Texas AG Ken Paxton sues Meta, accusing WhatsApp of bypassing encryption to access user messages

Texas Attorney General Ken Paxton sued Meta Platforms on Thursday, accusing the company of falsely marketing its WhatsApp messaging service as secure while secretly maintaining the ability to access and view the encrypted communications of its three billion users. The lawsuit, filed in Texas state court, claims Meta has failed to deliver on its core privacy promises.

The legal action follows a recently closed federal investigation into the same privacy concerns. According to internal documents, a Commerce Department investigator concluded earlier this year that Meta retains the technical capability to decrypt and read WhatsApp messages, prompting the state of Texas to seek civil penalties and an injunction against the tech giant.

Allegations of deceptive marketing

Paxton's lawsuit targets WhatsApp's long-standing marketing campaigns, which assure users that their messages are completely private and protected by end-to-end encryption. Bloomberg Law's report on the lawsuit notes that the state accuses Meta of deceptive trade practices. The state claims the company misleads consumers by retaining backdoor access to user communications.

The state's petition argues that Meta has built a business model around data harvesting, and that WhatsApp is not exempt from these practices. Texas prosecutors allege that Meta's control over the application's infrastructure allows it to bypass encryption protocols whenever it chooses, violating the explicit promises made to billions of global users.

The Commerce Department connection

The Texas lawsuit draws heavily on findings from a federal privacy investigation that the Commerce Department abruptly closed earlier this year. The federal probe was shut down shortly after an investigator with the Bureau of Industry and Security shared preliminary conclusions with other federal officials, warning that Meta stores and views WhatsApp messages.

An agent within the Office of Export Enforcement wrote a warning about the platform's security.

"There is no limit to the type of WhatsApp message that can be viewed by Meta," the agent wrote.

Despite these findings, the federal agency closed its investigation shortly after the note was circulated, according to sources familiar with the matter.

Meta's defense and technical claims

Meta has rejected the allegations, stating that the lawsuit mischaracterizes how its encryption technology works. In an official statement from Meta, a spokesperson denied that the company has any way to read encrypted user chats.

"WhatsApp cannot access people’s encrypted communications and any suggestion to the contrary is false," the spokesperson said. "We will fight this suit as we continue defending our strong record on protecting people’s messages."

Security experts have historically validated WhatsApp's use of the Signal protocol, which encrypts messages on-device. However, the lawsuit contends that Meta's proprietary implementation and cloud backup systems introduce vulnerabilities that allow the company to access the underlying data.

Legal implications under Texas law

The lawsuit seeks substantial civil penalties under the Texas Deceptive Trade Practices Act. Paxton is asking the court to issue a permanent injunction to stop Meta from advertising WhatsApp as a secure and private communication platform unless it changes its data access policies.

Texas has previously targeted major tech firms over biometric data and privacy violations. This latest action represents a significant escalation in the state's efforts to regulate how Silicon Valley giants handle consumer data and market their security features.