Messenger is Meta Platforms' standalone chat application, governed by Meta's group-wide Privacy Policy (Data Policy) alongside Facebook and Instagram, and Meta discloses on messenger.com/privacy that personal message content is end-to-end encrypted by default and is not used for ad personalization while other product data is collected to "improve the product experience." Meta's Data Policy discloses that information can be received from and shared with third-party advertisers, measurement partners, vendors, researchers, and law-enforcement requesters, and Meta's corporate entities (Meta Platforms, Inc. and Meta Platforms Ireland Limited) have been the subject of large regulatory actions, including a 2019 FTC settlement and a 2022 Irish Data Protection Commission fine of €265 million. Independent tracker-scanning of the Android APK and third-party comparative studies provide additional, narrower data points on the app's technical and collection footprint.
TRACK RECORD
1 ENFORCEMENT ACTION
[2019-07-24]
In 2019, the FTC imposed a $5 billion civil penalty on Facebook (now Meta) and new privacy restrictions, which the FTC described as the largest penalty ever imposed on any company for violating consumers' privacy.
Messenger's own privacy page states that Meta collects information from Messenger to improve the product experience and to support safety and security, while stating that personal message content is not used for ad personalization.
Meta's Privacy Policy, which applies to Messenger, states that data retention periods vary by feature, giving as an example that vanish-mode messages are kept for less time than regular messages.
A comparative analysis of messaging apps reported that Meta's Messenger was linked to more of the data-type categories examined than most other apps in the comparison, placing it at the top among the messaging apps studied for breadth of data linked to users.
Google Play's developer page for Meta Platforms, Inc. lists Messenger among the Android apps published under that corporate developer account, consistent with the disclosed parent-company relationship in Meta's Privacy Policy.
Meta's Data Policy identifies the corporate entity operating Messenger, Facebook, and Instagram as Meta Platforms, Inc., referring to these collectively as 'Meta Products.'
Messenger's own privacy page discloses that even with default end-to-end encryption, a user or another participant in a chat may still choose to share messages with Meta, such as through reporting or optional features.
Meta's Data Policy lists categories of third parties with whom user information may be shared, including advertisers, measurement partners, vendors and service providers, researchers and academics, and recipients of law enforcement or legal requests.
In 2019, the FTC imposed a $5 billion civil penalty on Facebook (now Meta) and new privacy restrictions, which the FTC described as the largest penalty ever imposed on any company for violating consumers' privacy.
In 2022, Ireland's Data Protection Commission fined Meta €265 million following an inquiry into a 2021 data-scraping incident affecting up to 533 million Facebook users; the inquiry specifically examined the Facebook Messenger Contact Importer tool alongside Facebook Search and Instagram Contact Importer for compliance with GDPR data-protection-by-design obligations.
Messenger's privacy page states that personal messages and calls are secured with end-to-end encryption, which the company describes as preventing Meta itself from viewing or listening to the content.