In short
- Cryptographers and privateness attorneys stated a brand new class motion accusing Meta of secretly accessing WhatsApp messages lacks technical element.
- Consultants stated large-scale message publicity would extra plausibly stem from user-side dangers, reminiscent of compromised gadgets.
- Issues over whether or not the grievance meets the specificity wanted to outlive early courtroom scrutiny had been additionally raised.
For years, WhatsApp has assured its roughly three billion customers that their messages are protected by end-to-end encryption—so safe that not even WhatsApp can learn them.
A new lawsuit difficult that declare is drawing swift skepticism from cryptographers and privateness attorneys, lots of whom say the allegations elevate extra questions on proof and timing than about WhatsApp’s underlying safety.
Technologists contacted by Decrypt stated they see no clear technical path for Meta to routinely entry the plaintext of WhatsApp messages, because the lawsuit alleges.
Matthew Inexperienced, a professor of cryptography at Johns Hopkins College, stated the one lifelike approach WhatsApp messages could be uncovered at scale can be by way of unencrypted cloud backups saved with third-party suppliers like Google or Apple, programs exterior Meta’s management.
“Backdoors in an app are at all times theoretically potential,” Inexperienced stated. “However they’d usually be detectable by reverse-engineering the app. The truth that the plaintiffs don’t show or declare something particular is a fairly good signal that they don’t know of a backdoor, as a result of discovering a flaw like that will make their case rather a lot stronger.”
Nick Doty, a technologist on the Middle for Democracy and Expertise, took a extra cautious view, telling Decrypt that outsiders lack full visibility into proprietary messaging programs however that the claims stay unlikely.
“I feel it’s onerous for any third celebration to have the ability to inform you with that a lot confidence,” Doty stated. “I’d be very stunned if the claims are correct.”
Doty added that encryption is just not a cure-all. Messages could be uncovered with out breaking the encryption itself, for instance, by way of malware put in on a consumer’s machine or by way of customers voluntarily reporting abusive content material. However the lawsuit seems to allege one thing broader, he stated.
“What’s described within the transient description on this go well with doesn’t appear to cowl these instances,” Doty stated. “It appears to be particular that it’s speaking about all messages, not just a few messages, and messages accessed immediately by Meta.”
Authorized consultants, in the meantime, questioned whether or not the grievance affords the specificity required to outlive early scrutiny in courtroom.
Maria Villegas Bravo, counsel on the Digital Privateness Info Middle, echoed these doubts from a authorized perspective, saying the grievance seems mild on factual element about WhatsApp’s precise software program.
“I’m not seeing any factual allegations or any details about the precise software program itself,” Villegas Bravo stated. “I’ve loads of questions that I’d need answered earlier than I’d need this lawsuit to proceed.”
Villegas Bravo additionally questioned the timing of the case, noting that it arrives as WhatsApp continues to litigate in opposition to NSO Group, the adware maker behind Pegasus.
In that case, WhatsApp accused NSO of abusing its infrastructure to ship malware to customers’ gadgets, an assault vector that didn’t contain breaking WhatsApp’s encryption.
“It’s very suspicious timing that that is taking place as that attraction is going on, as NSO Group is making an attempt to foyer to get delisted from sanctions within the U.S. authorities,” she stated, pointing to an identical lawsuit filed in Israel.
In Might 2025, NSO was ordered to pay greater than $167 million in damages to WhatsApp for unlawfully concentrating on over 1,400 customers.
“I don’t suppose there’s any advantage on this lawsuit,” Villegas Bravo stated.
Rivals weigh in
The case has additionally attracted commentary from rival messaging executives.
Telegram founder and CEO Pavel Durov wrote on X that the allegations aligned with Telegram’s previous critiques of WhatsApp’s safety, although he supplied no proof tied to the lawsuit itself.
X proprietor Elon Musk likewise claimed that “WhatsApp is just not safe,” urging customers to modify to X’s encrypted messaging function.
Neither govt substantiated their claims, and consultants cautioned in opposition to conflating aggressive rhetoric with technical proof. Nonetheless, the lawsuit lands at a delicate second for Meta, notably in rising markets the place WhatsApp dominates every day communication.
India alone accounts for greater than 850 million WhatsApp customers, with Brazil including one other 148 million, making any severe problem to the platform’s privateness guarantees consequential effectively past U.S. courts.
What’s Up?
The skepticism follows the proposed class motion’s submitting in federal courtroom in California on Friday that accuses Meta and its WhatsApp subsidiary of sustaining inner instruments that enable workers to entry personal message content material, regardless of public claims of end-to-end encryption.
The plaintiffs, together with customers from Australia, Brazil, India, Mexico, and South Africa, search to characterize non-U.S. and non-European WhatsApp customers since 2016.
The grievance alleges that Meta “siloed” inner groups in ways in which prevented workers from absolutely understanding how WhatsApp message entry labored, and that customers are compelled to depend on Meta’s public assurances as a result of WhatsApp’s full messaging stack is just not open-source or independently auditable.
It claims violations of federal and California privateness legal guidelines, breach of contract, unjust enrichment, and unfair competitors, and factors to previous public statements by Meta CEO Mark Zuckerberg asserting that the corporate can’t learn WhatsApp messages.
Meta has forcefully rejected the allegations. In an announcement shared with Decrypt, an organization spokesperson known as the claims “categorically false and absurd.”
“WhatsApp has been end-to-end encrypted utilizing the Sign protocol for a decade,” the spokesperson stated. “This lawsuit is a frivolous work of fiction, and we are going to pursue sanctions in opposition to plaintiffs’ counsel.”
Each day Debrief E-newsletter
Begin day by day with the highest information tales proper now, plus unique options, a podcast, movies and extra.