WhatsApp encrypts your messages. But it does not encrypt who you talk to, when, how often, or from where. That is called metadata. And metadata, when properly analyzed, reveals almost everything.
What Data Does WhatsApp Collect?
From the moment you accept the terms of service, this is what gets logged:
Your number and all your contacts' numbers
Even contacts who do not have WhatsApp are stored on their servers.
Last seen, profile photo, and about info
Visible by default to everyone — not just your contacts.
Conversation metadata
Who you talk to, how frequently, at what time, for how long. Not the content — the context.
Your IP address
Can reveal your approximate location even if you do not share live location.
Device information
Model, operating system, battery level, carrier, and signal strength.
Usage diagnostics
Activity logs inside the app, crashes, and time spent per feature.
The content of messages is protected by end-to-end encryption. But metadata is not. Metadata, when properly analyzed, reveals almost everything.
The Problem with Meta
WhatsApp has belonged to Meta since 2014. That means your activity in the app can be linked to what you do on Facebook and Instagram to construct a more complete advertising profile.
In 2021, WhatsApp updated its privacy policy to share more data with Meta. The European Union blocked that update. In Ecuador and most of Latin America, it took effect without restrictions.
This is not a hypothesis — it is part of the business model of a company that generated over $130 billion in advertising revenue in 2023.
What You Can Control
Actionable settings that minimize your exposure without forcing you to quit using the app.
Account Privacy
Last seen & online
Settings → Privacy → Last seen & online
Profile photo & About
Settings → Privacy → Profile photo / About
Groups
Settings → Privacy → Groups — prevents people from adding you without consent
Silence unknown callers
Settings → Privacy → Calls
Active Security
Two-step verification
Settings → Account → Two-step verification
Linked devices
Settings → Linked devices — log out of any sessions you do not recognize
Fingerprint lock or Face ID / PIN
Settings → Privacy → App lock / Fingerprint lock
Backups & Messages
End-to-end encrypted backup
Settings → Chats → Chat backup → End-to-end encrypted backup — backups on Google Drive or iCloud are not encrypted by default
Disappearing messages
In sensitive chats → tap contact name/icon → Disappearing messages
What You Cannot Control
There are clear limits to what privacy settings can achieve.
For high-sensitivity communications
For financial information, medical records, or legal agreements, alternatives with stronger privacy architectures exist. Signal belongs to no ad conglomerate and collects zero usage metadata.
The Conclusion
Digital privacy is not paranoia. It is hygiene.
Just as you would not leave your wallet lying on a table in a public place, you should not leave your personal data unconfigured on an app used by 2 billion people. It is not about mistrusting WhatsApp. It is about understanding what you are giving away and making informed decisions.
This article is part of the #UrbaInsights series, where we share practical analysis on cybersecurity and digital privacy for individuals and organizations across Ecuador and Latin America.
We are an Ecuadorian technology company specializing in digital transformation, data security, and SaaS platform development. From Quito, we help public and private organizations operate with greater security and efficiency in the digital space.
Interested in a cybersecurity evaluation for your organization? Contact us at urbadigital.com
