WhatsApp, Google and the Privacy Question
Encryption, metadata, software freedom and the practical steps toward greater digital independence.
עברית
Why ask questions about familiar services?
WhatsApp and Google services are convenient partly because so many people already use them. Convenience, however, does not settle questions about privacy, software freedom or dependence on a provider. A person may want to reduce their use without claiming that every message is readable by the company or that every feature is harmful. Good criticism should say exactly which boundary it is discussing.
For TUX Network Israel, the important question is whether people can understand their tools and make meaningful choices. That includes examining what is collected, what the provider controls and how difficult it would be to move. These are questions about power and practical independence as well as technical security.
WhatsApp: recognise what encryption protects
WhatsApp says personal conversations are end-to-end encrypted: the protection is intended to keep message content between the participants. That is a significant security property. It does not mean a recipient cannot copy a message, or that an unlocked or compromised phone becomes safe. The security of the endpoint remains important.
WhatsApp’s privacy policy also describes processing account, usage and device information. Content protection and service data are different categories. Our criticism is therefore not that encryption is worthless; it is that encryption alone does not answer every question about collection, retention and the relationship with Meta.
Backups and business conversations need separate attention
Encrypted backups are available as a separate protection. Check the backup arrangement you actually use rather than assuming the protection of a live conversation automatically covers every stored copy. WhatsApp also distinguishes personal messaging from business and AI features. It explains that some business conversations using Meta’s hosting are not treated as end-to-end encrypted. Read the information shown in the particular conversation.
The practical lesson is to ask where each copy goes: the sender’s device, a recipient’s device, an export, a backup or a business system. A single padlock icon is not a complete map of all those destinations.
Google: useful services, extensive data relationships
Google’s privacy policy describes collecting information such as activity, device details and location information, depending on services and settings. It explains uses including service operation, personalisation and advertising, and provides account controls and export or deletion options. Those controls matter, but should not be confused with a promise that no data is processed.
Our editorial concern is concentration. When searching, communication and other everyday tasks depend on one account ecosystem, changing provider can feel difficult even when individual alternatives exist. We favour keeping an exit route: know how to export important information and avoid making every part of your digital life depend on one login.
Privacy and free software are related, but different
A privacy setting determines a behaviour or a preference. A free software licence grants rights to study, change and share a programme. An official proprietary application does not become free software merely because it offers encrypted communication. Equally, a free application still needs careful design and responsible administration.
GNU and Richard Stallman place the user’s freedom at the centre of this debate. Our view is that people should be able to inspect the tools that act on their behalf and choose how to maintain them. That is a broader goal than finding a product that claims to collect a little less data.
A gradual route toward more control
Start by reviewing linked devices, account protection, backup choices and app permissions. The EFF guide provides concrete WhatsApp security guidance. Keep the device updated, and remember that a disappearing message is not a guarantee that another participant has not kept a copy.
For communication, GNU Jami is one free software project worth examining on its own terms. Try any alternative with a small group before relying on it: usability, accessibility, reliability and the needs of your contacts all matter. For search, compare the provider’s policy and operation rather than assuming the word “independent” proves anonymity. Read how Websearch.co.il exposes ranking weights to explore a different kind of user control.
Data protection in Israel: responsibility does not stop at the cloud
Israeli rules address transfers from databases in Israel to databases abroad. The Privacy Protection Authority also publishes guidance on outsourcing under Regulation 15 of the data-security regulations, including supplier assessment, a suitable agreement and oversight. A cloud contract is therefore something to examine, not a substitute for understanding which information is being entrusted to whom.
For a real organisational deployment, determine the applicable transfer conditions and contractual commitments before uploading personal information. The answer depends on the data, recipient and service. A region selector or a provider’s nationality alone cannot establish compliance with all applicable obligations.
American cloud services: location is only one layer
When examining a US-linked cloud service, separate the storage region, the contracting company, administrators’ access, subcontractors and backup destinations. These are our practical due-diligence questions: who can retrieve readable information, from where, for what tasks, and what happens when the contract ends? Ask for a usable export and a documented deletion process.
An Israeli or European storage region does not by itself settle every question of legal jurisdiction. Nor does choosing a US provider mean that every item is automatically available to every government agency. The legal process and the provider’s actual control over the information matter.
What the US CLOUD Act does — and what it does not
The CLOUD Act clarifies that providers subject to US jurisdiction may be required, under applicable Stored Communications Act process, to disclose data in their possession, custody or control regardless of storage location. The US Department of Justice explains that this is not a new authority for indiscriminate bulk access. Its FAQ also describes the Act as encryption-neutral rather than a new power to compel decryption.
Our technical conclusion is to examine key access as well as server geography. Encryption at rest managed by the provider and end-to-end encryption with keys unavailable to the provider are different designs. Do not treat a marketing label or a customer-managed key option as a complete description of who can access plaintext.
| Question to ask | Evidence to look for |
|---|---|
| What information is uploaded? | A data inventory and defined purpose |
| Who may access it? | Named roles, service boundaries and access records |
| Where are copies kept? | Storage, backup and support arrangements |
| Who holds usable keys? | A documented encryption and recovery design |
| Can we leave? | Tested export, restoration and deletion procedures |
This section explains issues to investigate; an organisation’s legal assessment must address its own processing and the current rules.
A free internet society begins with informed choices
Nobody should have to understand every protocol before joining a community. Clear explanations, useful defaults and the ability to ask questions make participation easier. We want more room for open standards, independent services and tools whose future is not entirely decided elsewhere.
Reducing dependence can be incremental: learn one setting, keep a useful export, try one free tool and share what worked. The aim is not to blame people for the applications their friends use. It is to create practical opportunities to choose differently.