WhatsApp is one of the most popular messaging apps in the world, with over 2 billion users globally. When Facebook acquired WhatsApp in 2014 for $19 billion, it raised questions about how WhatsApp would handle user data privacy and storage. With WhatsApp’s new 2021 privacy policy update, there is renewed interest in understanding where WhatsApp stores user data.
What data does WhatsApp collect?
WhatsApp collects a range of data from its users:
- Account information like your phone number, profile name, profile picture, and status message
- Your contacts list
- Any messages, photos, videos, voice messages, documents, and other media you send via WhatsApp
- Metadata like senders and recipients for messages, date/time stamps, mobile phone identifiers, IP addresses, and more
- Interactions with businesses using WhatsApp Business
- Payment transaction information if you use WhatsApp Pay
- Information about your use of WhatsApp features like your last seen status, groups, and broadcast lists
Some of this data is encrypted end-to-end, like your messages, while other data like your profile info and contacts list is available to WhatsApp/Facebook.
Where does WhatsApp store user data?
WhatsApp data and servers are distributed across data centers around the world. According to WhatsApp, user data is stored in these general locations:
- United States
- Singapore
- Netherlands
- Ireland
- Sweden
- Germany
However, the specific data center locations are not publicly revealed by WhatsApp or Facebook for security reasons.
Factors impacting WhatsApp data storage
There are several key factors that impact where and how WhatsApp stores user data:
1. Data privacy regulations
Different countries have various data privacy and protection laws that impact how tech companies handle user data. For example:
- The EU’s GDPR imposes strict requirements for handling data of EU citizens.
- India is considering data localization laws that would require Indian user data to be stored only in India.
- The US does not have a single comprehensive federal privacy law like GDPR.
To comply with regulations, WhatsApp maintains localized data centers in various countries and regions.
2. Proximity to users
WhatsApp replicates user data across multiple data centers located closest to its user base for faster and more reliable service. This optimized local storage helps provide low latency and quick access across networks.
3. Server capacity
WhatsApp’s enormous user base means it requires extensive server capacity to store the sheer volume of data generated daily. The companyStripe utilizes multiple high-capacity data centers across the globe to store and process huge amounts of messaging data, media, profiles, and more.
4. Data redundancy
To prevent data loss in case of outages or disasters, WhatsApp maintains redundant copies of user data in at least two different geographic regions. So if one data center goes down, data can be retrieved from a secondary location.
How does WhatsApp encrypt user data?
While WhatsApp does store user data like messages and media on its servers for backup purposes, it claims this data is heavily encrypted for security:
- WhatsApp uses end-to-end encryption for all messages, voice calls, video calls, media, and file transfers between users.
- Encryption keys are stored only on individual user devices, not WhatsApp servers.
- The company cannot decrypt user messages or calls.
- WhatsApp messages are encrypted with the Signal Protocol designed by Open Whisper Systems.
- Each chat has its own encryption keys.
- Backed up data is encrypted using a unique user key, which WhatsApp does not store.
This encryption is meant to prevent third parties including WhatsApp itself from accessing private user content. However, metadata remains visible.
Can users delete WhatsApp data?
Yes, WhatsApp provides options for users to delete their WhatsApp data from the app itself or by reaching out to WhatsApp support. Here are the key data deletion options:
Delete account
Users can delete their WhatsApp account entirely, which erases all data from WhatsApp servers. Instructions:
- Go to WhatsApp Settings > Account > Delete My Account.
- Confirm account deletion.
Delete chats
Individual chats or message threads can be deleted from WhatsApp on the user’s device. This also deletes chat history from WhatsApp servers after 30 days.
Delete media/files
Users can delete specific media like photos, videos, voice messages, documents, etc. sent or received on WhatsApp by deleting them from their phone’s gallery.
Request data deletion
If users cannot fully delete data from their devices, they can contact WhatsApp support to request deletion of their account info, chats, groups, media, etc.
However, residual copies of data may still exist in WhatsApp backups and caches after deletion. The company may retain data to comply with legal obligations.
WhatsApp data compliance and practices
While WhatsApp assures strong encryption for user content, the platform’s data collection, storage, and sharing practices have faced scrutiny:
- WhatsApp shares certain user data like phone numbers and analytics with parent company Facebook for advertising and business purposes.
- WhatsApp complies with government requests for user data in accordance with laws.
- Users must agree to privacy policies and terms of service that give WhatsApp rights to store, backup, and access user data.
- WhatsApp cannot provide complete assurance that unauthorized parties have not accessed or obtained user data.
- Security vulnerabilities have allowed spyware like Pegasus to hack WhatsApp for surveillance.
This has led some privacy advocates to question putting too much sensitive user data in the hands of a single private company like Facebook.
WhatsApp data shared with Facebook
| Data type | Shared with Facebook? |
|---|---|
| Messages | No |
| Media | No |
| Contacts | Yes |
| Location | Yes |
| Transaction data | Yes |
| App usage data | Yes |
Government data requests
WhatsApp received 55,630 requests for user account data from governments around the world in the second half of 2020:
| Country | Number of requests |
|---|---|
| United States | 11,887 |
| India | 3,004 |
| Germany | 28,258 |
| France | 4,564 |
| United Kingdom | 4,372 |
Conclusion
In summary, WhatsApp stores user data like messages, media, contacts, and profiles on servers and data centers located across the globe. While it encrypts user content and obscures exact data center locations for security, metadata and some personal data is shared with Facebook and governments when legally required. Users can delete their WhatsApp account or data directly within WhatsApp, but complete data deletion cannot be guaranteed. While WhatsApp assures security and privacy safeguards, concerns remain around concentration of user data with tech giants like Facebook and potential risks of government surveillance. Users should be cognizant of WhatsApp’s data practices when deciding how much personal data to store on the platform.