Texas Attorney General Ken Paxton filed a lawsuit on Thursday against Meta alleging that WhatsApp misrepresents its end-to-end encryption and that the company can read users' messages. WhatsApp is used by more than 3 billion people.

Since at least 2016, Meta, then named Facebook, has said that WhatsApp provides end-to-end encryption with messages encrypted on a sender's device using keys available only to the receiver. End-to-end encryption means that no one except the sender and receiver can read the plaintext messages.

Meta CEO Mark Zuckerberg has said, "Meta does not see any of the content in WhatsApp; it is fully encrypted." He has also said, "Facebook systems do not see the content of messages being transferred over WhatsApp."

In the complaint filed Thursday, the Texas Attorney General's office alleged that Meta can and does read the unencrypted contents of WhatsApp messages. The attorneys stated they are filing the action to "prevent WhatsApp and Meta from continuing to willfully deceive [Texans] by misrepresenting that their private communications were just that—private and inaccessible even to WhatsApp and Meta—when, in fact, WhatsApp and Meta have access to all WhatsApp users' communications in their entirety."

The sole factual evidence cited in the complaint is an article published last month by Bloomberg. That article described how the US Commerce Department's Bureau of Industry and Security abruptly closed an investigation into claims that Meta could access encrypted WhatsApp messages shortly after an agent sent an email outlining the probe's preliminary findings. A January 16 email from a Bureau of Industry and Security agent, sent to more than a dozen officials at other agencies, stated: "There is no limit to the type of WhatsApp message that can be viewed by Meta. The misconduct of Meta and its officers, including current and former high-level executives, involve civil and criminal violations that span several federal jurisdictions."

The complaint does not indicate that the Attorney General's office obtained the email itself or gathered information from investigators; it cites only the Bloomberg report. Representatives in the office did not respond to an email asking if its investigators had obtained any evidence beyond the news article. In an email, Meta called the allegations baseless and vowed to fight the lawsuit in court.

A team of researchers conducting a technical analysis of WhatsApp in 2023 found that it generally functions securely as described. The researchers identified a design flaw allowing a Meta employee with infrastructure access to add new members to a group chat without permission or interaction from existing members, though such additions are visible to all other members.

Benjamin Dowling, a senior lecturer in cryptography at King's College London, said his team reverse-engineered the WhatsApp cryptographic protocol and found no indication that it behaved differently from what Meta described. He said the analysis applied only to the WhatsApp client as available in May 2023 and might not apply to later versions, and that WhatsApp's closed-source status makes a definitive assessment of the code impossible. "Our reverse-engineering of WhatsApp and all the evidence we are aware of points towards WhatsApp providing users with end-to-end encryption for their message contents. While our analysis did find design weaknesses in the protocol, such as a lack of user control over things like group membership, these weaknesses are unlikely to be the basis of the complaint as they would not allow global stealth reading of messages," Dowling said.

Kenny Paterson, a researcher at ETH Zurich, said, "The vast majority of this Texas AG lawsuit looks like general dung-throwing in Meta's direction. I'm no fan of Meta's data harvesting practices, but that's all egregious misdirection on a case that seems to me to be built on a very thin evidence base: essentially, one news article is referenced to support the actual accusation." Paxton is in a US Senate primary runoff against incumbent John Cornyn.