WhatsApp implements end-to-end encryption for message content, but metadata including phone numbers, profile details, and active usage statistics remain exposed to processing by Meta, utopia.de reported on November 10, 2026.
Direct peer-to-peer connection establishment during internet voice and video calls exposes raw IP addresses between communicating devices, allowing third parties to extract approximate geographic coordinates, according to security insights compiled by Mimikama and highlighted by utopia.de.
Activating the call relay setting routes audio and video traffic exclusively through Meta’s relay infrastructure rather than establishing direct socket connections. Users can access this configuration by opening settings, selecting privacy, entering the advanced submenu, and toggling the option to protect IP addresses in calls.
Routing traffic through intermediate servers prevents remote peers from harvesting network locators. Platform documentation notes that this server redirection may introduce minor latency or perceptual degradation in audio fidelity.
Enabling enhanced chat privacy prevents the automatic local caching of shared multimedia assets onto participant hardware while blocking native chat export utilities and data harvesting for artificial intelligence model training, utopia.de reported.
This setting must be applied individually to specific direct messages or group threads by tapping the recipient’s name within the chat view, scrolling to the enhanced privacy toggle, and engaging the restriction. In multi-user group environments, the enforcement applies uniformly across all participants.
The defensive mechanism does not prevent local optical captures or external screen photography.
Deploying a custom username obscures the primary phone number from new contacts and group participants, though the underlying digits remain mandatory for core account authentication, utopia.de reported.
Users can establish an identifier by accessing account settings and selecting the username configuration field. Consumer protection organizations advise against deploying names that correlate directly with personal identity or mirrors handles used across other social media ecosystems like Instagram or Facebook to prevent cross-platform correlation.
The feature is entirely optional and can be modified or purged subsequently. The platform confirmed that user directory lookups remain restricted, meaning new contacts must possess the precise alphanumeric string to initiate communication.
Restricting profile visibility parameters ensures that sensitive telemetry such as online status, last seen timestamps, profile photographs, and personal info blocks are hidden from unauthorized endpoints, utopia.de reported based on guidance from the EU security initiative Klicksafe.
Configuring visibility to restrict access exclusively to saved contacts prevents unknown entities from scraping status updates. Similarly, adjusting group inclusion permissions prevents arbitrary accounts from injecting users into unwanted messaging cohorts where raw phone numbers might be exposed to malicious actors.
