New Delhi: A fresh privacy debate is building around WhatsApp after Telegram founder Pavel Durov publicly questioned how secure the platform really is.
In a post dated April 12, 2026, Durov accused WhatsApp of misleading users about its end-to-end encryption claims, calling it “the biggest consumer fraud in history.”
On April 9th, Elon Musk and Durov echoed similar statements. At the time, Musk posted on X saying, “Can’t trust WhatsApp.”
WhatsApp’s “E2E encryption by default” claim is a giant consumer fraud: ~95% of private messages on WhatsApp end up in plain-text backups on Apple/Google servers — not E2E-encrypted. Backup encryption is optional, and few people enable it — let alone use strong passwords.
— Pavel Durov (@durov) April 12, 2026
Durov flags WhatsApp cloud backups as key privacy gap
Durov claimed that “approximately 95% of private messages sent on WhatsApp are ultimately stored as plain-text backups on Apple iCloud and Google Drive servers.” He pointed to a known issue where messages are encrypted during transit, but backups are not always protected the same way.
The concern is tied to how backups work. When users enable cloud backup, which is often on by default, chat data gets stored outside WhatsApp’s encryption system. This means the messages may be accessible through those platforms.
Encrypted backups exist, but ‘Off’ by default
WhatsApp does offer an option to protect backups with encryption. But it is not automatic. Users need to manually enable it and set a strong password or a long encryption key.
Durov argued that most users never turn this on. Even if one person enables it, their chat partner might not. That creates another copy of the same conversation without encryption.
Security groups have raised similar concerns earlier. The Electronic Frontier Foundation has warned that “unencrypted backups are vulnerable to government requests, third-party hacking, and disclosure by Apple or Google employees.”
The claims in this lawsuit are categorically false and absurd. WhatsApp has been end-to-end encrypted using the Signal protocol for a decade so your messages cannot be read by anyone other than the sender and recipient.
— WhatsApp (@WhatsApp) April 9, 2026
Legal and industry response
The issue has also reached courts. A class action lawsuit in the US claims WhatsApp has a backdoor allowing access to private messages. Meta has rejected these claims, calling them “false and absurd,” though a detailed technical reply has not been shared.
At the same time, Durov positioned Telegram as a safer option, saying it “has never disclosed a single byte of users’ messages in its 12+ year history.” Still, experts note Telegram does not enable end-to-end encryption by default in regular chats.
For users, the takeaway is simple. Privacy on messaging apps now depends on settings, not just promises.
