A high-stakes international lawsuit has been filed against Meta Platforms Inc. and its subsidiary, WhatsApp, challenging the core promise of end-to-end encryption (E2EE) that the company has long guaranteed to its billions of global users.
Filed in the U.S. District Court in San Francisco, the complaint alleges that Meta has fundamentally misled users into believing their messages were fully private and inaccessible to the company.
The lawsuit, brought by an international group of plaintiffs seeking class-action status, cites information from unnamed whistleblowers within the company. These disclosures form the basis of a significant claim: that Meta and WhatsApp are able to "store, analyze, and access virtually all" of users’ private communications, directly contradicting the in-app assurances that 'only people in this chat can read, listen to, or share' their messages.
Specifically, the complaint outlines an alleged internal mechanism where Meta employees can reportedly request a 'task' from an engineer. This action is claimed to grant access to a workstation widget that can pull up a user’s messages based on their User ID, without requiring a separate decryption step. The allegation suggests this access is granted often without strict oversight, allowing Meta workers to read messages in near real-time, regardless of the app’s supposed E2EE framework.
Meta has strongly pushed back against the allegations. A company spokesperson has called the claims “categorically false and absurd” and described the lawsuit as a “frivolous work of fiction,” indicating an intent to seek sanctions against the plaintiffs’ legal team. Meta maintains that WhatsApp utilizes the Signal protocol, widely considered the industry gold standard for E2EE, and has done so for a decade.
Regardless of the outcome of this legal battle, the revelations and formal complaint underscore a critical and persistent issue for Meta: the erosion of public trust. The claims that Meta personnel can circumvent privacy protections and access communications that were advertised as impervious to company viewing raise serious questions about the integrity of its data-handling practices and its leadership’s commitment to user privacy. For a company with a history of privacy controversies, these allegations represent a significant challenge to the credibility of its entire privacy architecture. The ability of users to trust the foundational security of Meta's services is now under intense international scrutiny.