Author: Ana Vilfan / Accord Legal Scribe Solutions
Reading time: 12 minutes
Index
- Meta stops protected messages on Instagram.
- What is changing?
- What is encryption (E2EE)?
- Why is Meta removing this feature?
- What happens to your old encrypted conversations?
- Potential risks for users?
- EU Regulation 2016/679 (GDPR): What are your rights?
- What does this mean for businesses?
- Why should we pay attention to this news?
- How can Accord assist you?
- Meta Stops Protected Messages on Instagram: What Does This Mean for You and Your Business?
Until now, your messages traveled “sealed” – only you and the recipient could read them.
From May 2026, the “envelopes” disappear. Meta will be able to read your conversations.
As of May 8, 2026, your private conversations on Instagram will no longer be protected by end-to-end encryption (E2EE). This decision by Meta significantly changes the way personal messages are processed – both for individual users and for businesses.
- What is changing?
According to the official information from Meta, starting May 8, 2026, Instagram is removing the protected (end-to-end encrypted) messaging feature.
Until now, there was an option (although limited) for conversations to be encrypted so that:
- the content was accessible only to the sender and the recipient;
- even the platform itself had no access to the messages.
After this date:
- all new messages will be accessible to Meta;
- the platform will be able to process them in accordance with its policies and applicable legislation.
- What is “secure messaging”?
Secure (end-to-end encrypted) messaging means that:
- the message is “locked” on the sender’s device;
- it is “unlocked” only on the recipient’s device;
- no intermediary – including the platform – has access to the content.
This is a standard used in applications such as WhatsApp, Viber, Signal, as well as the Facebook platform.
On Instagram, this feature was never enabled by default and required manual activation for each chat. However, this often proved difficult for users because it was “hidden” behind several steps in the settings and was not automatically applied to all chats, but had to be enabled manually each time.
- Why is Meta removing this feature?
The company’s official position is low user activity.
In practice, however, the decision follows a broader regulatory and business context:
- new legislative requirements (in the US) for rapid removal of harmful content, including content involving minors and keywords related to grooming (sexual grooming, online grooming);
- the need for platforms to have access to communication content in order to fulfill these obligations;
- expansion of opportunities for data processing and targeted advertising, including through AI.
- What happens to your old encrypted conversations?
If you have used secure chats:
- you will receive a notification to download your content;
- an app update may be required;
- Meta does not provide a completely clear answer on how this data will be stored in the future.
IMPORTANT:
New messages will not be encrypted.
- What are the risks for users?
The lack of encryption does not affect only “sensitive” communication such as personal data, photos, and keywords. It has broader consequences:
- possibility of content analysis for advertising purposes – in certain cases this could violate EU Regulation 2016/679 if done outside permitted purposes or if deep profiling is carried out. Data subjects must be informed in case of automated processing;
- higher risk in case of a security breach (data breach);
- access to content in case of official requests from authorities;
- use of data for AI training – in certain cases this could pose a serious risk to the right to privacy.
- EU Regulation 2016/679 (GDPR): What are your rights?
For users in the EU, the General Data Protection Regulation (GDPR) applies, as well as national legislation.
When processing messages, Meta is obliged to:
- clearly state the purposes of processing;
- ensure the right to access, rectification, and deletion;
- obtain valid and explicit consent when data is used for marketing or AI.
IMPORTANT: Removing encryption in itself is not a violation, but the way data is processed afterward may lead to non-compliance with national legislation and the Regulation.
If you believe your rights have been violated, you can file a complaint with the relevant supervisory authority.
- What does this mean for businesses?
The change is particularly significant for companies that use Instagram for:
- communication with clients;
- negotiations with partners;
- exchange of sensitive business information;
- marketing.
Main risks:
- loss of control over communication confidentiality;
- potential leakage of trade information;
- non-compliance with sector regulations (finance, healthcare, legal, etc.).
Good practices:
- define an internal communication channel policy;
- limit the use of social networks for sensitive information;
- implement a compliance framework.
Alternatively, Meta recommends using WhatsApp, where encryption is enabled by default for all communication.
Independent solutions:
Using other applications such as Viber & Signal, the latter offering significantly higher privacy and minimal data collection.
- Why should we pay attention to this news?
Meta’s decision is within its authority, but it leads to a real change in privacy expectations. Low user engagement with end-to-end encryption should not be a leading reason for removing a core feature, especially when there has been a lack of public awareness about the existence and applicability of this feature.
In an environment where more and more communication happens online, understanding who has access to your information becomes crucial – both for your personal data and your business.
At present, the proposal for the so-called Chat Control 2.0 regulation has not yet been finally adopted. Negotiations are ongoing between the European Commission, the European Parliament, and the Council.
The most controversial element of Chat Control 2.0 is the so-called detection orders, which may require platforms to scan user content including messages, emails, photos, and files. Even encrypted applications such as WhatsApp, Viber, and Signal may be required to scan messages on the device before encryption (client-side scanning).
The main legal conflict is related to encryption. While explicitly breaking end-to-end encryption is currently politically rejected, critics warn that technologies such as client-side scanning could effectively lead to surveillance, including risks of false positives and abuse.
The proposal raises serious questions regarding fundamental rights, especially the right to privacy, data protection, and freedom of expression.
Politically, the EU remains divided between supporters who emphasize the scale of the problem of child sexual abuse material (CSAM) and the need for proactive tools, and opponents who warn that such legislation could create infrastructure for mass surveillance and weaken cybersecurity practices.
10. How can Accord assist you?
Accord Legal Scribe Solutions provides full legal assistance in the creation, structuring, and management of comprehensive solutions in compliance with GDPR and data protection legislation – compliance, audits, data protection policies, risk management, and legally sound privacy policies for businesses processing personal data.
Accord Legal also provides assistance in preparing and submitting complaints to the relevant data protection authority.
If you believe your rights have been violated or your personal data has been compromised, do not hesitate to contact us for a consultation at office@accordlegal.bg, call +359 888 688 868, or use the contact form.