Meta’s Instagram U-Turn on Encryption Raises Privacy Concerns

Meta’s decision to remove end-to-end encryption (E2EE) from Instagram direct messages is setting off alarms among cryptographers and privacy advocates, who say the move could weaken hard-won protections for private communication across the tech industry.

After nearly a decade of publicly promising default E2EE across its messaging platforms, Meta now plans to eliminate Instagram’s encrypted chat mode entirely on May 8. The company is blaming users for not opting into the feature a rationale experts describe as misleading and potentially dangerous for the future of secure messaging.

Meta has spent years positioning itself as a defender of private messaging. It invested heavily in bringing default end-to-end encryption to its chat apps, navigating both technical complexity and political pressure from law enforcement and governments that want more access to communications.

By December 2023, Meta announced default E2EE for Messenger and said the same was coming for Instagram DMs, describing it then as a major milestone. But instead of switching Instagram over to default encryption, the feature appeared only as a low-visibility, opt-in option tucked away in settings.

Now Meta says that because “very few people were opting in to end-to-end encrypted messaging in DMs,” it will remove the option altogether. A spokesperson told outlets that anyone who wants encrypted messaging can “easily” use WhatsApp instead. The company’s statement did not mention that end-to-end encryption is available on Messenger, steering users directly toward WhatsApp.

That framing has drawn sharp criticism. Researchers point out Meta spent years saying the real goal was default encryption precisely because opt-in versions attract low usage and are hard for typical users to find or understand a lesson the company itself appeared to acknowledge when it shifted from optional to default encryption work on Messenger after 2019.

Cryptographer Matt Green of Johns Hopkins University, who has advised Meta on its encryption rollout as both an unpaid and paid reviewer, argues the reversal undermines the value of public promises from big platforms. He notes that Meta had publicly committed to default encryption on Instagram chat, then later edited that messaging to imply it was always an optional feature and blamed low opt-in for its removal. In his view, this raises broader questions about whether people can trust Meta to keep encryption in Messenger and WhatsApp over time.

Security executive Davi Ottenheimer, creator of the post-quantum cryptography assessment tool pqprobe, calls Meta’s handling of Instagram DMs “deeply cynical,” saying the company designed the feature so few users would discover it, then used low adoption as justification to kill it.

What worries experts most is not just the change to Instagram, but the precedent it sets. Only a handful of companies have the scale and resilience to push back against government pressure and defend strong end-to-end encryption. Meta and Apple sit at the centre of that group. When a company of Meta’s size retreats, researchers fear it sends a signal that other firms or even other teams inside Meta can quietly roll back encryption without major consequence.

The timing is particularly sensitive. Around the world, law enforcement agencies are seeking more tools to monitor terrorism, child sexual abuse, and human trafficking, while repressive governments are expanding surveillance. Encryption critics frequently argue that default E2EE hampers investigations and enables criminals to hide. Privacy advocates counter that these crimes occur routinely on platforms without universal encryption and that weakening E2EE removes vital protections for billions of ordinary users without solving abuse.

Inside Meta, the debate has also been politically charged. Internal documents disclosed in a lawsuit over Meta’s handling of underage users show that end-to-end encryption has long been contentious. In 2019, ahead of CEO Mark Zuckerberg’s public push toward a “privacy-focused” roadmap, Meta’s head of content policy Monika Bickert wrote internally, “We are about to do a bad thing as a company. This is so irresponsible,” referring to the encryption plans, according to a Reuters report.

Zuckerberg’s own 2019 privacy manifesto acknowledged Facebook’s weak reputation on privacy but argued the company could evolve to build services people “really want,” including private messaging. Shortly after, Meta’s internal focus shifted from building optional encryption to making it the default for Messenger and Instagram DMs. By 2023, the company was publicly celebrating that it had finally crossed the finish line for Messenger and was testing default encryption for Instagram.

Against that backdrop, Meta’s sudden decision to retire Instagram’s encrypted mode and pin it on lack of user interest is being read by some as a sign that its ambitious encryption pledge was as much about repairing its public image after scandals like Cambridge Analytica as it was about long-term commitment.

Ottenheimer describes encryption inside Meta as both “a shield and a sword”: a shield against the collapse in user trust after data misuse and breaches, and a sword against governments that were pressing Meta on safety and content moderation. Now, he argues, the company appears to see less value in its “privacy brand” and is comfortable reversing course, while blaming users on the way out.

Meta did not provide additional explanation when approached for further comment on the decision.

Complicating the picture further is the evolving status of Messenger itself. As Casey Newton reported in Platformer, Meta plans to shut down the standalone Messenger website in April and is recoupling Messenger with Facebook, unwinding a decade-old push to make Messenger an independent product and a potential default chat app. That repositioning raises questions about how strategically important Messenger still is to Meta and by extension, how durable its encryption roadmap may be there.

At the same time, Meta is experimenting with new privacy-preserving technology in another area: AI chat. The company is partnering with Signal creator Moxie Marlinspike to integrate his new private AI system, called Confer, into Meta AI. The goal is to protect conversations people have with Meta’s AI chatbot, potentially extending strong privacy guarantees to a different class of interactions. The collaboration is still at an early stage, and Meta has not detailed how Confer will be implemented.

For now, researchers say one of the biggest risks is what comes next. If a long-running, high-profile commitment like Instagram’s end-to-end encryption can be reversed with a brief notice and a claim of low adoption, they worry it could embolden other platforms and future Meta leadership to chip away at encrypted services elsewhere. Public, on-the-record promises have been one of the few tools users have to hold platforms to their privacy commitments. If those promises no longer carry weight, the protections around encrypted messaging could prove far less stable than they appear.

This story was inspired by a Wired special report