claiming that messages on the popular messaging app are protected by end-to-end encryption and inaccessible to the company.

The complaint, lodged on January 23 in the U.S. District Court in San Francisco, alleges that Meta and WhatsApp store, analyze, and can access virtually all of WhatsApp users’ purportedly ‘private’ communications,” in violation of the company’s public assurances.

Plaintiffs from Australia, Brazil, India, Mexico, and South Africa are seeking damages and class-action status to represent global users.

WhatsApp has promoted end-to-end encryption as a core feature since 2016, using the Signal protocol.

The app displays notices stating that only people in this chat can read, listen to, or share messages, and its website asserts: “No one outside of the chat, not even WhatsApp, can read, listen to, or share your messages.”

The lawsuit cites information from unnamed courageous whistleblowers alleging that Meta employees can request and obtain access to users’ messages via internal systems, often without strict oversight.

Read also: EU gives WhatsApp until May to comply with Digital Services Act rules

According to the 51-page filing, workers can submit a task to engineers, who then grant access to a widget displaying messages by user ID, bypassing any decryption step.

Meta strongly rejected the allegations. “Any claim that people’s WhatsApp messages are not encrypted is categorically false and absurd. WhatsApp messages have been end-to-end encrypted using the Signal protocol for a decade, meaning that when you send a message, it is stored on your device and the recipient’s device only, not on WhatsApp or Meta servers in a readable form,” Andy Stone, Meta spokesperson said in a statement.

“The company described the suit as frivolous and indicated it would seek sanctions against the plaintiffs’ counsel.

Privacy experts have long noted that true end-to-end encryption prevents service providers from reading message content in transit or at rest, with keys held only on users’ devices.

However, the lawsuit focuses on alleged internal practices that could undermine those protections.The case adds to ongoing scrutiny of Meta’s privacy practices.

It follows earlier whistleblower allegations related to data handling at the company, though no independent technical evidence has yet emerged to substantiate the claims in this filing.

A representative for the plaintiffs did not immediately respond to requests for comment. The lawsuit seeks unspecified damages for alleged fraud and deceptive practices.