US Class Action Lawsuit Alleges WhatsApp, Meta Can Access Encrypted Messages

A class action lawsuit filed recently in a US federal court in California accuses Meta Platforms Inc. and its subsidiary WhatsApp LLC of misleading users worldwide about the privacy of their messages.

The case focuses on WhatsApp's repeated promise that messages sent on the platform are protected by end-to-end encryption and cannot be accessed by anyone other than the sender and the recipient, not even WhatsApp or Meta.

The plaintiffs say that promise is false.

According to the complaint, WhatsApp and Meta allegedly store and can access the contents of users' encrypted messages, including messages users believe they have deleted. It alleges that this access is available through internal tools used by Meta employees.

“Meta's and WhatsApp's claim that they do not have access to the substance of WhatsApp users' communications is false.”, the pleadings say

The lawsuit has been filed by plaintiffs from several countries, including India, Australia, Brazil, Mexico and South Africa, on behalf of similarly placed WhatsApp users worldwide, subject to exclusions under WhatsApp's terms of service.

The complaint describes how Meta employees can allegedly obtain access to WhatsApp messages by submitting an internal request, known as a “task”, to an engineer, stating that access is needed for work purposes. Once access is granted, the employee can allegedly pull up a user's messages using a unique identification number shared across Meta's platforms.

The messages, the complaint claims, appear without any separate decryption step and can be viewed in near real time. Access is not limited by time and allegedly extends back to the moment a user first activated their account.

The plaintiffs say WhatsApp never disclosed this level of access to users. Instead, they argue, the company repeatedly assured users that it does not store delivered messages and cannot read them.

The complaint points to WhatsApp's public statements, privacy policies, in-app notifications and explanations provided to users, all of which emphasised that end-to-end encryption keeps messages private even from WhatsApp itself.

It also relies on public statements made by Meta's founder and chief executive officer Mark Zuckerberg, including sworn testimony before the United States Senate.

During that hearing, Zuckerberg told lawmakers that Meta cannot see the contents of WhatsApp messages.

“We do not see any of the content in WhatsApp; it is fully encrypted.”

The plaintiffs say users around the world relied on these assurances when choosing WhatsApp for private communication. They argue that users were drawn to the platform because of its repeated privacy claims and that this trust played a key role in WhatsApp's widespread adoption.

The complaint says this trust mattered most for journalists, activists, and people living under authoritarian regimes, where any access to private communications can have serious consequences.

The lawsuit is built around the US Wiretap Act, which bars the unauthorised interception of electronic communications, and also accuses the companies of violating state privacy laws, breaching user contracts, and engaging in unfair trade practices.

The plaintiffs are asking the court for damages, orders to stop the alleged practices, and clear disclosures about what access WhatsApp and Meta have to users' messages. They want the court to restrain the alleged practices and require Meta and WhatsApp to clearly state what access, if any, the company has to users' messages.

“This lawsuit seeks to expose the fundamental privacy violations and fraud Meta is perpetrating against the billions of people worldwide who have used WhatsApp believing their communications would be private from everyone, even from WhatsApp and Meta.”

The case is at an early stage and will now proceed before the United States District Court for the Northern District of California.