Productivity & Comms Apps · Messaging · Structural / no discrete incident
Meta Messenger
Headline
Messenger's primary findings live in the Meta row in Consumer Apps, and the one that belongs here is the encryption timeline: Messenger did not have end-to-end encryption on by default for most of its existence, and…
Not independently verified. Verification status: Unverified - heuristic first draft. Publish state: draft unverified.
Messenger's primary findings live in the Meta row in Consumer Apps, and the one that belongs here is the encryption timeline: Messenger did not have end-to-end encryption on by default for most of its existence, and users overwhelmingly believed otherwise because WhatsApp - the same parent company - did. Two products, one owner, opposite defaults, and no point in either interface where the difference was made legible. Cross-ref the Meta AI row in LLM Providers for the October 2025 change routing AI chat content into ad targeting across Facebook, Instagram and WhatsApp with no US opt-out.
- Severity
- Evidence tierUnassigned
- Claims confirmed
- Last verified2026-08-04
Primary source. None recorded — Unverified - heuristic first draft.
Terms
Arbitration
Same as Meta overall.
Data sharing
See the Meta row (Consumer Apps tab) for the primary company-wide findings; Messenger specifically has END-TO-END ENCRYPTION enabled by default (rolled out 2023-2024) — a genuine security improvement Meta extended from WhatsApp, though the SEPARATE lawsuit (current status not re-verified as of Oct 2026) alleging Meta/Accenture can still access WhatsApp content DESPITE its own encryption claims (documented in the WhatsApp row) raises a parallel question about whether Messenger's encryption claims hold up to the same scrutiny.
Fees and billing
Not itemized this pass.
Contacts
Privacy contact. No published privacy email; Meta routes all requests through in-product privacy forms
Legal notice. PUBLIC COMPANY (META). Service route: c/o General Counsel / Corporate Secretary, Menlo Park, California — the corporate address on the SEC Form 10-K cover page is the official address of record. Confirm the exact street address on the current 10-K at sec.gov/edgar, and check the state-of-incorporation registered agent (usually Delaware; most large filers use The Corporation Trust Company or Corporation Service Company) via the Secretary of State business-entity search. A registered agent MUST accept service, which is why it is the reliable channel when a company publishes no privacy address.
Mailing address. Meta Platforms, Inc., ATTN: Privacy Operations, 1 Meta Way, Menlo Park, CA 94025, USA (corporate/SEC address: 1601 Willow Road, Menlo Park, CA 94025)
Evidence
No claims have been itemized for this row yet.
No sources are on file for this row yet.
Source vault
Link status: Candidate - not yet fetched
| Document | Last fetch | |
|---|---|---|
| Privacy policy See Meta's overall Privacy Policy (facebook.com/privacy/policy) | Not fetched yet | NO (HTML only) |
| Terms of service See Meta's overall Terms of Service (facebook.com/legal/terms) | Not fetched yet | NO (HTML only) |
| Website meta.com | Not fetched yet | — |
| Primary source No URL recorded Verification: Unverified - heuristic first draft | Not fetched yet | — |
Enforcement
No enforcement actions are linked to this row.
State statute
Headquarters on file: California. Provisions of CCPA/CPRA on file:
| Provision | Type | Source |
|---|---|---|
| Right to Deletion Cal. Civ. Code § 1798.105 | hard | source |
| Right to Correction Cal. Civ. Code § 1798.106 | hard | source |
| Right to Know / Access Cal. Civ. Code § 1798.110 | hard | source |
| Right to Limit Use of Sensitive Personal Information Cal. Civ. Code § 1798.121; Cal. Code Regs. tit. 11, § 7027 | hard | source |
| Right to Data Portability Cal. Civ. Code § 1798.130(a)(3)(B)(iii) | hard | source |
| Privacy Policy / Privacy Notice Requirements Cal. Civ. Code § 1798.130(a)(5); Cal. Code Regs. tit. 11, § 7011 | hard | source |
| Sensitive Personal Information — Categories Cal. Civ. Code § 1798.140(ae) | hard | source |
| Service Provider and Contractor Contract Requirements Cal. Civ. Code § 1798.140(ag); Cal. Code Regs. tit. 11, § 7051 | hard | source |
| Applicability Threshold (2025 CPI-Adjusted) Cal. Civ. Code § 1798.140(d) | threshold | source |
| Privacy Risk Assessment — Mandatory for High-Risk Processing (Eff. Jan. 1, 2026) Cal. Civ. Code § 1798.185(a)(15); Cal. Code Regs. tit. 11, §§ 7150-7157 | hard | source |
| Right to Opt Out of Sale or Sharing Cal. Civ. Code §§ 1798.120, 1798.135 | hard | source |
| Sale vs. Sharing Distinction Cal. Civ. Code §§ 1798.140(ad), 1798.140(ah) | hard | source |
| Enforcement — CPPA and AG; Civil Penalties (2025 CPI-Adjusted) Cal. Civ. Code §§ 1798.155, 1798.199.90; Cal. Bus. & Prof. Code § 17206 | hard | source |
| Notice at Collection Cal. Code Regs. tit. 11, § 7012 | hard | source |
| Cybersecurity Audit — Annual Independent Audit Requirement (Eff. Jan. 1, 2026) Cal. Code Regs. tit. 11, §§ 7120-7124 | hard | source |
| Automated Decision-Making Technology (ADMT) — Notice, Opt-Out, and Access Rights Cal. Code Regs. tit. 11, §§ 7200-7222; Cal. Civ. Code § 1798.185(a)(16) | hard | source |