Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The policy discloses that user data is transferred globally, including to the United States and to countries where Meta affiliates, partners, and service providers are located, using Meta's global infrastructure and data centers. The policy notes that destination countries may have different privacy laws than users' home countries.
This analysis describes what WhatsApp's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes that WhatsApp user data is subject to global transfer using Meta's infrastructure, and that the legal protections available to users' data may vary based on the destination country. For EU and UK users, this disclosure engages data transfer mechanism requirements under GDPR and UK data protection law.
The updated policy removes an unconditional statement of intent and replaces it with conditional language: 'We have no intention to introduce them, but if we ever do, we will update this Privacy Policy.' This revision reserves WhatsApp's right to introduce ad formats in Status and Channels in the future, subject only to updating the privacy policy at that time. The prior language established a stronger commitment; the updated language is more permissive. No specific consumer action is required; the change is informational regarding WhatsApp's future flexibility on advertising formats.
View change record →The updated terms no longer state that WhatsApp has no intention to introduce ads in Status and Channels. Instead, the revised language indicates that if ads are introduced in these features, WhatsApp will update its privacy policy to reflect the change. This means the company has reserved the option to add ads to Status and Channels in the future, subject to policy update notification.
View change record →The updated policy now explicitly discloses that users 'may see other types of ads in Status and Channels,' whereas the prior language stated WhatsApp had 'no intention to introduce' new ad types. This represents a shift from a stated commitment not to expand advertising toward an explicit acknowledgment that new ad categories may appear on WhatsApp's social features. The policy also updated its regional privacy guidance by removing a reference to Thai Personal Data Protection Act rights and adding a new section directing US residents to WhatsApp's United States Regional Privacy Notice for information about their consumer privacy rights under US law.
View change record →The agreement establishes that user data, including from EU, UK, and other jurisdictions with heightened privacy protections, may be transferred to and processed in the United States and other countries with different privacy laws. The policy does not specify in this section which transfer mechanisms (such as Standard Contractual Clauses) are used to govern those transfers.
Cross-platform context
See how other platforms handle Global Data Transfer Disclosure and similar clauses.
Compare across platforms →Monitoring
WhatsApp has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
"WhatsApp shares information globally, both internally within the Meta Companies and externally with our partners and service providers, and with those with whom you communicate around the world, in accordance with this Privacy Policy. Your information may, for example, be transferred or transmitted to, or stored and processed in, the United States; countries or territories where the Meta Companies' affiliates and partners, or our service providers are located; or any other country or territory globally where our Services are provided outside of where you live for the purposes as described in this Privacy Policy. WhatsApp uses Meta's global infrastructure and data centers, including in the United States. These transfers are necessary to provide the global Services set forth in our Terms. Please keep in mind that the countries or territories to which your information is transferred may have different privacy laws and protections than what you have in your home country or territory.Excerpt from WhatsApp's Privacy Policy
(1) REGULATORY LANDSCAPE: This provision directly implicates GDPR Chapter V (transfers of personal data to third countries), the EU-US Data Privacy Framework, UK data transfer mechanisms, and relevant adequacy decisions. The Irish DPC is the lead supervisory authority for EU transfers. The UK ICO governs UK transfers. The policy does not specify transfer mechanisms in the body of this provision, which may create transparency gaps under GDPR Article 13. (2) GOVERNANCE EXPOSURE: High for EU and UK operations. The disclosure that data may be transferred to any country globally where WhatsApp services are provided, combined with Meta's global infrastructure, requires that appropriate transfer safeguards (SCCs, adequacy decisions, or other mechanisms) be documented and maintained. The policy's acknowledgment that destination countries may have different privacy protections is a standard but operationally significant disclosure. (3) JURISDICTION FLAGS: EU/EEA users face the highest exposure given GDPR Chapter V requirements and the Schrems II framework's requirements for transfer impact assessments. UK users are subject to the UK International Data Transfer Agreement framework. Users in countries without adequacy decisions face the broadest potential gap between their home jurisdiction protections and those available in transfer destinations. (4) CONTRACT AND VENDOR IMPLICATIONS: Organizations processing EU or UK customer data via WhatsApp should verify that appropriate data transfer agreements are in place between WhatsApp Ireland Limited and WhatsApp LLC or other Meta entities. Due diligence should include confirming whether WhatsApp's cross-border transfer mechanisms have been updated to reflect current regulatory guidance. (5) COMPLIANCE CONSIDERATIONS: Legal teams should request documentation of the specific transfer mechanisms WhatsApp employs for EU and UK data transfers to the US and other third countries. Update records of processing activities to reflect WhatsApp as a data processor or sub-processor where applicable. Assess whether transfer impact assessments are required for WhatsApp-mediated data flows under applicable national implementations of GDPR Chapter V.
This provision establishes that WhatsApp user data is subject to global transfer using Meta's infrastructure, and that the legal protections available to users' data may vary based on the destination country. For EU and UK users, this disclosure engages data transfer mechanism requirements under GDPR and UK data protection law.
The agreement establishes that user data, including from EU, UK, and other jurisdictions with heightened privacy protections, may be transferred to and processed in the United States and other countries with different privacy laws. The policy does not specify in this section which transfer mechanisms (such as Standard Contractual Clauses) are used to govern those transfers.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by WhatsApp.