Signal vs WhatsApp: same encryption, different owners, and the owner is the product

Signal and WhatsApp encrypt your messages with the same protocol, so the honest comparison was never about the cryptography. It is about who owns the pipe, what they collect around your messages, and what they hand over when a court asks. On that test Signal wins outright, WhatsApp is far better than its reputation, and the practical answer for a UK household is not a dramatic switch. It is running both, deliberately. That verdict is assembled from leaked law enforcement paperwork, both companies’ own documents and years of expert consensus rather than our own bench.

The shared foundation is not a rumour. WhatsApp completed its rollout of end to end encryption in 2016 using the Signal Protocol, built by the same people who make Signal . Cryptographers have treated the content encryption as equivalent ever since. When you read that a messaging app choice is life or death for your texts, remember both of these apps lock the box the same way. The argument is about everything around the box.

Same lock, different building

Three things actually separate them, and none is the cipher.

Metadata first. WhatsApp collects who you message, when, how often, and your address book, and it belongs to Meta, whose business is joining data like that to an advertising profile. Signal is engineered not to know those things in the first place, which is not a promise but an architecture, and it has been tested in court, twice, as the next section shows.

Backups second, because this is the classic hole in “WhatsApp is encrypted”. For years the nightly backup to Google Drive or iCloud was not end to end encrypted, leaving that copy of your chats outside the encryption entirely; end to end encrypted backups arrived in 2021 as an option you must switch on . Do it today, it takes a minute. Signal never uploads your history unencrypted; its backups are local or opt in and key locked.

Verifiability third. Signal publishes the source code for its clients and its server, so outsiders can check the claims. WhatsApp uses the public protocol inside a closed app, so on everything beyond the cipher you are taking Meta’s word.

Read next Is Brave the best privacy browser? The browser half of the privacy stack, weighed on the same evidence first terms. →

What each hands over when compelled

Policies are promises. Documents are better. In 2021 the transparency group Property of the People obtained an internal FBI guide comparing what US agencies can extract from each messenger, first reported by Rolling Stone: from WhatsApp, subscriber records under subpoena, the target’s address book contacts under warrant, and, uniquely among the apps listed, near real time metadata on who is messaging whom, delivered every fifteen minutes under a pen register order; WhatsApp’s spokeswoman confirmed the capability while noting it never includes message content .

Signal’s line in that same chart reads almost empty, and Signal has proved it in court. Its first grand jury subpoena, in Virginia in 2016, produced exactly two things: the date the account was created and the date it last connected . A California search warrant in 2021 produced the same two timestamps, because Signal’s servers hold nothing else to hand over . This is the messaging equivalent of the police raid that left Mullvad’s office empty handed in our VPN comparison: a no data claim is worth little until someone with a warrant tests it.

Honesty cuts both ways here. Signal’s worst incident is real but small: a 2022 phishing attack on Twilio, its SMS verification supplier, exposed phone numbers for about 1,900 users, with no message history or contacts touched . And WhatsApp owns the strongest pro user legal fight in messaging: it sued NSO Group over the 2019 Pegasus attack on its users and won a jury verdict in 2025 . The trial judge later cut the punitive award to a small fraction of what the jury set . Pegasus is also the caveat that applies to both apps equally: spyware that owns the phone reads everything after decryption, and no messenger protocol can stop it.

Follow the money, again

WhatsApp’s founders published a manifesto in 2012 titled “Why we don’t sell ads”, listing among advertising’s sins “the insults to your intelligence and the interruption of your train of thought” . Both founders later left Meta; Brian Acton walked away from a fortune in unvested stock and told Forbes “I sold my users’ privacy”, then lent Signal the money that turned it into a nonprofit foundation . The company he left completed the arc in June 2025, when Meta announced adverts inside WhatsApp’s Updates tab , with targeting fed by Meta account data and business messaging framed by Meta’s chief executive as the next pillar of the business . Chats themselves stay ad free, for now, and the unremovable Meta AI button that appeared in 2025 suggests the direction of travel.

Signal’s model is the mirror image, with its own honest weakness: it is a donation funded nonprofit that publishes its running costs, and those costs are enormous for a charity . A messenger with no revenue engine depends on goodwill continuing. That is a real long term risk, and still a different category of risk from a messenger whose owner profits from knowing you.

One more UK relevant fact about the “free” price: WhatsApp does not link your data to Meta advertising in the UK and EU the way it does elsewhere, and that carve out was not volunteered. It followed the largest fine Ireland’s data regulator had ever issued . Your privacy settings here are held up by enforcement, not generosity.

The UK switch, honestly

In Britain, WhatsApp is the default: Ofcom found around three quarters of UK adults use it, and roughly two thirds call it their main messenger, with only one in ten switching their most used app in a year, half of them switching towards whatever their friends use . The 2021 privacy policy panic proved both points at once. Signal went from outside the UK’s top thousand apps to the country’s most downloaded app within days . Then the install surge faded nearly as fast as it arrived , partly because the policy change was narrower than the outrage suggested , and mostly because everyone’s groups stayed put.

The lock in is structural, and WhatsApp documents it themselves: an exported chat history is a text file that cannot be imported back into anything, WhatsApp included . Leave and your history stays behind. Two changes since then soften the switch. Signal usernames, added in 2024, mean a new contact never needs your phone number, though you still register with one . And both apps proved something about their spines in 2023, when WhatsApp and Signal each said they would leave the UK rather than break encryption for the Online Safety Act’s scanning powers . The government answered that scanning would only be demanded where technically feasible, while pointedly leaving the power in the law , so the apps stayed, and so did the standoff.

A word on the app people switched to by accident: Telegram is not the private option. Its standard chats are not end to end encrypted at all; only opt in secret chats are, and they do not work for groups . Moving from WhatsApp to Telegram for privacy is a downgrade wearing a costume.

Who should do what

Privacy Guides, the strictest mainstream recommendation list, puts Signal first and does not include WhatsApp at all , and for a journalist, an activist, or anyone whose threat model includes a court order, that is correct and settled. For everyone else the honest playbook is deliberate dual running: install Signal, move the conversations that deserve it, and keep WhatsApp for the groups whose switching cost is not yours to pay, the way households quietly end up running Jellyfin beside Plex rather than picking a winner.

Concretely: put your partner, close family and anything sensitive, medical, financial, legal, on Signal. Flip on WhatsApp’s encrypted backups tonight either way. Share your Signal username instead of your number with new people. And let the school group, the five a side chat and the extended family stay where they are until they move themselves. Privacy that survives contact with your real social life beats a purist switch you quietly abandon by March. If the keep it local instinct runs deeper than messaging for you, running AI on your own hardware is the same decision at a larger scale.

The verdict

Use Signal for the inner circle: same encryption as WhatsApp, none of the metadata, a court tested empty filing cabinet, and a nonprofit owner. Keep WhatsApp for the groups you cannot move, with encrypted backups switched on and the knowledge that Meta reads the envelope even though it cannot read the letter. Skip Telegram for privacy entirely. The realistic win is not deleting WhatsApp, it is demoting it.

Sources