Elon Musk: WhatsApp is exporting your user data every night

Millions of people worldwide trust WhatsApp to protect their communications. 

So is WhatsApp collecting your data every night? Can I trust this application with my data?

What did Elon Musk say about WhatsApp user data?

Musk directly criticized WhatsApp, claiming that the secure messaging app "exports your data every night," hinting that the app has undisclosed privacy issues that many people should know.

WhatsApp can be set up to back up data locally or to Google Drive every night. However, Musk is referring to the metadata WhatsApp collects, sent to its notoriously privacy-unfriendly parent company, Meta.

These activities were known and were previously of no concern. Meta's metadata collection is a bigger problem, but we'll get to it later.

Does WhatsApp export your user data every night?

Will Cathcart, WhatsApp's head of growth and strategy, issued a strong defense, refuting Musk's claims.

Cathcart's response was as expected, confirming that WhatsApp uses end-to-end encryption to secure messages and that neither the platform itself nor Meta can read any messages.

However, Cathcart's response did not go into detail about WhatsApp's collection of metadata about users, which is likely what Musk was aiming for.

Is Elon Musk right about WhatsApp?

Musk's general statement is correct. WhatsApp uploads your metadata for collection - it's logged directly into WhatsApp's FAQ about how WhatsApp works with other Meta companies.

The information we share with other Meta Companies includes your account registration information (such as phone number), transaction data (for example, if you use Facebook Pay), contact information related to services, information about how you interact with businesses when using WhatsApp. Services, mobile device information, IP addresses and may include other information identified in the Privacy Policy section titled 'Information We Collect' or obtained upon notification to you or based on your consent.

WhatsApp's metadata collection is one of the known privacy issues; How concerned you are about metadata collection and analysis is a personal decision.

Meta's lead AI expert, Yann LeCun, also joined the debate to defend WhatsApp's data collection, but similarly, did not address the issues of metadata collection.

In fact, user data is more than just messages. User metadata is an equally valuable source of information about the user, especially if it contains enough identifying information to help build a complete picture of the user's location, contacts, contact time, usage patterns, etc.

Although Musk did not provide much more information, he later liked an X post posted by security researcher Tommy Mysk explaining more about WhatsApp's collection of metadata and user data, and Now add the "bullseye" emoji.

WhatsApp privacy issues explained

WhatsApp is the go-to app for face-to-face communication all over the world. Despite its usefulness, WhatsApp is not without its problems. First, the metadata security issue discussed above. Elon Musk is not the first to talk about this, but it is worth remembering all the information that WhatsApp collects.

Meta is not the most trustworthy company and the amount of data shared between WhatsApp and its parent company is a major concern. So while there's no evidence that WhatsApp reads end-to-end encrypted messages, the shared metadata helps WhatsApp make money (and keeps the app free for most users).

Another problem is that backups are not encrypted. You can set WhatsApp to back up to a local device or a cloud service (Apple iCloud or Google Drive, depending on the device), but the backup remains unencrypted. It is a security problem that can be solved, but it has persisted for many years.

Most people also aren't aware of the differences between texting friends and family versus texting businesses. WhatsApp Business account users share more information with WhatsApp (and Meta) and messages are not encrypted by default. This combination means you may be providing more information than you realise, but it is not the responsibility of WhatsApp Business account users to make this clear.

With all that said, the article does not advise you to ditch WhatsApp for Signal, even though it is more secure. The most practical thing you can do is make WhatsApp more private.

David Pac

Update 31 May 2024