A new class-action lawsuit accusing WhatsApp of secretly reading users’ messages has set off a wave of skepticism from cryptographers and privacy lawyers — and raised fresh questions about evidence, timing and what end-to-end encryption (E2EE) really guarantees. What the lawsuit claims - Filed in federal court in California, the suit alleges Meta and WhatsApp maintain internal tools that let employees access private message content, contradicting WhatsApp’s long-standing public promise that messages are end-to-end encrypted and unreadable by the company. - Plaintiffs from Australia, Brazil, India, Mexico and South Africa seek to represent non-U.S. and non-European WhatsApp users dating back to 2016. The complaint cites alleged “siloed” internal teams, the lack of an open-source or independently auditable messaging stack, and points to statements by Mark Zuckerberg that WhatsApp cannot read messages. - Legal causes of action include violations of federal and California privacy laws, breach of contract, unjust enrichment and unfair competition. Why technologists are unconvinced Cryptographers contacted by Decrypt say the complaint doesn’t show a clear technical path for Meta to routinely access the plaintext of WhatsApp messages. - Matthew Green, a cryptography professor at Johns Hopkins, says the most plausible large-scale exposure would be unencrypted cloud backups stored with third-party providers such as Google or Apple — systems outside Meta’s control. He adds that an in-app “backdoor” is theoretically possible but would likely be discoverable through reverse-engineering, and the plaintiffs’ lack of specific technical claims suggests they haven’t found one. - Nick Doty, technologist at the Center for Democracy and Technology, warned outsiders don’t have full visibility into proprietary systems but described the lawsuit’s sweeping allegation — that Meta can access all messages directly — as unlikely. He also noted that E2EE doesn’t protect against other real-world risks, like malware on a user device or users voluntarily reporting content, but said the complaint appears to be alleging something broader than those scenarios. Legal and timing questions Privacy lawyers say the filing may be thin on facts needed to survive early court scrutiny. - Maria Villegas Bravo of the Electronic Privacy Information Center said the complaint lacks factual detail about WhatsApp’s software and flagged unusual timing: the suit arrives while WhatsApp is still litigating against NSO Group, the maker of Pegasus spyware. That separate case involved NSO abusing infrastructure to install malware without breaking WhatsApp’s encryption; in May 2025 NSO was ordered to pay WhatsApp more than $167 million for unlawfully targeting over 1,400 users. - Villegas Bravo called the litigation’s timing “very suspicious” and said she sees little merit in the new lawsuit. Competitive noise and public reaction Executives from rival platforms have amplified the accusations without offering technical proof. - Telegram founder Pavel Durov said the allegations align with his long-standing critiques of WhatsApp’s security. - X owner Elon Musk claimed “WhatsApp is not secure” and encouraged users to switch to X’s encrypted messaging. Experts cautioned not to conflate competitive rhetoric with evidence. Meta’s response Meta has forcefully denied the suit. A spokesperson told Decrypt the claims are “categorically false and absurd,” noting WhatsApp has used the Signal protocol for end-to-end encryption for a decade and calling the lawsuit “a frivolous work of fiction.” Meta added it will pursue sanctions against plaintiffs’ counsel. Why it matters WhatsApp’s privacy promises carry outsized weight globally: roughly three billion users rely on the app, including more than 850 million in India and 148 million in Brazil. If the plaintiffs can produce concrete technical evidence that Meta reads messages at scale, the legal and regulatory fallout would be significant worldwide. But technologists and privacy lawyers say the current complaint lacks the technical specificity needed to make that case — leaving the action, for now, as much a legal and PR confrontation as a clear technical indictment. Read more AI-generated news on: undefined/news

#BTC