Texas sues Meta and WhatsApp for allegedly lying about encrypted message privacy
The Lawsuit That Shook the Encryption World
In May 2026, Texas Attorney General Ken Paxton dropped a legal bombshell on Meta Platforms and its messaging subsidiary WhatsApp, filing a lawsuit that challenges the very foundation of WhatsApp's privacy promise. The complaint, lodged in Harrison County district court, alleges that the companies deceived millions of Texans by claiming their messages are end-to-end encrypted and inaccessible—even to WhatsApp itself—while maintaining internal systems that allow employees and contractors to view private communications.
This isn't just another tech privacy skirmish. It strikes at the heart of what made WhatsApp the world's most popular messaging app, with over 3 billion users. If the allegations hold up, they could redefine how encryption claims are scrutinized in marketing and what accountability looks like for platforms that trade on privacy as a feature.
What Texas Alleges: The Core of the Complaint
The lawsuit, brought under the Texas Deceptive Trade Practices Act (DTPA), accuses Meta and WhatsApp of three specific violations. First, the state claims the companies represented that they were unable to access user communications when, in fact, they could and did. Second, it alleges they marketed WhatsApp as a service where messages "stay between you and who you send them to—no one else, not even WhatsApp (or Meta), can read, listen to, or share them," which the state argues is demonstrably false. Third, the complaint asserts that the companies failed to disclose their access capabilities with the intent to induce users into using the platform.
The filing seeks a permanent injunction preventing Meta and WhatsApp from accessing Texans' message content without consent, plus civil penalties of $10,000 per violation. It also demands attorneys' fees, costs, and any other relief the court deems appropriate. This isn't merely about financial penalties—it's about forcing transparency in an area where opacity has been the norm.
Whistleblowers and the Commerce Department Investigation
What gives the Texas lawsuit its teeth are the whistleblower accounts and a previously unreported federal investigation. According to the complaint, a special agent from the Commerce Department's Office of Export Enforcement examined claims that Meta employees and contractors could view WhatsApp message content and concluded those claims were "meritorious." The agent reportedly found that "Meta stores and can view WhatsApp messages" and that "Meta can and does view and store all the text messages, photographs, audio and video recordings" in an unencrypted format.
Even more damning, the complaint describes a tiered internal permissions system that granted different levels of access to WhatsApp content, including a "significant number of foreign/overseas workers in India." This system allegedly allowed employees and contractors to submit requests to obtain the content of private messages, sometimes with little or no scrutiny. A 2024 whistleblower complaint to the Securities and Exchange Commission (SEC) reportedly described the same internal access system, painting a picture of a company that said one thing publicly while doing another behind closed doors.
Meta's Response: 'Categorically False and Absurd'
Meta hasn't taken the allegations lying down. In a statement responding to the lawsuit, Meta spokesperson Rachel Holland asserted, "WhatsApp cannot access people's encrypted communications and any suggestion to the contrary is false." Another spokesperson, Andy Stone, took to social media to call the claims "categorically false and absurd," pointing to WhatsApp's use of the open-source Signal protocol for over a decade as proof that messages are protected.
The company maintains that its encryption is genuine and that any suggestion of access is a misunderstanding or misrepresentation. Yet the lawsuit's reliance on internal documents and whistleblower testimony suggests that the state believes it has evidence that goes beyond mere misunderstanding. The question now is whether Meta can convincingly demonstrate that its encryption is as ironclad as it claims, or whether the discovery process will reveal discrepancies that back up Texas's allegations.
The DTPA: A Powerful Tool for Consumer Protection
The Texas Deceptive Trade Practices Act is one of the strongest consumer protection laws in the country, allowing the attorney general to seek hefty penalties for misleading business practices. By filing under the DTPA, Paxton's office isn't just seeking damages for specific individuals—it's aiming to set a precedent that could affect how all tech companies operating in Texas market their privacy features.
The act prohibits false, misleading, or deceptive acts or practices, including representing that goods or services have characteristics, uses, or benefits they do not have. The state argues that WhatsApp's encryption claims fall squarely into this category. If Texas prevails, it could force Meta to change its marketing language and implement stricter internal controls. More broadly, it could embolden other states to pursue similar actions, creating a patchwork of regulations that tech companies would have to navigate.
Why This Matters for Everyday Users
For the average WhatsApp user, this lawsuit raises uncomfortable questions. If the state's allegations are true, then years of private conversations—family photos, business deals, sensitive personal information—could have been accessible to employees and contractors. The trust that users placed in WhatsApp's encryption may have been misplaced.
Even if Meta ultimately prevails, the lawsuit highlights a critical truth: encryption is only as strong as the company's commitment to it. Users should understand that "end-to-end encryption" can mean different things in practice, and that metadata—who you talk to, when, and how often—is often not encrypted. As consumers, it's worth asking hard questions about what platforms actually do with our data, rather than taking marketing claims at face value.
The Road Ahead: Legal and Industry Implications
The Texas lawsuit is still in its early stages. Meta has not yet filed a formal court response, and the discovery process could take months or even years. But the case has already sparked a broader conversation about encryption, privacy, and corporate accountability. It joins a growing list of data privacy actions brought by Paxton's office against major tech companies, signaling that states are increasingly willing to take on Big Tech over privacy promises.
Depending on the outcome, this case could reshape how companies market encryption features, forcing them to be more transparent about what they can and cannot access. It could also lead to federal action, as lawmakers on both sides of the aisle have shown interest in data privacy legislation. For now, all eyes are on Harrison County, where a judge will decide whether WhatsApp's privacy promise was a genuine commitment or a deceptive illusion.