Take a IM app like WhatsApp. If I send a message to another user while their client is offline, the server holds the message and then delivers it when the receiver's client goes online. It even has those two blue ticks, to show that the other user read the message.

Considering an IM app like WhatsApp, would an IM app server holding user's messages long after the content was delivered be an issue of personal data protection?

I know the answer would be jurisdiction-based, because laws aren't the same everywhere. Answers like "in the EU it is like xxxx" or "in the USA it is fine" are ok.

  • 2
    WhatsApp uses end2end encryption, so unless either your device or the recepient's device is compromised, the data is secure. And if one of the devices IS compromised, I suspect WhatsApp is the least of your concerns!
    – AlexH
    Feb 27, 2015 at 17:17
  • @darkf that is good to know, even though the question is not about WA
    – Mindwin
    Feb 27, 2015 at 17:18
  • 1
    Actually, end-to-end encryption is only used by WhatsApp when both devices run Android.
    – TheWolf
    Feb 27, 2015 at 17:20
  • 1
    unfortunately, legal questions are out-of-scope here because of the issue you identified: every jurisdiction will differ and therefore there cannot be a single acceptable answer
    – schroeder
    Feb 27, 2015 at 18:16
  • 3
    I'm voting to close this question as off-topic because it asks for world-wide legal implications.
    – schroeder
    Feb 27, 2015 at 18:17

1 Answer 1


I can answer that for Germany only (caveat below). In German data protection law, it's basically forbidden to collect, process or use data that can be linked to a natural person and that's not publicly available unless you're explicity allowed by law or by the affected person.

By sending the message, I'd assume (IANAL though) that you implicitly give your consent to have that message stored on the server as long as necessary to deliver it. Any further storing would have to be consented to separately (via Terms of Use for example, which in itself would pose new questions about whether such a consent is valid because no-one ever reads them and so on...).

However, WhatsApp and any similar IMs would probably walk to hell and back in order to avoid German data protection laws to be applicable to them for exactly that reason.

Not the answer you're looking for? Browse other questions tagged or ask your own question.