What the default settings do
WhatsApp uses end-to-end encryption for messages and calls by default, which means the content of your conversations cannot be read by WhatsApp or Meta. However, the app still collects metadata - who you talk to, when, and how often. Several defaults also expose personal information to all WhatsApp users: your profile photo, last seen timestamp, about text, and read receipts are visible to everyone by default.
WhatsApp shares certain account data with Meta for purposes including ad targeting on other Meta platforms. Two-step verification is not enabled by default, and there is no app-level lock unless you configure one.
Meta AI is built into WhatsApp and cannot be fully removed, though it can be muted or minimized. By default, Meta can only read messages you directly send to Meta AI or that mention it, not your other conversations, and this holds whether or not you have Advanced Chat Privacy turned on for a chat.
A reasonable privacy baseline
These settings are found in Settings → Privacy within the WhatsApp app, unless noted otherwise.
Visibility controls
Last Seen & Online → My Contacts
By default, anyone with your number can see when you were last active and whether you are currently online. Restricting this to your contacts limits that visibility. You can also choose "Nobody" if you prefer full privacy, though you will also lose the ability to see others' last seen.
Profile Photo → My Contacts
Limits who can see your profile photo to people in your address book. The default is "Everyone," which includes any WhatsApp user who has your number.
About → My Contacts
Your about text is visible to all WhatsApp users by default. Restricting it to contacts keeps it within your known circle.
Status Privacy → My Contacts
Status updates (the Stories-like feature) are shared with all contacts by default. You can restrict this to specific contacts or exclude certain people.
Read receipts and activity
Read Receipts → Off
Disabling read receipts means others will not see blue checkmarks when you read their messages. You will also stop seeing read receipts from them. Note that read receipts in group chats cannot be disabled.
Groups → Who Can Add Me → My Contacts
By default, anyone can add you to group chats. Restricting this to your contacts prevents unknown numbers from adding you to groups without your approval.
Live Location → Review and stop any active sharing
Live location sharing is always opt-in per conversation, but it is worth periodically checking that you are not sharing your real-time location in any chats you have forgotten about.
Meta AI and linked data
Advanced Chat Privacy → On for sensitive chats (Chat → Contact info, or Group info → Group permissions → Advanced chat privacy)
This per-chat setting blocks exporting the chat, stops other participants' devices from auto-downloading media, and prevents anyone in that chat from using Meta AI to summarize, answer questions about, or generate images from its content. It does not add encryption beyond WhatsApp's standard end-to-end protection, and it is not available in chats with a business that hosts its messaging through Meta. Any participant in a one-on-one chat can normally turn it back off, so it works better as a shared agreement than a guarantee.
Linked Accounts in Accounts Center → Review (Meta Accounts Center, in-app or at meta.com/accounts_center)
Linking WhatsApp to your Meta Accounts Center is optional and off by default. If linked, Meta can share account identifiers, age information, cross-posted content such as a story shared from Instagram or Facebook, and usage information across apps for purposes including ads. Message content and calls stay end-to-end encrypted regardless, and your WhatsApp contact list is not shared with other Meta companies.
Security
Two-Step Verification → Enabled (Settings → Account → Two-step verification)
This adds a six-digit PIN required when re-registering your phone number with WhatsApp. It protects against SIM-swap attacks and unauthorized account transfers. This is not enabled by default.
App Lock (Fingerprint/Face ID Lock) → On (Settings → Privacy → App Lock)
Requires biometric authentication to open WhatsApp. This adds a layer of protection if someone has physical access to your unlocked phone.
Chat Lock → Enable for sensitive conversations
Individual chats can be moved to a locked folder that requires biometric authentication to access. This is useful for conversations that contain sensitive information. Locked chats also hide notification previews for those conversations.
Trade-offs
- Turning off read receipts is reciprocal: you lose the ability to see whether others have read your messages. Group chat read receipts remain on regardless.
- Restricting “Last Seen & Online” to contacts means you also cannot see this information for people outside your contacts.
- Setting groups to “My Contacts” means non-contacts who try to add you will need to send an invitation that you must accept, which adds a step for legitimate group invitations.
- Enabling app lock adds a small friction each time you open WhatsApp. The timeout can be adjusted to reduce this.
- Two-step verification means you need to remember an additional PIN. If you forget it, there is a waiting period before you can reset it.
- Advanced Chat Privacy cannot be enforced unilaterally in one-on-one chats; the other person can turn it off, and it is unavailable for chats with Meta-hosted business accounts.
- Leaving your Meta Accounts Center unlinked means you cannot use certain cross-app features, such as sharing a WhatsApp status directly to an Instagram or Facebook story.
Who should not change these settings
- If you use WhatsApp for business or customer communication where being easily reachable matters, keeping profile photo and about visible to “Everyone” may be appropriate.
- If read receipts are important for your communication style - for example, coordinating time-sensitive plans - keeping them on is reasonable.
- If you frequently join group chats initiated by acquaintances or organizations not in your contacts, restricting group additions to “My Contacts” may cause you to miss legitimate invitations.
- If you are the only person who uses your phone and app lock feels unnecessary, skipping it is a valid choice.
- If you regularly cross-post between WhatsApp, Instagram, and Facebook, linking your Meta Accounts Center is a reasonable trade-off for that convenience.