A colleague sends you a confidential message on WhatsApp. You want help answering it, so you paste it into Meta AI. The app has not changed. The recipient and the rules governing the content have.

Harto Pönkä’s October 6 warning identifies substantive concerns about training, advertising and search partners. Meta’s own training announcement supports the central warning about content sent to its AI. Its newer privacy claims need a separate assessment: announcing a protected mode does not prove that every deployed instance delivers every promised protection.

Same app, different recipients

WhatsApp says ordinary personal messages and calls remain end-to-end encrypted. Trail of Bits independently describes that encrypted messaging architecture in its technical review. WhatsApp separately says Meta receives content sent to standard Meta AI directly or in a group. These sources support distinguishing ordinary encrypted conversations from content deliberately shared with AI; they do not constitute an exhaustive audit of every current WhatsApp data flow. WhatsApp privacy FAQ, Trail of Bits technical analysis

Message encryption does not establish that WhatsApp collects no information about usage or accounts. EFF explains that encryption in transit does not encrypt metadata. EFF’s encryption guide

Encryption protects a message against parties outside its intended endpoints. It does not stop the recipient from processing what it receives. Consequently, saying that an AI conversation is simply “unencrypted” obscures the important question: which system can obtain readable content, and what may it do with it? Transport encryption and protection from the service operator are different guarantees.

AI training is a documented concern in Europe

Meta’s April 2025 European announcement explicitly included interactions with Meta AI, such as questions and queries, in the information used to train and improve its models. It separately discussed adults’ public posts and comments. A March 27, 2026 update clarified its exclusion of private messages: it does not apply when someone shares those messages with an AI feature. This is Meta’s stated processing policy, not an independent measurement of its training datasets. Meta’s European training announcement

A prompt about an employment dispute, a family member’s condition or a customer’s unreleased plans can reveal information intended for a much smaller audience. Training use adds another purpose for processing it; it does not establish that a model will reproduce a particular conversation to another user.

The Irish Data Protection Commission independently documents Meta’s European training proposal and objection-form measures, specifically discussing public posts. That statement does not establish the scope of an objection for every WhatsApp AI feature. EU users should inspect current notices and the available objection process, retain the response, and check whether it covers AI interactions as well as public content. An objection to training should not be treated as a promise that every other form of processing stops. DPC statement, May 21, 2025

Advertising needs a separate evidence check

Meta announced that AI interactions would become signals for content and advertising recommendations from December 16, 2025, with rollout in most regions. It also said that WhatsApp AI interactions would not personalize experiences across different Meta accounts when WhatsApp had not been added to the same Accounts Center. The announcement excludes certain sensitive topics from ad targeting. Meta’s personalization announcement

Reuters reported that the initial rollout excluded the EU, UK and South Korea. This review did not confirm a later Finland-specific rollout of AI-interaction ad targeting. A broad privacy-policy permission and evidence of actual use are separate things; lack of confirmation here is not proof that such use is absent. Reuters reporting, October 1, 2025

Accounts Center linking and model training are separate questions. Avoiding unnecessary account linking is a reasonable way to limit connected experiences, but it should not be presented as a switch that makes standard AI prompts confidential or prevents all training.

Incognito Chat: an announcement is not a complete privacy guarantee

On May 13, 2026, Meta announced Incognito Chat for WhatsApp and the Meta AI app. AP also reported the announcement and attributed the inaccessible-content and disappearing-message promises to Meta. This corroborates the public announcement; AP’s report is not a technical test of those promises. Neither source establishes availability for every Finnish account. Meta’s Incognito announcement, AP’s contemporaneous report

Private Processing runs inference in a protected cloud environment. Meta’s engineering description uses confidential virtual machines and remote attestation, which lets the client verify the processing environment before sending encrypted requests. Readable input is processed there to generate a response; the architecture aims to keep it inaccessible to the infrastructure operator. This involves a different trust model from a conversation processed only on two people’s devices. Meta’s engineering description

There is independent technical evidence for the underlying architecture, with substantial limits. NCC Group’s 2025 assessment reviewed the Message Summarization Service, not the later Incognito Chat product. It found software-level privacy and non-persistence in the reviewed systems, subject to assumptions and remediation. The report explicitly warns that reviewed code may differ from launch code and that third-party services and dependencies were outside scope. It also identifies remaining trust in Meta and its partners. Meta commissioned the assessment. NCC Group report, executive summary

Trail of Bits’ pre-launch review found 28 issues, including eight high-severity findings. Its April 2026 account describes fixes, partial fixes and remaining lower-severity issues, and emphasizes implementation and reproducibility limits. Trail of Bits’ audit analysis

On May 15, 2026, researcher Laurent Gaffié published a Secorizon report alleging that the production transparency infrastructure was non-functional. This review has not independently reproduced the finding or established its current remediation status. The allegation does not prove that Meta has read conversations, but raises a material question about the ability to verify production behavior. Secorizon’s original report

The audits support parts of the underlying security design. They do not certify every current Incognito session or rebut concerns about standard Meta AI data collection.

Web search can cross another boundary

Meta’s Private Processing whitepaper describes optional web search. The model creates a query from the prompt and relevant context, then sends it outside the protected environment through Meta infrastructure to external search providers. It says searches are not linked to the user, query terms are visible in the interface and transparency report, and users can disable search. It also describes minimization and query-length limits. Private Processing technical whitepaper, web-search section

Removing an account identifier does not necessarily make the words of a query anonymous. A rare name or distinctive confidential detail can identify someone through content alone. That is a risk analysis, not a claim that such a disclosure occurred.

This review did not find a separate technical test verifying those search controls in current Incognito sessions. Where the documented control is available, disable web search before entering information if external queries are unacceptable. If its scope cannot be established, keep confidential information out of that workflow. Reviewing query details afterward cannot undo a transmission.

Controls users and group owners can actually apply

The first control is a rule about content: do not send client records, credentials, private correspondence or other people’s sensitive details to a standard consumer AI assistant. For organizations, the security or privacy owner should specify which AI workflows are approved, including whether external search is permitted. Demonstrate the distinction using synthetic examples rather than real records.

For sensitive conversations, inspect the per-chat sharing restrictions. WhatsApp introduced Advanced Chat Privacy to block chat exports, automatic media downloads and use of messages for AI features. During this review, the linked help page was titled About restricted chat, while indexed documentation still described the earlier setting. Labels and availability may therefore differ by version. These are documented product controls; their enforcement was not independently tested here. WhatsApp’s feature announcement, WhatsApp’s current help link

Open the conversation’s information screen and check the restrictions described by the setting available on your version. Have the group administrator manage group restrictions. Confirm the setting remains enabled and, using synthetic messages, check that the relevant AI or export action is unavailable. Update participants’ apps and read the current limitations: earlier help documentation warned about older clients and exclusions for certain Meta-hosted business chats. Do not assume those limitations have disappeared because the label changed.

This reduces supported sharing paths. It cannot guarantee that another participant will never manually copy information, photograph a screen, or send content through another tool. A group still needs an agreement about sharing its members’ information.

Before using AI, confirm the mode, read its current notice and check external-search controls. Review Accounts Center for unnecessary linking. Keep workplace secrets and other people’s sensitive information in an approved workflow with an acceptable data-handling basis.

If confidential information has already been submitted, identify what was sent, which mode was used, and whether a search query was generated. Use available deletion and privacy-request controls, retaining confirmation of what the provider says was removed. For workplace or customer information, report the disclosure through the organization’s established process. A missing chat in the interface is not evidence that every previously processed copy or downstream use has been erased.

Sources