WhatsApp encryption: App can still store information about who people talk to and when

If the company holds the data, as its terms allow it to, then it will be possible for governments to retrieve it

The Facebook and WhatsApp applications' icons are displayed on a smartphone on February 20, 2014 in Rome (AFP/Getty)

WhatsApp has announced that all messages sent on its service are now fully encrypted, but the service could still be storing important information about people’s conversations.

The company announced yesterday to much celebration that it had taken steps to ensure that WhatsApp messages could only be read by the person sending and receiving them. It said that it had taken the step to ensure that messages couldn’t be intercepted by hackers or oppressive regimes.

But the company is still able to store important data that could be used for spying or other malicious ends by those same people, according to its own privacy information. Though it can’t store or even read the contents of messages, it can still store a whole host of other data about them.

“WhatsApp may retain date and time stamp information associated with successfully delivered messages and the mobile phone numbers involved in the messages, as well as any other information which WhatsApp is legally compelled to collect,” the company’s privacy page reads.

That means that information can exist on WhatsApp’s servers and so potentially be vulnerable to hacking or requests from governments to view it.

Debate has raged over the importance of so-called metadata — information about messages rather than their contents — for security services. Governments and others have argued that such information is only useful for making decisions at a high level and not about any specific person — but privacy campaigners have said that metadata can be easily used to piece together somebody’s life.

Such information could also be used for advertising at some point in the future, given that WhatsApp is owned by marketing giant Facebook. While some had been encouraged by the fact that the data in encrypted messages can no longer be read by the site even if it wanted to, metadata could still potentially be used for advertising purposes.