In January 2021, WhatsApp sent a notification to 2 billion people. The message was simple: accept new terms allowing data sharing with Facebook, or stop using the app. Within seven days, 25 million users downloaded Signal. Another 9 million grabbed Telegram. The exodus was so sudden that Signal’s servers crashed for three days straight.
Most of those users came back to WhatsApp within a month. But something changed. For the first time, ordinary people started asking what their messaging app actually does with their data. The answer turned out to be more complicated than anyone expected.
What WhatsApp actually shares (and what it doesn’t)
WhatsApp messages are end-to-end encrypted. That part is true. Meta cannot read your messages, and neither can law enforcement without physical access to your device. The encryption is solid. It uses the Signal Protocol, the same one that actual cryptographers use when they want privacy.
But encryption protects message content. It does nothing for metadata. WhatsApp collects your phone number, your contacts, your device ID, your IP address, your location, how often you use the app, who you message, when you message them, and how long those conversations last. It knows which groups you join. It tracks when you’re online. It logs every interaction with the app interface.
All of that metadata goes to Meta. The company links it to your Facebook and Instagram profiles if you have them. It uses the data for ad targeting across its entire network. Your WhatsApp messages stay private. Your behavioral patterns become advertising inventory.
The privacy alternative matrix
There are four messaging apps that people actually use when they leave WhatsApp. Each trades different things.
Signal is the privacy purist choice. Open source, nonprofit funded, collects almost nothing. Your phone number gets hashed and stored temporarily for contact discovery, then deleted. Signal knows when you registered and when you last connected. That’s it. No message metadata, no group membership logs, no reading receipts stored on servers. The catch is everyone you want to talk to needs Signal too, and most people won’t switch.
Telegram positions itself as the anti-WhatsApp, but its privacy story is theatrical. Messages aren’t end-to-end encrypted by default. Group chats are never encrypted. Everything sits on Telegram’s servers in reversible form. The company can read your messages, and has handed data to authorities when pressed. Telegram does have secret chats with proper encryption, but almost nobody uses them because they’re hidden in a submenu and don’t sync across devices.
Threema costs $4.99 and asks for nothing. No phone number, no email, just a random ID generated on your device. Messages are encrypted, servers are in Switzerland, the company makes money by charging users instead of monetizing data. The app works without any personal information. The price tag filters out casual users, which means your family group chat probably won’t migrate there.
iMessage is the accidental privacy app. Apple encrypts everything end-to-end and stores almost no metadata. The company has taken genuine stands against government backdoor requests. But iMessage only works between Apple devices, which makes it useless for anyone with Android friends. The blue bubble exclusivity is privacy through platform lock-in.
The metadata problem nobody solves
Even the most private messaging apps leak one thing they cannot hide: the social graph. Every encrypted messaging system needs some way to route messages between users. That requires identifiers. Phone numbers, usernames, key fingerprints, something to map message sender to message recipient.
Signal tried to solve this with sealed sender, which strips metadata from the envelope. But the server still needs to know which device to send each message to. Telegram stores your full contact list on its servers to sync across devices. WhatsApp uploads hashed phone numbers to match you with friends who have the app.
The technical reality is that secure communication requires some trust in the server operator. The question isn’t whether you’re leaking metadata. It’s who you’re leaking it to and what they’re doing with it.
Where the exodus actually went
The 2021 WhatsApp migration turned into a natural experiment in privacy preferences. Signal gained users who wanted maximum privacy and were willing to convince their contacts to switch. Telegram got users who wanted to leave Meta’s ecosystem but weren’t ready to sacrifice convenience. Most people did nothing because their entire family was still on WhatsApp.
Three years later, Signal has 40 million active users. Telegram has 800 million. WhatsApp has 2.8 billion. The numbers tell a clear story: privacy matters in theory but network effects matter in practice.
The real shift wasn’t the apps people switched to. It was the conversation that started. Before January 2021, almost nobody knew that messaging apps collected data beyond the messages themselves. Now people ask. They read privacy policies. They make different choices for sensitive conversations versus casual group chats. That awareness didn’t replace WhatsApp, but it created options where none existed before.
If you actually want to move away from WhatsApp, the path depends on what you’re trying to protect. For pure privacy: Signal. For escaping Meta while keeping convenience: Telegram’s secret chats or Threema. For Apple users only: iMessage by default. Each choice trades something. The question is which trade matters least to you.