WhatsApp is not only convenient – but a data protection issue
WhatsApp is considered the standard for many. “Everyone has it anyway” has become almost like the unofficial operating system of social communication. That is exactly the problem.
Because WhatsApp is not just a messenger. WhatsApp is a Meta service. And thus part of a corporation whose business model has relied for years on evaluating, combining, and making economically usable large amounts of personal data. The fact that this often collides with European data protection is no coincidence, but systemic.
The real scandal: Not only your own data is affected
The central point is often downplayed in public debate: Using WhatsApp on a smartphone and giving the app access to the local address book does not only share your own information, but also the data of other people.
That is also of people who
- do not use WhatsApp at all,
- have never signed a contract with Meta,
- and have never given consent for their phone number to end up at Meta or WhatsApp.
Exactly there lies the data protection issue. Phone numbers from the address book are personal data. For their transmission, a legal basis is needed. And the mere fact that someone uses WhatsApp themselves does not replace the consent of the other contacts. That has been pointed out by data protection authorities for years.
New ruling from Berlin: WhatsApp was set boundaries
Particularly noteworthy is a recent ruling from the Berlin II Regional Court of 23 February 2026 (Case No. 52 O 22/17). In the proceedings of the Federal Association of Consumer Centres, WhatsApp was prohibited from transmitting personal data of users and third parties to Facebook in business dealings with consumers in Germany, as long as these data were based on the previously criticized consent practice. The court criticized exactly the way WhatsApp obtained this consent. However, the ruling is still not binding at the moment.
That is not a minor issue, but a clear signal: The data transfer within the Meta corporation is not automatically legal just because somewhere in long terms of service a checkbox was ticked.
The problem is structural, not only historical
One could now say: “This concerns only old conditions from 2016.” That is too short-sighted.
Because the fundamental problem remains the same: WhatsApp is technically and organizationally designed to match contacts, process metadata, and embed communication into a Meta ecosystem. Even if individual clauses are changed, the question remains on which reliable legal basis data of uninvolved third parties should be processed. That is why data protection authorities and specialized institutions have long warned against the uncritical use of WhatsApp – especially in professional or public administration contexts.
Practically legally hardly usable
And thus we come to the uncomfortable part: Using WhatsApp “normally” means moving on very thin ice from a data protection perspective.
Because in practice, a clean use actually means:
- no uncontrolled access to the address book,
- no transmission of contact data without consent,
- clear technical separation,
- in doubt, a separate phone book only with approved WhatsApp contacts.
Even data protection authorities name exactly these restrictions as a prerequisite to limit the risks. This already shows how absurd the situation is: A messenger, used by billions of people on their everyday smartphones, is data protection-wise only acceptable if it is artificially castrated.
The myth of “private use”
Often the problem is downplayed with the argument that in the private sphere, nobody would look at it so closely. That may often be practically true. Legally, it does not solve the problem.
Because even privately, phone numbers are personal data. Even privately, the lack of consent of the contacts does not simply disappear. And even privately, a data protection issue does not become legal behavior just because it happens millions of times.
Exactly there lies one of the biggest strengths of Meta: The company has managed to normalize a state that is legally and ethically highly problematic. Not because everything would be clean, but because convenience covers every criticism.
Using WhatsApp decides over other people’s data
That is the point that must be clearly stated: Using WhatsApp with an open address book does not only mean making a decision about one’s own data, but also about the data of others.
About friends. Family. Colleagues. Business contacts. People who might even deliberately not want to be part of Meta.
This foreign determination is the real core of the problem. WhatsApp turns the private phone book into a data source for a company that has not become well-known through restraint.
Digital convenience is not a free pass
This is not about being anti-technology. It is also not about condemning people who have installed WhatsApp. It is about being honest:
A service that builds its functionality on users uploading massive amounts of foreign contact data is, from a data protection perspective, no small matter, but a systemic problem.
And if courts now set limits to this model, that is not a hassle against innovation. It is overdue.
Matrix shows that it is possible without address book upload
The often-heard argument that a messenger must have access to the phone book is simply false. I myself use Matrix or Element. There, I do not need a local address book that is transferred to any provider in the first place.
Contacts run through Matrix IDs, rooms, Spaces, or invitation links. That is the decisive difference from a data protection perspective: I can communicate without dragging the data of third parties into a system they have never consented to.
Yes, Matrix also offers, if desired, functions for better findability via phone number or email. But that is exactly the point: on demand. Optional. Not as a requirement, not as a tacit condition of use.
WhatsApp shows how surveillance is sold as comfort. Matrix shows that it can be done differently.
I also use Matrix for this site, so that you can contact me in Contact . Since Matrix has a decentralized network, you can find many different servers here: https://joinmatrix.org
Conclusion
WhatsApp is not just “practical.” WhatsApp is a prime example of how a dominant service has politicized legal violations and gray areas for years through social habituation.
The recent Berlin ruling shows again: The transfer of data to Meta is not arbitrarily legitimizable. And the address book upload remains a major issue – especially for those who do not use WhatsApp at all and yet end up in this system.
You must therefore clearly state: Using WhatsApp with full address book access does not only mean making compromises on your own privacy, but also decides over the data of other people. And that is exactly why WhatsApp is not just a convenient messenger, but a data protection issue that lasts forever.
Sources
- LG Berlin II, Press release on the ruling 52 O 22/17 of 24.02.2026: LG Berlin II decides on the lawsuit of the Federal Association of Consumer Centres against WhatsApp
- Heise on the assessment of the ruling: Defeat for WhatsApp: Berlin Regional Court prohibits data transfer to Facebook
- Landesbeauftragte für den Datenschutz Niedersachsen, Information sheet on WhatsApp: Information sheet for responsible persons on the use of WhatsApp
- Landesbeauftragter für den Datenschutz Rheinland-Pfalz: WhatsApp
- Beck-Aktuell on the legal summary: WhatsApp data transfer is unlawful: Everything at once, please!
