The viral message urges all WhatsApp group admins to enable the app’s advanced chat privacy feature. It warns that if the feature isn’t enabled, “AI systems” can legally access messages, phone numbers and personal data on phones, including “1-to-1 chats”.

A WhatsApp spokesperson told Africa Check that these claims were “completely false”. The message is inaccurate for several reasons. The new feature, which is optional and must be enabled for each chat, introduces three restrictions that limit what other members of a group chat can do with messages and media.

None of these restrictions directly affect what information is collected by Meta AI, or change what data WhatsApp “may legally access”.

To use WhatsApp, all users must agree to the company’s terms of service and privacy policy, including having certain data collected. These policies are governed by overarching local laws that sometimes have tighter restrictions, such as those in Europe and the United Kingdom.

In South Africa, the 2013 Protection of Personal Information (Popi) Act governs the processing and use of personal information. It came into full effect in 2021. In September 2024, South Africa’s Information Regulator issued a notice instructing WhatsApp to change its privacy policy to comply with the Popi Act. It noted that the company’s European and UK policies contained requirements missing from its South African policy, despite them being necessary under South African law.

Regardless, the “advanced chat privacy” feature doesn’t change the legal agreements around data. While you can prevent WhatsApp from accessing certain data, you must agree to the entire terms of service to use the platform.

The feature also “has nothing to do with accessing your messages, phone data, or private chats”, according to Sharon Knowles, chief executive of South African cybersecurity firm Da Vinci Forensics and Cybersecurity. Claims about the feature changing WhatsApp’s access to “all group chat messages, members’ phone numbers, and even personal data stored on phones” are incorrect.  Some of this information is already accessed by WhatsApp, depending on which features you use.

1. Prevents automatic file downloads from chats

Generally, WhatsApp automatically downloads media shared in a chat,  whether voice notes, images, videos or other files, onto the recipient’s device. The advanced chat privacy feature prevents this, as do some other settings. But the recipient could still decide to download or share the media manually. But if, for example, you accidentally share the wrong file and delete the message before the recipient chooses to download it, they won’t have a copy.

2. Prevents easy exports of chat history

If someone wants to record all the messages sent in a chat, this can usually be done with a simple button press. With advanced chat privacy on, this option is not available, and they would need to manually copy individual messages, take screenshots of the chat, or photograph their screen with another device. This might reduce the chances of someone saving or sharing a chat history that includes sensitive information.

3. Prevents the use of Meta AI features in the chat

Meta AI is a “virtual assistant” app that is integrated into WhatsApp and other Meta platforms. The chatbot, powered by artificial intelligence (AI), is marketed as a “personal AI that understands you”, using data Meta has collected about you across the platforms you use.

Meta AI can generally be activated within WhatsApp chats by tagging it, or by requesting AI-generated summaries of a chat. These features are not available if advanced chat privacy is turned on for a specific chat.

A WhatsApp spokesperson stressed that using Meta’s AI features was optional on WhatsApp: “You have to take action to start the conversation by opening a chat or sending a message to the AI.” They said that if you did not interact with the AI tool, no information would be sent to Meta AI – even if you hadn’t enabled the advanced chat privacy feature.

In general, no matter what features you use, WhatsApp cannot read your messages due to a technology called “end-to-end encryption”, or E2EE. Knowles described it as acting like the message is locked. “Your messages are locked, or encrypted, on your phone and only unlocked, or decrypted, when they reach the person you’re talking to,” she said.

Importantly, only the sender and intended recipient of a message can unlock it. This means that even WhatsApp itself cannot read the content of messages.

However, while E2EE protects the contents of your messages, calls and files on WhatsApp, this protection doesn’t cover all the data created when you use the app.

Thorin Klosowski, a security and privacy activist at the Electronic Frontier Foundation (or EFF) told Africa Check: “In the case of WhatsApp, the company collects metadata, such as when a message is sent, who the messages are between, and where it is sent from.”

Metadata is information about a particular piece of data. For example, if the data is a text message, its metadata might include the time it was sent or the place it was sent from.

Although the contents of a message are protected by E2EE, it is impossible to protect a lot of metadata. WhatsApp will, for example, always be able to determine the time a message was sent and the recipient.

More privacy-focused messaging services, including Signal, protect some metadata, such as the sender of a message – though for the most part they simply promise to store as little information as possible.

WhatsApp did not respond to our requests for comment about its data collection practices, but its privacy policy lists many kinds of personal data.

Some of this information is actively provided by users, and if you use the app, you are probably aware that you have shared it. This includes information like your phone number, account name, and optionally a profile picture, the contact details of people in your address book, and more.

But other information is collected automatically, and you may not be aware that WhatsApp is collecting it. This includes:

• Whether you are online (and when you were last online)
• The device you are using
• How much battery power it has
• What mobile network you are using
• How strong your internet connection is
• Your location
• Browser cookies and other information that could connect your WhatsApp account or device to other online activity

(For a full breakdown of the data WhatsApp collects, read their privacy policy.)

While WhatsApp does not collect message content, there are situations in which this could be exposed to third parties. For example, Knowles told us that if you chose to back up copies of your chat history to a cloud storage provider, such as Google Drive or iCloud, these might be unencrypted (or unlocked), and the contents accessible to your cloud service provider.

Klosowski told Africa Check: “I think it’s important to think through how much data the company collects – everything it can – and what it uses it for – mostly to sell advertising. That broad collection of data consolidated with one company gives them a lot of power, and it’s not always clear to people just how much the company collects.”

Meta, with which WhatsApp shares data, mostly uses the information it collects for advertising, linking data from Whatsapp with your activity on other apps and across the web. (Meta will soon introduce ads to WhatsApp itself.)

This means the company could, for example, use the information that you sent a message on WhatsApp from Johannesburg on a phone with a short battery life, along with other device information, to show you an advert for a new phone with a long battery life while you are browsing the web on your laptop.

Tech outlet Futurism has also reported that Facebook has previously taken advantage of what it called “moments of psychological vulnerability”, like stress or body image issues, to target advertising at certain users, including teenagers.

Knowles pointed out some other, more direct privacy concerns: “If Meta is hacked, your unencrypted data, like your IP address or chat backups, could be exposed.” The same would be true of your personal messages if your cloud storage provider were hacked.

Meta may also hand over data to governments in response to legal requests. And for sensitive communications, even a small amount of information can be extremely revealing.

Klosowski said: “With WhatsApp and chat messaging apps specifically, the metadata of who you are communicating with and when can reveal a lot about who you are, where you are, and what your needs may be.” While this kind of data may not seem important in the moment, he emphasised that this “can be worrisome for some in the future if legal or personal situations change”.

The EFF offers examples of how this might work. It could, for instance, be determined that someone “called a gynecologist, spoke for a half hour, and then called the local abortion clinic’s number later that day”.

This is data that is collected from all WhatsApp users, even those who do not engage with Meta AI. But Meta’s chatbot comes with additional privacy concerns.

The idea that “AI systems” can access all of your WhatsApp messages and private data stored elsewhere on your phone is incorrect. WhatsApp’s spokesperson told Africa Check that personal messages remain “off limits” and end-to-end encrypted.

However, there are still important details to consider before interacting with Meta AI.

When you interact with the chatbot, those messages are not encrypted the same way, and “are processed by Meta’s systems”, Knowles told us. Meta has said it may share that information with third parties and human reviewers, or use it to improve AI responses.

The company said it has developed “private processing” technology allowing some AI features to be used with E2EE, without saving or sharing any data with Meta itself. But, Klosowski said, this “seems more limited to features like message summaries” and was not yet widely available at time of writing.

Meta has warned users not to share sensitive information or personal details with the chatbot – and admitted that its responses may also be inaccurate. (For more about chatbots and accuracy, read our 2024 analysis.)

There are many examples of chatbots like Meta AI producing inaccurate information, sometimes leading to privacy violations, such as revealing ordinary people’s phone numbers when asked for the number of a business or of Meta AI itself. Other privacy concerns have been raised, including the Meta AI app having a publicly viewable feed of users’ conversations with the chatbot, which many users may not realise they have shared.

There are several steps you can take to protect your personal information on WhatsApp.

1. Use encrypted backup methods

Klosowski and Knowles both strongly recommended using end-to-end encrypted backups to save your WhatsApp chat history. This ensures that should anyone gain access to these, they won’t be able to read your entire message history.

2. Change WhatsApp device permissions

If you are concerned about the data WhatsApp collects, you can limit what it has access to by changing which device permissions it has access to. Knowles recommended: “only give WhatsApp access to your location, contacts, camera, and microphone if it’s truly necessary”. WhatsApp has a guide to changing these permissions. However, this won’t prevent all data collection. For example, restricting access to your location won’t prevent WhatsApp from using information like your device IP address to determine where you are.

3. Hide your IP address

If you want to hide your IP address, Knowles recommended using a VPN, or virtual private network. While this isn’t completely protective, and the privacy VPN services offer varies, this can limit how visible your location is to some apps. (Read the EFF guide for more on this.) But this method doesn’t protect from other ways apps might track you, like through web cookies, GPS and others, which require other adjustments to privacy settings.

4. Use another encrypted messaging app

Knowles and Klosowski also suggested that privacy-conscious users could opt for other encrypted messaging apps. Both specifically mentioned Signal, which stores far less data than WhatsApp. (According to Signal’s privacy policy, it stores a user’s phone number, some technical data needed to transfer messages, and optional information shared by users such as their profile picture.)