Data Protection and WhatsApp: Is Signal a Real Alternative?

Introduction

Many people use WhatsApp to stay in touch with friends, family, and colleagues, but not all users know that behind the messenger app stands Facebook, the social media platform notoriously known as a data-hungry giant. WhatsApp users can never be entirely sure whether their metadata and contact numbers are also being passed on to Facebook. Data protection advocates have long viewed Facebook's appetite for data with suspicion, and alternatives like Signal and others have emerged in response.

Data Protection at WhatsApp: What You Need to Know

WhatsApp is indispensable for many people — over two billion people worldwide use the messenger. But when it comes to data protection, many users are unsure. What data does WhatsApp share? And how well does the service protect personal information? Despite the GDPR, there are loopholes that WhatsApp and Facebook exploit. A critical look is worthwhile here.

Facebook, the parent company, has often been criticized for how it handles personal data and data protection, as European standards tend to take a back seat. Under external pressure and unfavorable media coverage, Facebook responded by introducing end-to-end encryption for WhatsApp. This is a first step toward ensuring that messages and calls can't be intercepted by a third party. At the same time, users can also set data protection preferences in the WhatsApp settings, allowing them to clearly define how their data is used and how visible they are to other users.

Despite all of WhatsApp's efforts, data protection leaks keep coming to light. In 2017, media reports revealed that a developer had managed to read out the online status of any user using just their WhatsApp phone number. The data gathered this way can be used to build communication logs, putting internet data security at risk.

How Does WhatsApp Handle Your Data?

Thanks to end-to-end encryption, WhatsApp isn't supposed to be able to read content such as messages or images — in theory. In practice, however, the service still collects a wide range of metadata: profile pictures, location data, usage times, billing information, and more.

Under Art. 15 GDPR, you have the right to access this data. You can request a report directly in the app — in just a few clicks:

Requesting a report from WhatsApp is fairly straightforward:

• Open the WhatsApp app
• Select Settings
• Open Account
• Request Account Info

After about three days, you'll receive a complete data package with information about your profile, your usage, and your settings.

Many users — especially businesses — store their chat histories in the cloud. In doing so, they lose the protection of end-to-end encryption. Instead, the data sits with cloud providers, often on US servers.

WhatsApp also stores undelivered messages on US servers. The provider promises to delete them after 30 days — but when pressed for details, WhatsApp often stays vague. Data protection experts therefore recommend server locations in Europe.

Is Life Without WhatsApp Possible?

Of course, there are plenty of alternatives to the popular messenger today, and apps like Threema, Signal, and Wire offer a stronger data protection perspective. But the fact remains that WhatsApp has such widespread adoption that it's become almost a basic requirement for communication.

Even internal work groups are often run on WhatsApp, which makes actively avoiding the app a real problem for employees.

Being first to market gave WhatsApp a decisive advantage — it offered a messaging service that was easy to use while also being highly functional. These features fueled WhatsApp's rapid growth, and many users consider data protection secondary, since the benefits of visibility and reach outweigh it for them.

Other messengers have a hard time in the market, since a messenger only pays off if your social circle also agrees on the same app. Businesses that value data protection set up user groups on WhatsApp alternatives to stay compliant, but people's private lives will keep relying on WhatsApp. WhatsApp's dominance could only be shaken by a global data protection scandal, or by a competitor offering advantages compelling enough to make switching unavoidable.

What WhatsApp Data Is Shared with Facebook?

To use WhatsApp, you first have to agree to the provider's terms of service. WhatsApp then collects metadata covering things like device information, the type and frequency of use, and phone numbers. This data is passed on to Facebook. According to WhatsApp's FAQs, this data sharing serves to improve and protect WhatsApp — the reasoning being that it helps guard against fake news and fraudulent accounts. By agreeing to the terms of service, you can't prevent this data sharing. By invoking a legitimate interest in data exchange, WhatsApp and Facebook effectively sidestep the General Data Protection Regulation.

Signal vs. WhatsApp: Which Offers Better Data Protection?

Of course, many people are tied to WhatsApp, since in most cases their social circle is also active on the controversial platform. But at the same time, many WhatsApp users are also aware that there are secure alternatives that put a stronger focus on data protection.

Ask a data protection officer, and they'll point you to Signal. Signal stands for security and protected privacy, something its open-source code already hints at. This is especially appealing, since any potential security risks or spying attempts would be spotted immediately.

Just like WhatsApp, Signal is a free service — one that offered end-to-end encryption from the very start, which WhatsApp only adopted later, under pressure. Unlike WhatsApp, Signal doesn't aim to be a profitable messaging service — it's run as a non-profit foundation, funded entirely by donations.

What Data Protection Does Signal Offer?

Signal only processes the bare minimum: your phone number and, if you choose, your contacts. You can also use a pseudonym or an emoji as your display name. Technical call data is encrypted and anonymized, so no conclusions can be drawn about individual users, since the data is secured through random authentication tokens and push tokens.

It's especially important that end-to-end encryption makes it impossible for messages and calls to be intercepted by a third party. This applies to audio and video calls as well as group calls with up to five users — a particularly important criterion for businesses.

Message Security on Signal

One special feature of Signal is "disappearing messages." You set a timer, and once the chosen time period expires, messages are no longer visible — they're deleted by the app. Messages aren't stored on any external servers; they always remain on the devices themselves. This means Signal avoids the problem of a non-GDPR-compliant server location altogether. Encryption is always active and doesn't need to be turned on manually.

Conclusion

WhatsApp is widely used — but it's no role model when it comes to data protection. Despite encryption, metadata is collected, shared with Facebook, and in some cases stored on US servers.
Signal offers a clear advantage: strong data protection, no advertising, no data sharing.

For businesses and anyone who values GDPR compliance, Signal is a real, secure alternative to WhatsApp.