A lawsuit claims that WhatsApp's end-to-end encryption is a sham, and is demanding damages, but the app’s parent company, Meta, calls the claims "false and absurd."
The lawsuit was filed in a San Francisco US district court on Friday and comes from a group of users based in countries such as Australia, Mexico, and South Africa, according to Bloomberg.
As evidence, the lawsuit cites unnamed “courageous whistleblowers” who allege that WhatsApp and Meta employees can request to view a user’s messages through a simple process, thus bypassing the app’s end-to-end encryption.
“A worker need only send a ‘task’ (i.e., request via Meta’s internal system) to a Meta engineer with an explanation that they need access to WhatsApp messages for their job,” the lawsuit claims. “The Meta engineering team will then grant access—often without any scrutiny at all—and the worker’s workstation will then have a new window or widget available that can pull up any WhatsApp user’s messages based on the user’s User ID number, which is unique to a user but identical across all Meta products.
“Once the Meta worker has this access, they can read users’ messages by opening the widget; no separate decryption step is required,” the 51-page complaint adds. “The WhatsApp messages appear in widgets commingled with widgets containing messages from unencrypted sources. Messages appear almost as soon as they are communicated—essentially, in real-time. Moreover, access is unlimited in temporal scope, with Meta workers able to access messages from the time users first activated their accounts, including those messages users believe they have deleted.”
(Credit: PCMag/Michael Kan)
The lawsuit does not provide any technical details to back up the rather sensational claims. WhatsApp's end-to-end encryption has long been a major selling point. It means that Meta can’t decrypt and read your messages; the encryption keys are only stored on the devices that send and receive the messages.
"Any claim that people's WhatsApp messages are not encrypted is categorically false and absurd,” Meta told PCMag. “WhatsApp has been end-to-end encrypted using the Signal protocol for a decade. This lawsuit is a frivolous work of fiction and we will pursue sanctions against plaintiffs’ counsel."
Get Our Best Stories!
Stay Safe With the Latest Security News and Updates
Thanks for signing up!
Your subscription has been confirmed. Keep an eye on your inbox!
The lawsuit, however, accuses Meta of trying "to prevent the truth from coming out by imposing onerous nondisclosure agreements on its workers, essentially threatening the full force of one of the world’s richest companies if any of these individuals dared reveal what goes on behind closed doors at the company. These efforts have now failed, but they worked for many, many years by obscuring the truth.”
In 2021, ProPublica examined how WhatsApp’s support team can view a subset of user messages. But these messages were manually reported by users for abuse, and thus forwarded to Meta. ProPublica also found that WhatsApp can share unencrypted metadata, including location information, with law enforcement.
Recommended by Our Editors
The legal action arrives months after WhatsApp's former head of security, Attaullah Baig, filed a lawsuit that claims he tried to address "systemic cybersecurity failures" involving user data, but faced retaliation instead.
Pavel Durov, CEO of rival messaging app Telegram, also weighed in-. "You’d have to be braindead to believe WhatsApp is secure in 2026," he tweeted. "When we analyzed how WhatsApp implemented its 'encryption,' we found multiple attack vectors."
Elon Musk also joined in to argue that "WhatsApp is not secure. Even Signal is questionable." Naturally, he encouraged people to use X Chat instead. His tweet, however, was slapped with a Community Note calling it misleading. "X Chat offers e2e encryption but lacks forward secrecy: key compromise exposes all past messages. Private keys are controlled by X, protected only by a 4-digit PIN. Metadata is collected. Signal provides forward secrecy, device-only keys, and minimal metadata," the note says.
WhatsApp chief Will Cathcart also jumped into the comments. "This is totally false," he wrote to Musk. "WhatsApp can’t read messages because the encryption keys are stored on your phone and we don’t have access to them. This is a no-merit, headline-seeking lawsuit brought by the very same firm defending NSO after their spyware attacked journalists and government officials."
About Our Expert
Michael Kan
Senior Reporter
Experience
I've been a journalist for over 15 years. I got my start as a schools and cities reporter in Kansas City and joined PCMag in 2017, where I cover satellite internet services, cybersecurity, PC hardware, and more. I'm currently based in San Francisco, but previously spent over five years in China, covering the country's technology sector.
Since 2020, I've covered the launch and explosive growth of SpaceX's Starlink satellite internet service, writing 600+ stories on availability and feature launches, but also the regulatory battles over the expansion of satellite constellations, fights with rival providers like AST SpaceMobile and Amazon, and the effort to expand into satellite-based mobile service. I've combed through FCC filings for the latest news and driven to remote corners of California to test Starlink's cellular service.
I also cover cyber threats, from ransomware gangs to the emergence of AI-based malware. Earlier this year, the FTC forced Avast to pay consumers $16.5 million for secretly harvesting and selling their personal information to third-party clients, as revealed in my joint investigation with Motherboard.
I also cover the PC graphics card market. Pandemic-era shortages led me to camp out in front of a Best Buy to get an RTX 3000. I'm now following how President Trump's tariffs will affect the industry. I'm always eager to learn more, so please jump in the comments with feedback and send me tips.