WhatsApp.
Your messages are encrypted — WhatsApp genuinely cannot read them. But everything else — who you talk to, when, how often, your entire contact list, device fingerprint, and location — goes straight to Meta §3 and feeds their ad-targeting machine on Facebook and Instagram. Government requests get your full metadata on good-faith belief alone — no warrant required §6.
TL;DR — 8 answers.
The eight things you actually want to know, at a glance.
The questions, answered.
No legalese. Every answer the way your most cynical friend would put it.
Do they sell your data?
Not in name. But your contact list, social graph, and usage patterns go to Meta — and Meta uses them for targeted ads on Facebook and Instagram. Same outcome, different word.
Are they tracking you on other sites?
WhatsApp itself doesn't run cross-site trackers. But your data feeds Meta's cross-platform ad graph, which does. The laundry gets done — just one building over.
Can your data train their AI?
Using AI at Meta features? Your data goes to Meta for AI. The policy says "to support AI features" — whether that includes model training is deliberately vague. No opt-out described.
Who can see what you do?
Message content: no one but you and the recipient. Message metadata (who, when, how often): Meta always · governments on good-faith request · businesses you message: everything.
Can you delete everything?
Deleting the app does not delete your data. You must use the in-app 'delete my account' flow. After that, metadata and logs are retained for an undefined "necessary" period.
Do they honor your opt-out?
No GPC support. No opt-out from Meta data sharing (it's framed as operational, not optional). CCPA rights exist but are buried in a separate document most users never see.
Special handling for minors?
Minimum age is 13 (16 in EU) — but that's in the Terms, not the privacy policy. The policy mentions under-18s only in the context of "legitimate interests" legal basis, not enhanced protection.
Been fined for this before?
€225M GDPR fine (2021) — second largest in GDPR history — for opacity about exactly this: data shared with Meta. Italy, UK, Germany, Turkey, and Brazil also investigated or fined.
At a glance, honestly.
Eight signals, color-coded. Like a model card for a machine — except the machine is reading your data.
The Privacy Label, honestly.
An Apple-style label for what's collected and a Cranor-style back-of-pack for what they do with it. Every cell links to the exact line in their policy.
The receipts, translated.
Five of the worst clauses, lifted verbatim. Strikethroughs are theirs. Marginalia is ours.
Dark patterns spotted.
Tricks the policy and surrounding UX use to make you "consent" without really consenting.
Your rights, by where you live.
Same company, wildly different rights depending on your jurisdiction. Direct links to the specific opt-out / delete / access flows.
- ✓ Right of access
- ✓ Right to rectification
- ✓ Right to erasure
- ✓ Right to data portability
- ✓ Right to object to legitimate interests processing
- ✓ Right to withdraw consent
Source: §7
The actual sources.
Every claim above is anchored to a line in the policy we analyzed. Click any section ID to view it in context.
SOURCE: https://www.whatsapp.com/legal/privacy-policy/ · POLICY VERSION: 2024-01-04 · SNAPSHOT HASH:
- §1End-to-end encryption"End-to-end encryption means that your messages are encrypted to protect against us and third parties from reading them."
- §2Information We Collect"We collect device and connection-specific information when you install, access, or use our Services."
- §3How We Work With Other Meta Companies"…showing relevant offers and ads across the Meta Company Products"
- §4Information You And We Share"Users, including businesses, with whom you communicate can store or reshare your information (including your messages) with others on and off our Services."
- §5AI at Meta features"If you choose to use AI at Meta through WhatsApp, Meta receives…device and connection information…to support the provision of AI at Meta features."
- §6Law, Our Rights, And Protection"We access, preserve, and share your information…if we have a good-faith belief that it is necessary to: (a) respond pursuant to applicable law or regulations, legal process, or government requests"
- §7EEA user rights (GDPR)"If you are located in the European Economic Area…you have the right to access, rectify, port and erase your information and the right to restrict and object to certain processing of your information."
- §8Managing And Retaining Your Information"We store information for as long as necessary for the purposes identified in this Privacy Policy."
- §9US Regional Privacy Notice / regulatory history"For more information about your privacy rights under US state privacy laws, please see our US Regional Privacy Notice."
- §10Assignment, Change of Control, and Transfer"In the event that we are involved in a merger, acquisition, restructuring, bankruptcy, or sale of all or some of our assets, we will share your information with the successor entities or new owners."