WhatsApp vs. Signal: Which Messenger Protects Your Data Better?

Is Signal more secure than WhatsApp?

Yes. Both messengers encrypt messages and calls end-to-end, but Signal collects hardly any metadata, is open source and is run by a non-profit foundation without an advertising business. WhatsApp collects significantly more data about your communication and belongs to the Meta group.

Many people use WhatsApp to stay in touch with friends, family and colleagues. Less well known is how much data is generated alongside the actual messages – and that the messenger belongs to the Meta group, which also includes Facebook and Instagram. Data protection experts have criticised this for years and recommend alternatives such as Signal. Here you will learn how the two messengers differ in terms of data protection and what this means for you and your business.

WhatsApp vs. Signal at a glance

How does WhatsApp handle your data?

Since 2016, WhatsApp has encrypted messages and calls end-to-end by default – using the Signal Protocol, which was originally developed for Signal. This means WhatsApp cannot read content such as texts, images or voice messages.

Metadata is a different story. Among other things, WhatsApp collects:

• phone number, profile name and profile picture
• the phone numbers in your address book if you allow access to your contacts
• usage times, online status and group memberships
• device, connection and approximate location data (e.g. via the IP address)

This data reveals who communicates with whom and when – even without knowing the content.

Three more points you should know:

• Backups: Chat histories can be backed up to Google Drive or iCloud. Since 2021, end-to-end encryption can be enabled for these backups – but it is off by default. Without it, backups are stored unencrypted with the cloud provider.
• Undelivered messages: If a message cannot be delivered, WhatsApp stores it encrypted on its servers for up to 30 days and then deletes it.
• Meta AI: WhatsApp now includes an AI assistant from Meta. Messages to Meta AI are not end-to-end encrypted like normal chats. Our article on Meta AI explains what Meta does with such data.

What data does WhatsApp share with Meta?

WhatsApp shares certain information with other Meta companies, for example for infrastructure, security and protection against spam and abuse. A special rule applies to users in the EU: according to WhatsApp, their data is not passed on to Meta for Meta to improve its own products or advertising on Facebook and Instagram. WhatsApp also confirmed this commitment to the European Commission in 2023.

Even so, the data processing is not entirely unproblematic. In 2021, the Irish Data Protection Commission fined WhatsApp 225 million euros for failing to provide sufficiently transparent information about how it processes data and shares it with other Meta companies.

How to request your data from WhatsApp

Under Art. 15 GDPR, you have a right of access to the data WhatsApp stores about you. You can request the report directly in the app:

1. Open WhatsApp and go to Settings.
2. Select Account.
3. Tap Request account info.
4. Confirm the request.

After about three days, a report with information about your account and settings is available for download. Depending on the app version, the menu path may differ slightly. The report does not include chat content. You can find step-by-step instructions in the WhatsApp Help Center.

What does Signal do better for data protection?

Signal is run by the non-profit Signal Foundation and is funded exclusively by donations. There is no business model based on data or advertising. The source code is public, so independent experts can review it.

The key differences from WhatsApp:

• Minimal data: Signal only stores the phone number, the registration date and the time of the last connection. Contacts, groups and profile information remain encrypted.
• Usernames instead of phone numbers: You can create a username and hide your phone number from others.
• Encryption everywhere: Messages, calls, video calls and group calls with up to 75 people are always end-to-end encrypted. Encryption does not need to be enabled.
• Hardly any metadata: With the “sealed sender” feature, even Signal cannot see who sent most messages.
• Disappearing messages: You can set a timer after which messages are deleted automatically.

Messages are only stored temporarily and encrypted on Signal's servers until they are delivered, and then deleted. They are only stored permanently on the devices.

WhatsApp in your business: what you need to consider

From a data protection perspective, WhatsApp is difficult for businesses. The biggest problem is contact syncing: anyone who gives WhatsApp access to their address book transfers the phone numbers of all contacts to WhatsApp – including people who do not use WhatsApp and never agreed to this. Companies usually lack a legal basis for this.

There are further issues:

• There is no data processing agreement with WhatsApp for the standard WhatsApp app.
• Business chats on private devices are hard to control, archive or delete.
• Data may be transferred to the US.

If you don't want to give up WhatsApp for customer contact, you should use the WhatsApp Business Platform and set it up properly. Our article How to use WhatsApp for business in a GDPR-compliant way explains how. For internal communication, messengers such as Signal, Threema or Wire are usually the better choice. Either way, your team needs a clear messenger policy.

You can also find an up-to-date overview of WhatsApp's data protection risks in our article WhatsApp and data protection 2026.

Is switching to Signal realistic?

WhatsApp is so widespread that for many it has almost become a prerequisite for communication. A messenger is only useful if the people around you use it too – which makes switching difficult.

In companies, things are different: you can decide which messenger is used for internal communication. Many companies that care about data protection therefore use Signal or Threema internally and use WhatsApp, if at all, only via the Business Platform for customer contact.

Conclusion

WhatsApp reliably encrypts content, but it collects a lot of metadata and belongs to the Meta group. Signal has a clear advantage in data protection: hardly any metadata, open source, no advertising and a non-profit operator.

For businesses, personal WhatsApp accounts can hardly be used for business communication in a GDPR-compliant way. Signal is a secure alternative for internal chats, while customer contact requires a properly configured business solution and a clear messenger policy.

Not sure which messengers and tools are permitted in your company? An external data protection officer from heyData reviews your communication channels and helps you set clear rules for your team.

Take the first step towards privacy-compliant communication. Book a demo now!