WhatsApp, a Meta Platforms subsidiary, operates a messaging service that provides end-to-end encryption for message content while its privacy policy discloses that device, connection, and contact metadata are shared with other Meta Companies for purposes including business analytics and advertising across Meta products. In 2021 the Irish Data Protection Commission fined WhatsApp €225 million for GDPR transparency violations regarding data sharing with its parent company, a decision WhatsApp continues to contest, and in a separate matter WhatsApp's own 2019 lawsuit established that NSO Group's Pegasus spyware exploited a WhatsApp voice-calling vulnerability to target roughly 1,400 users. Corporate ownership is disclosed through SEC filings and the privacy policy itself, which identifies WhatsApp as one of the Meta Companies.
TIMELINE
NO ENTRIES ON FILE YET.
ULTIMATE PARENT
TOOLS WE RECOMMEND
PLUS
RECEIPTS
21 ON FILE
COLLECTION
The service's policy indicates blocking first-party cookies may limit your ability to use the service.
WhatsApp's EEA privacy policy discloses that it collects device and connection-specific information — including hardware model, operating system, battery level, signal strength, app version, and browser information — when a user installs, accesses, or uses its services.
As assessed by PrivacySpy on 2021-06-16 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the service collect personal data from third parties? — Yes.
As summarized in coverage of the Irish Data Protection Commission's 2021 infringement decision, the DPC found that WhatsApp's processing affected non-users as well as users, because users' phones allowed WhatsApp to access and upload the contact information of non-WhatsApp users.
WhatsApp's own EEA privacy policy explicitly identifies WhatsApp as part of the Meta corporate family, stating its status among the group of companies known as the Meta Companies.
As assessed by PrivacySpy on 2021-06-16 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the policy outline the service's general security practices? — Somewhat.
WhatsApp's privacy policy states that it shares information collected from users both internally among the Meta Companies and externally with partners, service providers, and those with whom users communicate.
WhatsApp's EEA privacy policy discloses that it works with Meta Companies located in the UK, Israel, and the United States that provide it with business analytics services, allowing comparisons of unique user counts across Meta-owned services.
As assessed by PrivacySpy on 2021-06-16 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the policy allow personally-targeted or behavioral marketing? — No.
Reporting on the 2021 Irish DPC decision states that the underlying dispute concerned WhatsApp not adequately telling its users how their data was being shared with parent company Facebook.
In a lawsuit WhatsApp filed against NSO Group in 2019, a federal judge in California ruled in December 2024 that NSO Group was liable under the Computer Fraud and Abuse Act and for breach of contract for facilitating Pegasus spyware attacks against roughly 1,400 WhatsApp users.
In February 2026 the EU Court of Justice ruled that WhatsApp Ireland has the right to contest the EDPB's binding decision that led to the €225 million DPC fine, extending the multi-year legal dispute.
Coverage of NSO Group's 2025 fine describes how a zero-day vulnerability in WhatsApp's voice-calling feature, tracked as CVE-2019-3568, was leveraged to deploy Pegasus spyware onto targeted devices.