A Popular Messaging App's New Metadata Policy, Explained

A widely used end-to-end encrypted messaging app updated its privacy policy last week to extend, from thirty to ninety days, how long it retains certain connection metadata — information about when and how often accounts communicate, though not the content of those communications, which remains encrypted throughout.

The change has drawn attention from privacy researchers less because of the specific number of days and more because it highlights a distinction that end-to-end encryption's marketing tends to blur: encryption protects message content, but it was never designed to protect metadata — who is talking to whom, when, and how often — which can be revealing on its own, sometimes more revealing than content itself in aggregate.

The company's stated rationale for the extension centers on abuse prevention, arguing that a longer retention window improves its ability to detect coordinated spam and harassment campaigns that unfold over a timeframe longer than thirty days. Privacy advocates broadly accept that rationale as plausible while still arguing that any retention extension deserves proportionality scrutiny rather than a blanket policy update.

Legal experts note that metadata retained by a messaging provider, regardless of retention window, remains subject to lawful subpoena in most jurisdictions in a way that properly implemented end-to-end encrypted content generally is not. That gap is precisely why metadata minimization, not just content encryption, has become a growing focus for privacy-oriented app design.

For users specifically concerned about metadata exposure, researchers point to a narrower set of mitigations: apps that route traffic through mix networks or otherwise obscure connection patterns, though these come with real usability tradeoffs that have kept them from mainstream adoption. The broader lesson researchers emphasize is a familiar one: encryption is a necessary privacy protection, not a complete one.