WhatsApp is preparing to bring more generative AI into one of the world’s most widely used encrypted messaging apps. The challenge is not whether AI can summarize or draft text. It is whether WhatsApp can offer those tools without weakening the privacy expectations that define the service.
The company’s answer is a new system called Private Processing. It is intended to let users access cloud-based AI capabilities while keeping message data away from Meta, WhatsApp, and other parties.
Why WhatsApp needs a different AI model
WhatsApp is used by roughly 3 billion people around the world, and its central promise is end-to-end encrypted communication. In that model, messages and calls are accessible only to the sender and receiver, or to the participants in a group chat. WhatsApp and Meta are designed to be unable to read those private communications.
That creates a basic conflict with the way many generative AI systems work. Large language models typically run on cloud servers, and those servers need access to a user’s request and related data in order to process it. For a secure messenger, sending private text into a cloud AI system changes the risk profile.
Meta has already been adding generative AI across its services using its open source large language model, Llama. WhatsApp also includes a light blue circle that opens the Meta AI assistant. But the AI assistant has raised concern because interactions with it do not receive the same protection as end-to-end encrypted WhatsApp chats.
Private Processing is meant to narrow that gap. Instead of treating WhatsApp messages like ordinary AI prompts, Meta says the new platform was built specifically for AI tasks that must respect WhatsApp’s privacy and security guarantees.
What Private Processing is designed to do
The first cloud-based AI capabilities are expected to include message summarization and composition tools. Users will opt into using WhatsApp’s AI features, rather than having them applied automatically.
Meta security engineering director Chris Rohlf described the challenge as both technical and experiential. WhatsApp, he said, is closely watched by researchers and threat actors, and its users already have strong privacy expectations.
There's also an existing set of privacy expectations from users, so this wasn’t just about managing the expansion of that threat model and making sure the expectations for privacy and security were met—it was about careful consideration of the user experience and making this opt-in.
The company’s goal is to create an alternate framework for AI inside a service where the provider is normally boxed out from message contents. That framework depends on limiting access, limiting retention, and making the system harder to quietly alter.
Private Processing uses special hardware that isolates sensitive data inside a Trusted Execution Environment, a locked-down region of a processor. The system is built to process and retain data for the minimum amount of time possible. It is also designed to stop and send alerts if it detects tampering or adjustments.
How users can limit AI inside chats
WhatsApp is also introducing a control called Advanced Chat Privacy. This setting gives people a way to restrict how shared communications can be handled by others in a conversation.
According to WhatsApp, when Advanced Chat Privacy is on, users can block others from exporting chats, auto-downloading media to their phone, and using messages for AI features. Like disappearing messages, anyone in a chat can turn the setting on or off, and the change is recorded for everyone to see.
That matters because AI use in a chat is not only about one person’s preference. A message belongs to a conversation, and participants may not agree about whether its contents should be used for AI features. Advanced Chat Privacy gives that concern a visible control, though participants still need to pay attention when the setting changes.
- Opt-in AI features: users choose whether to use WhatsApp’s AI tools.
- Advanced Chat Privacy: chat participants can block use of messages for AI features.
- Visible changes: turning the setting on or off is recorded for people in the chat.
Why this is not the same as Apple’s approach
The source article compares WhatsApp’s plan with Apple’s Private Cloud Compute, which supports the Apple Intelligence AI platform. Apple’s system can be used in Messages to generate message summaries and compose Smart Reply messages on iPhones and Macs.
But the comparison has limits. Apple’s Private Cloud Compute supports Apple Intelligence wherever that platform can be applied. Private Processing, by contrast, was purpose-built for WhatsApp and does not support Meta’s AI features more broadly.
There is also a hardware difference. Apple Intelligence is designed to do as much AI processing as possible on-device and sends requests to Private Cloud Compute only when needed. That depends on powerful hardware, so Apple designed Apple Intelligence for recent generations of mobile hardware. Old iPhones and iPads will never support Apple Intelligence.
Meta faces a different problem. WhatsApp serves about 3 billion users across many kinds of smartphones, including old and low-end devices. Rohlf and Colin Clemmons, one of the Private Processing lead engineers, said it was not feasible to design WhatsApp AI features that would run locally across that full range of devices.
Instead, the company focused on making Private Processing less useful to attackers if it were breached. As Clemmons put it, The design is one of risk minimization.
The remaining security question
WhatsApp is inviting third-party audits of parts of Private Processing. It also plans to include the system in the Meta bug bounty program so the security community can report flaws and possible vulnerabilities. Meta says it ultimately plans to make Private Processing components open source to expand verification and help others build similar services.
Those steps may increase confidence, but they do not erase the underlying tradeoff. Matt Green, a Johns Hopkins cryptographer who previewed some of the privacy guarantees but has not audited the full system, said any end-to-end encrypted system using off-device AI inference is riskier than a purely end-to-end system.
You’re sending data to a computer in a data center, and that machine sees your private texts.
Green said he believes WhatsApp when it says the system is designed to be as secure as possible and that the company cannot read users’ texts. Still, he warned that more private data will go off device, and the machines that process it will become targets for hackers and nation state adversaries.
The debate is not only about the first AI features. WhatsApp says Private Processing could become a foundation for more complex AI capabilities in the future, including features that involve processing and potentially storing more data. That possibility raises the stakes. The more useful AI becomes inside secure messaging, the more important the privacy architecture becomes.
For now, WhatsApp is trying to hold two ideas together: users want AI help while messaging, and they should not have to leave a private platform to get it. Whether Private Processing can satisfy both demands will depend on the strength of its design, the transparency of its review, and how carefully WhatsApp expands what AI is allowed to do.