WhatsApp collects extensive data about you — including detailed metadata, device behavior, and inferred location — and shares it freely across all Meta products, with unnamed third parties, and with governments based on its own judgment, with no fixed limit on how long it keeps any of it. If you're in the US or Canada, you've given up your right to sue WhatsApp in court or join a class action, any claim must be filed within one year, and even if you win, the company's liability is capped at just $100. WhatsApp can change its privacy policy without your agreement, and if the company is sold, your data goes with it automatically. On the positive side, your personal messages are genuinely end-to-end encrypted and WhatsApp cannot read them, but messages sent to businesses do not carry the same protection.
Last analyzed
Heads up: this analysis is AI-generated, can be incomplete or wrong, and is not legal advice. Use it as a starting point and read the original document before you agree — see our Terms.
Clause-by-clause breakdown
Every clause we flagged in WhatsApp's agreement, with what it means for you.
US/Canada users must arbitrate disputes and waive class-action rights.
“IF YOU ARE A WHATSAPP USER LOCATED IN THE UNITED STATES OR CANADA, OUR TERMS CONTAIN A BINDING ARBITRATION PROVISION, WHICH STATES THAT, EXCEPT IF YOU OPT OUT AND EXCEPT FOR CERTAIN TYPES OF DISPUTES, WHATSAPP AND YOU AGREE TO RESOLVE ALL DISPUTES (DEFINED BELOW) THROUGH BINDING INDIVIDUAL ARBITRATION, WHICH MEANS THAT YOU WAIVE ANY RIGHT TO HAVE THOSE DISPUTES DECIDED BY A JUDGE OR JURY, AND THAT YOU WAIVE YOUR RIGHT TO PARTICIPATE IN CLASS ACTIONS, CLASS ARBITRATIONS, OR REPRESENTATIVE ACTIONS. PLEASE READ THE "SPECIAL ARBITRATION PROVISION FOR UNITED STATES OR CANADA USERS" SECTION BELOW TO LEARN MORE.”
Quoted verbatim from the agreement What this means: If you're in the US or Canada, WhatsApp requires you to settle legal disputes through private arbitration rather than in court, and you give up the right to join a class-action lawsuit. This means if WhatsApp harms many users in the same way, each person must fight their case individually — making it far less practical to seek justice. There is an opt-out window mentioned, but you must actively use it.
What you can do: Look for the opt-out instructions in the 'Special Arbitration Provision' section of the Terms and submit your opt-out within the stated deadline (typically 30 days of account creation). Keep a record of your opt-out submission.
Your data is shared with Meta to personalise ads across all Meta apps.
“As part of the Meta Companies, WhatsApp receives information from, and shares information (see here) with, the other Meta Companies. We may use the information we receive from them, and they may use the information we share with them, to help operate, provide, improve, understand, customize, support, and market our Services and their offerings, including the Meta Company Products. This includes: helping improve infrastructure and delivery systems; understanding how our Services or theirs are used; promoting safety, security, and integrity across the Meta Company Products, e.g., securing systems and fighting spam, threats, abuse, or infringement activities; improving their services and your experiences using them, such as making suggestions for you (for example, of friends or group connections, or of interesting content), personalizing features and content, helping you complete purchases and transactions, and showing relevant offers and ads across the Meta Company Products; and providing integrations which enable you to connect your WhatsApp experiences with other Meta Company Products.”
Quoted verbatim from the agreement What this means: WhatsApp shares your data — including usage patterns, device identifiers, and account information — with Facebook, Instagram, and other Meta-owned platforms. Meta uses this data to show you targeted ads across its products. This is a broad, ongoing data-sharing arrangement that you cannot opt out of while continuing to use WhatsApp.
What you can do: Review your Meta Accounts Center settings to understand what is linked and limit cross-product data use where options are available. Be aware that full opt-out is not possible without deleting your account.
WhatsApp keeps your data indefinitely with no fixed time limit.
“We store information for as long as necessary for the purposes identified in this Privacy Policy, including to provide our Services or for other legitimate purposes, such as complying with legal obligations, enforcing and preventing violations of our Terms, or protecting or defending our rights, property, and users. The storage periods are determined on a case-by-case basis that depends on factors like the nature of the information, why it is collected and processed, relevant legal or operational retention needs, and legal obligations.”
Quoted verbatim from the agreement What this means: WhatsApp does not commit to any fixed maximum retention period for your non-message data (usage logs, device info, metadata, etc.). The vague 'as long as necessary' standard gives WhatsApp broad discretion to keep your information indefinitely for loosely defined 'legitimate purposes'. There is no self-service way to force deletion of all retained data.
What you can do: Use the in-app 'Delete My Account' feature to trigger deletion of your account data. Note that some data tied to enforcement or legal obligations may still be retained after deletion.
WhatsApp can change its privacy policy without your explicit consent.
“We may amend or update our Privacy Policy. We will provide you notice of amendments to this Privacy Policy, as appropriate, and update the "Effective Date" at the top of this Privacy Policy. Please review our Privacy Policy from time to time.”
Quoted verbatim from the agreement What this means: WhatsApp can change its privacy policy at any time and only promises to give notice 'as appropriate' — a vague standard that does not guarantee you will be actively informed before changes take effect. Continued use of the service after an update implies acceptance of the new terms. The archive of past versions (Section 10) shows the policy has changed many times.
What you can do: Periodically check the Privacy Policy page yourself and watch for in-app notifications. If you disagree with a change, your only recourse is to delete your account before the new policy takes effect.
WhatsApp shares your data with governments based on its own judgment.
“We access, preserve, and share your information described in the "Information We Collect" section of this Privacy Policy above if we have a good-faith belief that it is necessary to: (a) respond pursuant to applicable law or regulations, legal process, or government requests; (b) enforce our Terms and any other applicable terms and policies, including for investigations of potential violations; (c) detect, investigate, prevent, or address fraud and other illegal activity or security, and technical issues; or (d) protect the rights, property, and safety of our users, WhatsApp, the other Meta Companies, or others, including to prevent death or imminent bodily harm.”
Quoted verbatim from the agreement What this means: WhatsApp will hand your data to governments or law enforcement based on its own 'good-faith belief' that a request is necessary — there is no stated requirement for a court order or formal legal process. The broad categories (b) through (d) also allow sharing for internal enforcement purposes with minimal external oversight.
What you can do: Review WhatsApp's published transparency reports to understand the volume and nature of government data requests. Consider that end-to-end encrypted message content is not accessible, but metadata (who you contact, when, device info) can be shared.
WhatsApp's maximum liability to you is capped at $100.
“THE WHATSAPP PARTIES WILL NOT BE LIABLE TO YOU FOR ANY LOST PROFITS OR CONSEQUENTIAL, SPECIAL, PUNITIVE, INDIRECT, OR INCIDENTAL DAMAGES RELATING TO, ARISING OUT OF, OR IN ANY WAY IN CONNECTION WITH OUR TERMS, US, OR OUR SERVICES (HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, INCLUDING NEGLIGENCE), EVEN IF THE WHATSAPP PARTIES HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. OUR AGGREGATE LIABILITY RELATING TO, ARISING OUT OF, OR IN ANY WAY IN CONNECTION WITH OUR TERMS, US, OR OUR SERVICES WILL NOT EXCEED THE GREATER OF ONE HUNDRED DOLLARS ($100) OR THE AMOUNT YOU HAVE PAID US IN THE PAST TWELVE MONTHS.”
Quoted verbatim from the agreement What this means: No matter what harm WhatsApp causes you — including through negligence — the most you can ever recover is $100 (or what you paid in the last year, which for most users is $0). This cap applies even if WhatsApp's failure causes you significant real-world harm, such as a data breach exposing sensitive personal information. This is a very low ceiling given the scale of data WhatsApp holds.
What you can do: Be aware that your legal remedies against WhatsApp are severely limited. Users in some jurisdictions (e.g., EU/UK) may have statutory rights that override this cap — check your local consumer protection laws.
You have only one year to file any legal claim against WhatsApp.
“THESE TERMS ALSO LIMIT THE TIME YOU HAVE TO BRING A CLAIM OR DISPUTE, INCLUDING THE TIME TO START AN ARBITRATION OR, IF PERMISSIBLE, A COURT ACTION OR SMALL CLAIMS PROCEEDING TO THE FULLEST EXTENT PERMITTED BY APPLICABLE LAW. We and you agree that for any Dispute (except for the Excluded Disputes defined below) we and you must bring Claims (including commencing an arbitration proceeding) within one year after the Dispute first arose; otherwise, such Dispute is permanently barred.”
Quoted verbatim from the agreement What this means: You have only one year from when a problem first arises to file any legal claim against WhatsApp. Most jurisdictions give consumers two to six years. If you miss this shortened deadline — even by a day — your claim is permanently gone, regardless of how serious the harm was. This is a significant reduction of your normal legal rights.
What you can do: If you believe WhatsApp has harmed you, act quickly. Consult a lawyer as soon as possible, as the one-year clock starts from when the dispute first arose, not when you discovered it.
Your data is sent to any country, including those with weaker privacy laws.
“WhatsApp shares information globally, both internally within the Meta Companies and externally with our partners and service providers, and with those with whom you communicate around the world, in accordance with this Privacy Policy. Your information may, for example, be transferred or transmitted to, or stored and processed in, the United States; countries or territories where the Meta Companies' affiliates and partners, or our service providers are located; or any other country or territory globally where our Services are provided outside of where you live for the purposes as described in this Privacy Policy. WhatsApp uses Meta's global infrastructure and data centers, including in the United States. These transfers are necessary to provide the global Services set forth in our Terms. Please keep in mind that the countries or territories to which your information is transferred may have different privacy laws and protections than what you have in your home country or territory.”
Quoted verbatim from the agreement What this means: Your data can be transferred to any country in the world, including the United States, where privacy protections may be weaker than in your home country. WhatsApp frames these transfers as 'necessary' and provides no mechanism to restrict them. Users in the EU/UK have some additional protections under GDPR/UK GDPR transfer rules, but global users do not.
What you can do: If you are in the EU or UK, check WhatsApp's Data Privacy Framework and transfer addendum documents for the legal basis of transfers. Global users have limited recourse beyond accepting this condition.
WhatsApp disclaims all responsibility if the service fails or harms you.
“YOU USE OUR SERVICES AT YOUR OWN RISK AND SUBJECT TO THE FOLLOWING DISCLAIMERS. WE ARE PROVIDING OUR SERVICES ON AN "AS IS" BASIS WITHOUT ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, NON-INFRINGEMENT, AND FREEDOM FROM COMPUTER VIRUS OR OTHER HARMFUL CODE. WE DO NOT WARRANT THAT ANY INFORMATION PROVIDED BY US IS ACCURATE, COMPLETE, OR USEFUL, THAT OUR SERVICES WILL BE OPERATIONAL, ERROR FREE, SECURE, OR SAFE, OR THAT OUR SERVICES WILL FUNCTION WITHOUT DISRUPTIONS, DELAYS, OR IMPERFECTIONS.”
Quoted verbatim from the agreement What this means: WhatsApp makes no promises that the service will work correctly, be secure, or be free from harmful code. If the service fails, leaks your data, or causes you harm, WhatsApp accepts no responsibility. This is a broad disclaimer that strips away most legal accountability for service failures.
What you can do: UK users have stronger statutory protections that override some of these disclaimers (the UK Terms explicitly preserve statutory rights). Users elsewhere should be aware that their legal remedies may be very limited.
WhatsApp collects detailed metadata about who you contact and when.
“Usage And Log Information. We collect information about your activity on our Services, like service-related, diagnostic, and performance information. This includes information about your activity (including how you use our Services, your Services settings, how you interact with others using our Services (including when you interact with a business), and the time, frequency, and duration of your activities and interactions), log files, and diagnostic, crash, website, and performance logs and reports. This also includes information about when you registered to use our Services; the features you use like our messaging, calling, Status, groups (including group name, group picture, group description), payments or business features; profile photo, "about" information; whether you are online, when you last used our Services (your "last seen"); and when you last updated your "about" information. Device And Connection Information. We collect device and connection-specific information when you install, access, or use our Services. This includes information such as hardware model, operating system information, battery level, signal strength, app version, browser information, mobile network, connection information (including phone number, mobile operator or ISP), language and time zone, IP address, device operations information, and identifiers (including identifiers unique to Meta Company Products associated with the same device or account).”
Quoted verbatim from the agreement What this means: Even though your messages are encrypted, WhatsApp collects extensive metadata: who you talk to, when, how often, for how long, which groups you're in, your device's battery level, signal strength, and unique identifiers tied to your Meta account. This metadata can reveal a great deal about your life, relationships, and habits even without reading message content.
What you can do: Limit optional features (like Status and location sharing) to reduce metadata collection. Be aware that core usage metadata cannot be avoided while using the service.
Your data is automatically transferred if WhatsApp is sold or merged.
“In the event that we are involved in a merger, acquisition, restructuring, bankruptcy, or sale of all or some of our assets, we will share your information with the successor entities or new owners in connection with the transaction in accordance with applicable data protection laws.”
Quoted verbatim from the agreement What this means: If WhatsApp is sold or merged with another company, your personal data is transferred to the new owner as part of the deal. You have no right to object to or opt out of this transfer. The new owner could have very different privacy practices.
What you can do: Monitor news about Meta/WhatsApp corporate changes. If a sale occurs and you are uncomfortable with the new owner's practices, delete your account promptly.
You grant WhatsApp a broad, transferable licence over all your content.
“In order to operate and provide our Services, you grant WhatsApp a worldwide, non-exclusive, royalty-free, sublicensable, and transferable license to use, reproduce, distribute, create derivative works of, display, and perform the information (including the content) that you upload, submit, store, send, or receive on or through our Services. The rights you grant in this license are for the limited purpose of operating and providing our Services (such as to allow us to display your profile picture and status message, transmit your messages, and store your undelivered messages on our servers for up to 30 days as we try to deliver them).”
Quoted verbatim from the agreement What this means: You grant WhatsApp a broad, worldwide, sublicensable license to use, copy, distribute, and create derivative works from any content you send or receive through the service. While the Terms say this is limited to 'operating and providing' the service, the license is sublicensable and transferable, meaning it can be passed to third parties.
What you can do: Be mindful of what content you share through WhatsApp, particularly in public-facing features like Channels. For private messages, end-to-end encryption means WhatsApp cannot practically access the content, limiting real-world impact.
Messages to businesses can be read by Meta and third-party providers.
“When you message with a business on WhatsApp, keep in mind that the content you share may be visible to several people in that business. In addition, some businesses might be working with third-party service providers (which may include Meta) to help manage their communications with their customers. For example, a business may give such third-party service provider access to its communications to send, store, read, manage, or otherwise process them for the business. To understand how a business processes your information, including how it might share your information with third parties or Meta, you should review that business' privacy policy or contact the business directly.”
Quoted verbatim from the agreement What this means: When you message a business on WhatsApp, that conversation is not end-to-end encrypted in the same way as personal chats — the business and its third-party service providers (potentially including Meta) can read those messages. WhatsApp shifts responsibility to you to check each business's privacy policy, which is impractical.
What you can do: Treat any message to a business on WhatsApp as potentially readable by Meta and third parties. Avoid sharing sensitive personal information (financial details, health info) in business chats.
WhatsApp cannot connect you to emergency services like 999 or 911.
“NO ACCESS TO EMERGENCY SERVICES: There are important differences between our Services and your mobile phone and a fixed-line telephone and SMS services. Our Services do not provide access to emergency services or emergency services providers, including the police, fire departments, or hospitals, or otherwise connect to public safety answering points. You should ensure you can contact your relevant emergency services providers through a mobile phone, a fixed-line telephone, or other service.”
Quoted verbatim from the agreement What this means: WhatsApp cannot be used to call emergency services (police, fire, ambulance). If you rely on WhatsApp as your primary communication tool, you could be unable to reach help in an emergency. This is a safety-critical limitation that users should be aware of.
What you can do: Always keep a traditional phone line or mobile network available for emergency calls. Do not rely on WhatsApp as your sole means of communication.
WhatsApp collects detailed device and behavioral data beyond messaging needs.
“Usage And Log Information. We collect information about your activity on our Services, like service-related, diagnostic, and performance information. This includes information about your activity (including how you use our Services, your Services settings, how you interact with others using our Services (including when you interact with a business), and the time, frequency, and duration of your activities and interactions), log files, and diagnostic, crash, website, and performance logs and reports. This also includes information about when you registered to use our Services; the features you use like our messaging, calling, Status, groups (including group name, group picture, group description), payments or business features; profile photo, "about" information; whether you are online, when you last used our Services (your "last seen"); and when you last updated your "about" information. Device And Connection Information. We collect device and connection-specific information when you install, access, or use our Services. This includes information such as hardware model, operating system information, battery level, signal strength, app version, browser information, mobile network, connection information (including phone number, mobile operator or ISP), language and time zone, IP address, device operations information, and identifiers (including identifiers unique to Meta Company Products associated with the same device or account).”
Quoted verbatim from the agreement What this means: WhatsApp collects an extensive profile of your device and behavior: your hardware model, battery level, signal strength, IP address, mobile operator, when you're online, how long you use the app, and device identifiers that link you across all Meta products. This goes well beyond what is needed to deliver messages and creates a detailed behavioral fingerprint that feeds into Meta's broader data ecosystem.
What you can do: Limit permissions in your device settings where possible. Be aware that some of this collection (e.g., IP address, device identifiers) cannot be turned off while using the service.
WhatsApp estimates your location even if you never share it.
“Even if you do not use our location-related features, we use IP addresses and other information like phone number area codes to estimate your general location (e.g., city and country). We also use your location information for diagnostics and troubleshooting purposes.”
Quoted verbatim from the agreement What this means: Even if you never share your location with anyone, WhatsApp still estimates where you are using your IP address and phone number area code. This passive location inference happens in the background without any action on your part and cannot be turned off while using the service.
What you can do: Using a VPN can mask your IP address and prevent accurate location inference, though this may affect service quality. There is no in-app setting to disable this passive collection.
Your data is shared with unnamed third-party service providers for marketing.
“Third-Party Service Providers. We work with third-party service providers and other Meta Companies to help us operate, provide, improve, understand, customize, support, and market our Services. For example, we work with them to distribute our apps; provide our technical and physical infrastructure, delivery, and other systems; provide engineering”
Quoted verbatim from the agreement What this means: WhatsApp shares your data with an unspecified number of third-party service providers for a wide range of purposes including marketing. The policy does not name these providers or fully describe what data each receives. The phrase 'market our Services' suggests your data may be used to target you with advertising for WhatsApp itself through third-party channels.
What you can do: Review WhatsApp's full privacy policy and any linked sub-policies for more detail on specific third-party partners. There is no general opt-out from third-party service provider sharing described in the Terms.
You must pay WhatsApp's legal costs if your actions cause a lawsuit.
“If anyone brings a claim ("Third-Party Claim") against us related to your actions, information, or content on WhatsApp, or any other use of our Services by you, you will, to the maximum extent permitted by applicable law, indemnify, and hold the WhatsApp Parties harmless from and against all liabilities, damages, losses, and expenses of any kind (including reasonable legal fees and costs) relating to, arising out of, or in any way in connection with any of the following: (a) your access to or use of our Services, including information and content provided in connection therewith; (b) your breach of our Terms or applicable law; or (c) any misrepresentation made by you.”
Quoted verbatim from the agreement What this means: If someone sues WhatsApp because of something you did on the platform, you are required to pay WhatsApp's legal costs and any damages. This is a broad indemnification clause — it covers not just intentional wrongdoing but any use of the service that results in a third-party claim. Even an inadvertent Terms violation could trigger this obligation.
What you can do: Use WhatsApp only for lawful purposes and follow the Terms carefully. Be especially cautious about sharing third-party content, as copyright or defamation claims could trigger this clause.
Personal messages are end-to-end encrypted — WhatsApp cannot read them.
“We offer end-to-end encryption for our Services. End-to-end encryption means that your messages are encrypted to protect against us and third parties from reading them.”
Quoted verbatim from the agreement What this means: Personal messages and calls between WhatsApp users are end-to-end encrypted by default, meaning WhatsApp itself cannot read them. This is a strong privacy protection that goes beyond what many messaging services offer.
What you can do: Ensure both you and your contacts are using up-to-date versions of WhatsApp to maintain end-to-end encryption. Note this protection does not apply to business chats or Channels.
You can download a copy of your account data anytime in-app.
“You can access or port your information using our in-app Request Account Info feature (available under Settings > Account). For iPhone users, you can learn how to access, manage, and delete your information through our iPhone Help Center articles. For Android users, you can learn how to access, manage, and delete your information through our Android Help Center articles.”
Quoted verbatim from the agreement What this means: WhatsApp provides an in-app tool to request and download a copy of your account data, which is a meaningful user right. This self-service export feature is available to all users, not just those in regulated regions.
What you can do: Use Settings > Account > Request Account Info to download your data at any time.
WhatsApp commits to no third-party banner ads inside the app.
“No Third-Party Banner Ads. We still do not allow third-party banner ads on our Services. We have no intention to introduce them, but if we ever do, we will update this Privacy Policy.”
Quoted verbatim from the agreement What this means: WhatsApp explicitly commits to not showing third-party banner advertisements within the app. This is a meaningful user-protective commitment, though it does not prevent data sharing with Meta for ad targeting on other Meta platforms.
WhatsApp Channels content is public and visible to everyone, including WhatsApp.
“Channels are public, meaning that anyone can discover, follow, and view your Channel. Given the public nature and unlimited audience size of Channels, Channel Content will be visible to any user and by WhatsApp. This also means that Channel Content is among the information WhatsApp collects and uses to promote safety, security and integrity on Channels, as further described in this Channels Privacy Policy, the Supplemental Terms, and in the WhatsApp Channels Guidelines.”
Quoted verbatim from the agreement What this means: Content posted to WhatsApp Channels is fully public — visible to any WhatsApp user worldwide and to WhatsApp itself. Unlike personal messages, Channels content has no end-to-end encryption and no audience restrictions by default. Anyone can screenshot or record Channel content and share it anywhere.
What you can do: Only post to Channels content you are comfortable being permanently public. Do not share personal, sensitive, or identifying information in Channel updates.
WhatsApp explicitly states it cannot read your personal messages or calls.
“As always, your personal messages and calls are end-to-end encrypted. No one else, not even WhatsApp, can read or listen to them.”
Quoted verbatim from the agreement What this means: Both the EEA and UK privacy policies explicitly state that personal messages and calls are end-to-end encrypted and that WhatsApp itself cannot read or listen to them. This is a strong, clearly stated commitment that goes beyond a vague privacy claim.
What you can do: Verify encryption is active by checking the lock icon in individual and group chats. Note this protection applies to personal chats, not to Channels or messages sent to businesses.
Frequently asked questions
Is WhatsApp's Terms & Conditions agreement fair?
- BeforeYouClick grades WhatsApp E on an A–E scale, where A is the fairest. Its agreement contains 7 critical clauses, 11 warnings and 5 good practices.
What are the biggest problems with WhatsApp's terms?
- The most serious clauses we flagged are: Forced Arbitration Blocks Class Actions, Data Shared Across All Meta Products and No Fixed Data Retention Time Limit.
How long does it take to read WhatsApp's terms?
- WhatsApp's agreement takes about 80 minutes to read in full, across 23 clauses we reviewed. The summary on this page covers the same ground in under a minute.
When was WhatsApp's agreement last analyzed?
- We last read WhatsApp's Terms & Conditions on July 3, 2026. Companies change their terms without notice, so check the original document for the current version.
Is this analysis legal advice?
- No. This analysis is AI-generated, can be incomplete or wrong, and is not legal advice. Use it as a starting point and read the original agreement before you agree to it.
More agreements to read
- TelegramMessagingGrade C
- Signal Messenger LLCMessagingGrade C
- DiscordMessagingGrade D
- PosteoProductivityGrade A
- Mullvad VPNSecurityGrade A
- MurenaSecurityGrade B