- The documents do not say whether your data trains AI.
- Ads are based only on what you are looking at, not a profile of you.
- Data is shared only with the providers who run the service.
- The policy describes staff access for safety and legal checks.
Chats stay end-to-end encrypted, but they still collect lots of account, device, and contact data and share it with Meta.
Agent Trust Hub uses AI and may make mistakes. Review reports and confirm their contents before relying on them.
Collected
Phone number, profile, usage, device IDs, and optionally contacts, location, and photos.
Read the exact line
Privacy policy
“We collect device and connection-specific information when you install, access, or use our Services. This includes information such as hardware model, operating system information”
Training
They run the app, fight abuse, and may show ads in Status and Channels; chats stay encrypted.
Read the exact line
Privacy policy
“As always, your personal messages and calls are end-to-end encrypted. No one else, not even WhatsApp, can read or listen to them.”
Sharing
Meta companies and other vendors get account and device data; they cannot read your chats.
Read the exact line
Privacy policy
“We work with other Meta Companies that act as our service providers and help us provide and improve our Services.”
Kept
Undelivered messages last up to 30 days; account deletion can take up to 90 days.
Read the exact line
Privacy policy
“Note that for technical reasons it takes up to 90 days from the beginning of the deletion process to delete or your WhatsApp information.”
Controls
You can change privacy settings, request your data, and delete your account in the app.
Read the exact line
Privacy policy
“You can access or port your information using our in-app Request Account Info feature (available under Settings > Account).”
Fine print
EEA users can go to court at home; they give 30 days’ notice before changing the terms.
Read the exact line
Terms of service
“If you are a consumer and habitually reside in a country or territory within the European Region, the laws of your country or territory will apply to any Claim you have against us”
Expand “Read the exact line” to see the source alongside the explanation.
What you can turn off
The controls and opt-outs their own documents describe, and where they say to find them.
Request a copy of your account info
Settings > Account > Request Account Info
Delete your WhatsApp account in the app
In-app settings, delete my account feature (not just uninstalling the app)
Turn off contact upload and tighten who sees you
In-app privacy settings and device permissions for contacts and location
Object to certain processing if you are in the EEA
Use the objection form linked from How To Exercise Your Rights and choose “How can I make an objection to the processing of my information”
If a switch is not where they say, the deletion request above still applies.
Line by line
The lines that matter most, worst first.
If you turn on contact upload, they regularly copy phone numbers from your address book, including people who do not use WhatsApp.
Read the exact line
Privacy policy
“You can use contact upload and provide us with contact information from your device address book on a regular basis, including those of users of our Services and your other contacts.”
For example, names and numbers of friends who never installed WhatsApp can still be sent to them when you sync contacts.
Using Status or Channels can mean extra tracking used for ads, even though they say they do not run third-party banner ads.
Read the exact line
Privacy policy
“If you use optional features such as Status or Channels, we also collect information using similar technologies for ads.”
For example, opening Channels could let them collect cookie-like data to show you ads there.
If you use a photo for an avatar, they scan parts of your face or body in that picture. They say it is not used to identify you.
Read the exact line
Privacy policy
“When you choose to use certain avatars features, such as using a photo to enable us to suggest an avatar that more closely resembles you, we process the photo and parts of your face or body features in the photo frame.”
For example, a selfie you pick for an avatar is processed so the cartoon looks like you.
You keep ownership, but you give them a broad license so they can run the service, including showing your profile photo and sending messages.
Read the exact line
Terms of service
“you grant WhatsApp a worldwide, non-exclusive, , , and transferable license to use, reproduce, distribute, create derivative works of, display, and perform the information (including the content) that you upload, submit, store, send, or receive on or through our Services.”
For example, they can show your profile picture to people who have your number, and pass that license to helpers who run the app.
People can look at some of your information when they check accounts or safety issues. They still cannot open your encrypted chats.
Read the exact line
Privacy policy
“We use information we have and apply automated data processing techniques and, in some instances, conduct manual (human) review to:verify accounts on an ongoing basis”
For example, a reviewer might look at a reported group photo or a profile picture, not your private chat text.
Even after the 90-day deletion window, copies can sit in disaster-recovery backups for a while.
Read the exact line
Privacy policy
“Copies of your information may also remain after the 90 days for a limited time in the backup storage that we use to recover lost information in the event of a disaster, software error, or other information loss event.”
For example, after you delete your account, a backup tape might still hold your phone number for a short extra period.
They can shut an unused account without you asking, and the privacy policy says inactive accounts are generally removed after 120 days without an alert.
Read the exact line
Terms of service
“We may also disable or delete your account if it does not become active after account registration or if it remains inactive for an extended period of time.”
For example, if you stop opening WhatsApp for about four months, the account can disappear and you are not warned.
They must warn you at least 30 days before new terms take effect, so you can leave if you disagree.
Read the exact line
Terms of service
“Unless otherwise required by law, we will provide you at least 30 days' advance notice of changes to our Terms (e.g., by e-mail or through the Services)”
For example, you might get an in-app notice a month before a new rule starts, and you can delete the account if you do not accept it.
If you live in the EEA as a consumer.
Read the exact line
Terms of service
“If you are a consumer and habitually reside in a country or territory within the European Region, the laws of your country or territory will apply to any Claim you have against us that arises out of or relates to these Terms or our Services, and you may resolve your Claim in any competent court in your country or territory that has over the Claim.”
For example.
The actual words and call audio of your personal chats are locked so WhatsApp staff cannot open them.
Read the exact line
Privacy policy
“As always, your personal messages and calls remain end-to-end encrypted. No one else, not even WhatsApp, can read or listen to them.”
For example, a private voice note to a friend is not readable on WhatsApp’s servers.
Kids under 13 (or a higher local age) need a parent-managed account where that exists; otherwise the stated minimum is 13.
Read the exact line
Terms of service
“You must be at least 13 years old to use our Services or such greater age required in your country or territory on your own. If you are under this age, your parent or guardian can create a parent-managed account for you if it is available in your country or territory.”
For example, a 12-year-old may only use WhatsApp if a parent sets up a supervised account in a country where that feature is offered.
If they were careful, they will not pay for losses they did not cause, could not reasonably predict, or that came from events outside their control. They still accept full for death, injury, intent, and gross negligence.
Read the exact line
Terms of service
“Provided that we have acted with professional diligence, WhatsApp does not accept responsibility for losses not caused by our breach of these Terms or otherwise by our acts; losses that are not reasonably foreseeable by you and us at the time of entering into these Terms; and events .”
For example, if a network outage they did not cause makes you miss a message, they say they are not on the hook for that loss.
Words to know
Legal words from the lines above, in plain English.
- service providers
- Outside companies that handle your data on the app's instructions, such as a cloud host or an email sender. For example, the company that stores the app's files in the cloud sees your data but only does what the app tells it.
- de-identified
- Data with your name and obvious identifiers removed, though it can sometimes still be traced back to you. For example, your chats with names stripped out may still be kept and studied after you delete your account.
- cookies
- Small files a website saves on your device so it can recognise you and remember what you did. For example, a cookie keeps you logged in and can also tell an ad company which sites you visited.
- royalty-free
- The company can use your content without ever paying you for it. For example, your photo can appear in the app's ads and you get nothing.
- sublicensable
- The company can pass its rights over your content on to other companies without asking you. For example, an app can let an advertiser or a partner reuse your video under the licence you gave.
- worldwide license
- You let the company use your content anywhere on earth, usually for free and for as long as it likes. For example, a video you post can be shown in ads in any country without asking you again.
- governing law
- Which country's or state's laws are used to settle any dispute, no matter where you live. For example, a user in Ohio may find the terms are judged under California law.
- force majeure
- The company is not responsible for failures caused by events outside its control, like storms, war or outages. For example, if a power cut takes the app down for a week, you cannot claim compensation.
How we got here · grade A+ · score 68/100 · 15 of 15 policy answers backed by a verified quote · 2 not stated
What does the app collect beyond what it needs to work?
Besides your number and messages, they collect usage, diagnostics, device IDs, IP-based location, and, if you enable features, your address book, precise location, and photos.
Does it record your voice, face or body, and what happens to that?
Calls are end-to-end encrypted. If you use avatar photos or age checks, they process a face or body in the photo; age-check selfies are deleted after the estimate.
Are your chats and uploads used to train AI models, and is that off by default?
Not stated in the documents.
Can employees or contractors read your conversations, and when?
People review material for safety, reports, legal requests, and support you send them. They cannot open ordinary encrypted chats.
Are you profiled or tracked for advertising?
They say they do not run third-party banner ads, but you may see other ads in Status and Channels, and those features use ad-related cookies.
Do they sell or share your data, and can you opt out?
They share collected information with Meta companies and other vendors that must use it on WhatsApp’s instructions to run the service.
What rights do they take over what you type and what the AI makes?
They do not claim ownership of what you submit. You give a license only so they can operate and provide the service.
How long do they keep your data after you delete it, and can you delete it in the app?
You can delete the account in the app. They say deletion or de-identification generally takes up to 90 days, with longer keeps for legal or security reasons.
Does it build a lasting memory or profile of you, and can you see, edit or turn it off?
These documents do not describe an AI memory of your chats. You control profile visibility like last seen and photo in settings.
Do they commit to basic security, and have they leaked data?
They describe end-to-end encryption, authentication keys, and trusted-device checks. These pages do not describe an independent audit or bug-bounty program.
Is there a real age gate, and are teens protected?
You must be at least 13, or older where local law requires it. Younger users may get a parent-managed account, and they sometimes use age checks including a video selfie.
Will they tell you when the rules change, and is the policy specific?
Both documents are dated. Terms changes get at least 30 days’ notice. The privacy policy lists data types, purposes, and many retention periods.
Can they close your account without warning, and can you get your data out first?
They can suspend or end access anytime for suspicious or unlawful conduct. Inactive accounts can be deleted without an alert. You can delete in the app first.
If something goes wrong, who pays?
For EEA users they accept unlimited liability for death, injury, intent, and gross negligence, and otherwise limit losses they did not cause or could not reasonably foresee.
Do subscriptions renew on their own, and can you get a refund?
Not stated in the documents.
The privacy policy is 15,101 words at a professional or legal expert level (Flesch reading ease 4.5); the terms are 3,710 words at a professional or legal expert level.
