End-to-end encryption on Instagram: what changes for your privacy

The removal of end-to-end encryption from Instagram is one of those quiet changes that, without much fanfare, can significantly impact how we chat daily. Until now, it was possible to activate highly secure conversations in direct messages, but Meta has decided to put an expiration date on them and redirect that promise of privacy to other platforms within the company, such as WhatsApp.

If you're concerned that Meta might be able to read your messages or use them to train artificial intelligence models , you're right to want to understand what the removal of this security layer means. The change isn't just technical: it involves political pressures, debates about child protection, the fight against crime, and, of course, the data business.

What exactly was end-to-end encryption on Instagram?

End-to- end encryption, known as E2EE , is a technology that ensures a message can only be read by the sender and recipient. In practice, the content is encrypted on your phone and travels "disguised" to the other person's phone, where it is decrypted with a unique key shared only by those two devices.

When this feature was active on Instagram, E2EE-protected direct messages could not be decrypted by Meta , third parties, or authorities, even if they gained access to the servers where the data was stored. To anyone viewing those packets of information in transit, the content was essentially a string of unintelligible characters.

Unlike WhatsApp, where end-to-end encryption is enabled by default in all chats , things worked differently on Instagram. Here, you had to go into the privacy settings and follow several steps to manually activate encrypted messaging in specific conversations—something many people didn't even know existed because it was hardly promoted.

Meta began testing this encryption on Instagram around 2021, after announcing in 2019 its intention to extend enhanced privacy to all its messaging services in response to serious controversies, such as the Cambridge Analytica case , in which data from millions of Facebook users was exploited for political campaigns such as Brexit or Donald Trump's campaign.

At the time, Mark Zuckerberg argued that the future of the internet lay in platforms more focused on privacy than public exposure, emphasizing that this protection allowed people to be more authentic when communicating. That vision, however, has gradually faded, and the case of encryption on Instagram is a clear example of this shift.

Meta's decision: goodbye to E2EE on Instagram and a key date

Meta has confirmed that starting May 8, 2026, Instagram will stop offering end-to-end encryption for direct messages. It's not just a setting change: the feature will be completely removed from the app, meaning it will no longer be possible to start or maintain new chats protected with this type of encryption on the platform.

The company has been issuing warnings rather discreetly. It has updated Instagram's features page and is sending notifications to users who still have encrypted conversations active, informing them that the service will no longer be available and that, if they want to keep those messages, they must download them before the deadline.

A Meta spokesperson explained that, according to their internal data, "very few people" were enabling encrypted messaging on Instagram, and that for this reason, they have decided to remove the option in the coming months. The company emphasizes that anyone who wants to continue using end-to-end encryption can do so easily by switching to WhatsApp , where this protection is enabled by default in all chats.

The important distinction is that messages and calls under this encryption scheme were the only ones that, officially, even Meta couldn't read. Instagram's own documentation states that with E2EE, only you and the person you're talking to could see or hear the content, excluding the company itself. That guarantee will no longer exist on Instagram.

Furthermore, it has been stated that end-to-end encrypted messages not downloaded before the retirement date will be deleted . Externally, Meta presents the change as affecting only a minority of users, but from a privacy perspective, it represents a significant step backward.

What technically changes when encryption disappears on Instagram?

With the end of end-to-end encryption, Instagram direct messages will still be encrypted in transit (the standard practice to prevent simple attacks while data is traveling across the network), but they will no longer be protected by that extra layer that prevents the platform from accessing the content. In other words, Meta once again has the key to read what you write in your DMs, at least technically.

In an end-to-end encryption (E2EE) scenario, if someone intercepts the communication midway, they would only see a stream of encrypted data impossible to decrypt without the correct key. Meta itself wouldn't be able to do anything with it either. Without this end-to-end protection, it's feasible for the company to store the messages on its servers in a format that it can process internally , while still protecting them from unauthorized external access.

Meta insists that this doesn't mean your conversations will suddenly be "live." Access controls, server encryption, and internal mechanisms to prevent unauthorized mass access remain in place. However, unlike end-to-end encryption, the company now defines what can and cannot be done with the content, as it is technically accessible under certain conditions.

In practice, this opens the door to automated message analysis for a multitude of purposes: from content moderation and abuse detection to service personalization, security research, and responses to legal requests. What was previously blocked by cryptographic design now depends on internal policies and legislation.

Furthermore, there is an important side effect: it makes it easier to enable more aggressive scanning or monitoring tools on messages in the future, something that is much more complicated or directly unfeasible with E2EE without breaking the encryption model itself.

Can Meta use my MDs to train AI without E2EE?

With end-to-end encryption enabled, Meta's ability to use the specific content of your direct messages to train AI models was drastically reduced from a technical standpoint: it simply couldn't read them in plaintext. With its removal, it's technically possible to access that data again, although what they do in practice and what privacy policies allow is another matter entirely.

In general, large technology platforms reserve the right in their terms of service to use certain user data to improve their services, develop algorithms , detect abuse, or train recommendation systems. They often refer to aggregated or anonymized data, but the key is that, without end-to-end email (E2EE), the content of messages is accessible and can be processed before this supposed anonymization.

If your question is whether Meta could use private Instagram conversations (without end-to-end encryption) as part of a dataset to train AI models , the honest answer is: technically, yes , unless its own policies, regional regulations like GDPR, or your privacy settings explicitly limit it. And even then, there's always uncertainty about how well those limits are respected in practice.

With end-to-end encryption enabled, the design itself prevented such uses because the company didn't possess the keys to read your messages. The protection was structural, not just legal. By removing this safeguard, privacy now depends more on trust in Meta and regulatory frameworks than on a technical impossibility.

For those who want to minimize that risk, the company itself recommends switching to WhatsApp , where messages, files, calls, and video calls are end-to-end encrypted by default. According to WhatsApp, neither the company, nor third parties, nor even the authorities can access the content of these exchanges because they do not have the necessary keys to decrypt them.

In what cases could third parties access or intercept the messages?

Without end-to-end encryption, there are several scenarios in which a third party could gain access to your Instagram messages, although not all are equally likely or equally concerning. The first thing to understand is that intercepting data in transit is one thing, but reading its content is another.

Regarding outright interception (for example, on compromised Wi-Fi networks), most services, including Instagram, still use transport encryption (HTTPS/TLS). This makes it much harder for an attacker "listening" to the connection to see the messages in plain text. Although end-to-end encryption (E2EE) is no longer the norm, data doesn't usually travel unencrypted across the network, so the risk of a random snooper on your Wi-Fi reading everything isn't so simple.

Where the landscape does change is in server-side access. Without end-to-end encryption (E2EE), messages are stored in a way that allows Meta to process them. And when a company has access to data, it also exposes itself to the possibility that this data could be requested by authorities in investigations, used for automated control systems, or, in the worst-case scenario, end up in a security incident if there is a serious breach.

Furthermore, you must consider access through your own device. If someone gains access to your phone while you're logged in (a partner, family member, someone who steals and unlocks your phone, malware, etc.), they will be able to read your Instagram messages even if they were previously end-to-end encrypted. End-to-end encryption (E2EE) doesn't protect against access from an already authenticated device , only against intruders along the way or on the server.

On the other hand, the moderators or automated content review systems of some platforms take advantage of the fact that messages are not end-to-end encrypted to analyze certain conversations for spam, fraud, threats, child sexual exploitation, or other illegal uses. Discord, for example, does not offer end-to-end encryption in its DMs, and its moderators can access private chats in certain cases to take action against serious rule violations.

How privacy is handled on Instagram: Private DMs and disappearing messages

The disappearance of end-to-end encryption doesn't mean Instagram will become a public display where everyone can see your messages. You'll still be able to have private conversations , as long as you take care of basic precautions like not sharing your session, not leaving your account open on other people's devices, and properly configuring who can message you.

Instagram also maintains its disappearing messages mode , a feature where, by swiping up within a chat, messages and files are displayed once and then disappear when you leave the chat or after a short period, usually 24 hours. This is a way to reduce the visible footprint of your conversations, especially if you're sending sensitive information that you don't want to leave permanently.

However, it's important to distinguish between message expiration and end-to-end encryption. Time-limited messages restrict the time you and your contact can view the content in the app, but while the message exists, it remains on Meta's servers and could potentially be accessed by the company or, in certain contexts, by authorized third parties.

In contrast, end-to-end encryption ensured that, even while the message was available, only the sender's and receiver's devices could see it in plain text. For those who take privacy seriously, these differences matter a great deal: time-based mode is a history management measure , not a cryptographic barrier that isolates your conversations from the platform itself.

In practical terms: you can continue chatting with whomever you want on Instagram privately from the view of other users, but you will have less assurance that the platform and its technical infrastructure will remain completely "blind" to the content of what you write, especially if new monitoring systems are established or if there are legal requests for access.

Political pressures, security, and the Chat Control debate

The removal of end-to-end encryption on Instagram doesn't come in a vacuum. It coincides with a time of strong international pressure on Big Tech to limit or control these types of cryptographic protections, especially with the argument of combating online child sexual abuse and other criminal activities coordinated through messaging.

In 2024, the Virtual Global Working Group (VGT), an international alliance of security agencies and law enforcement bodies, openly opposed end-to-end encryption in services like Meta. Their main argument is that, while E2EE protects user privacy, it also significantly complicates the prosecution of crimes and the protection of minors in the digital environment.

The VGT specifically cited Meta as an example of what they consider a design that "degrades security systems and weakens the ability to keep child users safe." They presented real cases in which abusers were apprehended thanks to access to Facebook conversation logs. According to their argument, if those conversations had been end-to-end encrypted, it would have been very difficult, if not impossible, to detect those cases.

In Europe, the controversial proposal known as Chat Control followed a similar line: under the guise of combating child sexual abuse material (CSMA), it proposed the possibility of scanning private communications for illegal content, even on end-to-end encryption (E2EE) services like WhatsApp. The problem is that, from a technical standpoint, there is no easy way to maintain robust encryption while simultaneously introducing backdoors for law enforcement without creating enormous security risks.

The debate surrounding Chat Control has been fierce. Digital rights activists have insisted that, under the guise of protecting minors, it could open the door to uncharted scenarios of mass surveillance , in which any message could be scanned by automated systems. The European Parliament has so far rejected the most intrusive proposal, approving an amendment that prohibits the indiscriminate scanning of messages.

Europe, national pressures and the battle over encryption

The political battle in the European Union has been ongoing for years. The EU Council has been discussing ways to implement something similar to Chat Control, while Parliament has been more hesitant to cross certain lines regarding fundamental rights and digital privacy . Meanwhile, a provisional regulation allowing platforms to conduct voluntary analysis to detect child sexual abuse content has been repeatedly renewed.

This temporary measure has an expiration date, and as has been noted, it expires on April 3. From that day forward, the exception that allowed this large-scale voluntary testing in certain services will cease to exist. Some countries, such as Spain , have been particularly in favor of maintaining or even strengthening these types of mechanisms, arguing that they are necessary to protect minors.

For some members of Parliament, such as the Social Democratic MEP Birgit Sippel, it is "regrettable" that neither the Council nor the European Parliament have reached a stable agreement, but at the same time many civil society organizations consider it a victory that a rule that would have opened the door to the mass scanning of private messages was not approved.

In this context, Meta's backtracking on encryption for Instagram is interpreted by many experts as a worrying sign. It's the first time a major platform has taken such a clear step backward in terms of encryption protections, which could send the message that sacrificing structural privacy to facilitate certain types of control or monitoring is acceptable.

Reuters has also reported internal tensions within Meta regarding the rollout of encryption. Some executives reportedly went so far as to call the introduction of E2EE "irresponsible" due to the potential for it to be used for harmful activities, ranging from harassment and sexual abuse of minors to communication between terrorist groups. This internal opposition is believed to have contributed to slowing down and limiting the reach of encryption on Instagram.

Comparison with WhatsApp, Telegram, Signal and other platforms

To better understand what losing end-to-end encryption on Instagram means, it's helpful to look at what other messaging apps do. In the case of WhatsApp , the situation is clear: all conversations, calls, and video calls are protected with E2EE by default. There's no button to disable it in standard chats; it's simply how the platform has worked for years.

Signal is another well-known example. This app has made end-to-end encryption its flagship feature. It's all about privacy: not only does it encrypt messages, but it also tries to minimize the collection of metadata (who is talking to whom, when, from where, etc.), which can reveal a lot of sensitive information even if the message content is encrypted.

Telegram offers a middle ground. Its regular chats aren't end-to-end encrypted; instead, they use client-server encryption, which allows the platform to manage multiple features (cloud backups, syncing across multiple devices, etc.). However, it includes the option of "secret chats," which do have end-to-end encryption and can also be configured with timers so that messages are automatically deleted after a certain period.

At the other extreme, services like Discord don't offer end-to-end encryption for private messages. This allows platform moderators, in certain cases, to access conversations to investigate abuse, spam, or serious rule violations. It's an approach that prioritizes moderation capabilities over cryptographic privacy.

By removing end-to-end messaging, Instagram is moving closer to models like Discord or Telegram's standard chats, where the platform has ample leeway to access and process content. The difference is that, unlike WhatsApp or Signal, you will no longer be able to choose a conversation environment within Instagram where the company is completely "locked down" by technical design.

What can you do if you're worried about your privacy from now on?

If you're particularly concerned about the confidentiality of your conversations, the first thing to understand is that, after the removal of End-to-End Privacy (E2EE), Instagram will no longer be the ideal place to share extremely sensitive information. As a social network, it will still be useful for quick chats , basic coordination, or low-risk topics, but it's not the most suitable tool for dealing with delicate matters.

Meta suggests migrating any conversations you want to keep with end-to-end encryption to WhatsApp , where that protection will remain fully operational. If you'd rather not rely on Meta at all, you could also consider alternatives like Signal, which take a more radical approach to privacy and robust encryption.

On Instagram, even without end-to-end messaging, you can improve the situation somewhat by using the temporary messaging mode to limit the lifespan of certain messages, preventing long message histories from accumulating. It's also important to carefully review your privacy and security settings : who can send you direct messages, whether you allow requests from people you don't follow, two-step verification , login alerts, etc.

Finally, let's be realistic: no technical setup can replace common sense. If something could be harmful if it were to leak from a chat (for example, due to an account hack, screenshots, or other leaks), perhaps the best option is not to send it through a general social network. Not even end-to-end encryption can protect you from a screenshot taken by the person you're talking to.

The removal of end-to-end encryption on Instagram marks a shift in how Meta understands privacy within this social network: it no longer aims to make DMs as secure a channel as WhatsApp, but rather a flexible messaging system, easy to moderate and aligned with regulatory pressures, which forces you as a user to be more aware of what kind of information you share there and on which platform you really want to keep your private conversations.