“US-owned, US-hosted, end-to-end encrypted.”
- Monthly active users
- 3B+
- Parent
- Meta (NASDAQ: META)
- Acquired
- 2014, ~$19B
- EEA controller
- WhatsApp Ireland Ltd
13 = midpoint of Control 12 & Data 13
Sovereignty Quadrant
Control ↑ who owns & governs the company · Data → where your data lives. Every dot is a company — click to open it.
Every number below traces to 15 sourced facts across 11 independent sources, last verified 2026-06-12. 3 open questions hold confidence at 88% — they lower confidence, never the score.
Control ↑
Who legally and economically controls the company
Legal & Jurisdiction
15
Core entity WhatsApp LLC is Delaware-incorporated and wholly owned by Meta Platforms, Inc. (US). WhatsApp Ireland Limited acts as the EEA data controller, which does give GDPR and the Irish DPC real enforceability (e.g. the 2023 fine) — that is why this scores above a pure-US zero rather than at the floor. But the operating control sits with a US parent, so this is firmly in the 'EU-operating under a foreign parent / run outside the EU' band.
Why 15? 4 sourced facts · click to expand
Core legal entity and jurisdiction of incorporation
Meta Platforms 10-K Exhibit 21.1 (subsidiaries list) · as of 2025-01-29
EEA data controller of record
WhatsApp Privacy Policy (EEA) · as of 2026-06-08
EU law reaches WhatsApp via Irish DPC as lead supervisory authority (GDPR enforced)
Irish Data Protection Commission · as of 2023-01-19
Ultimate parent jurisdiction
Meta Platforms 10-K FY2024 · as of 2025-01-29
Control & Ownership
8
WhatsApp is 100% owned by Meta Platforms, Inc., listed on NASDAQ, with founders Koum and Acton long departed and holding no equity. Meta's dual-class structure gives Mark Zuckerberg majority voting control via 10-votes-per-share Class B stock. Voting control, economic majority and listing venue are all US — squarely in the foreign-control band.
Why 8? 4 sourced facts · click to expand
Ownership of WhatsApp
Meta Platforms 10-K Exhibit 21.1 · as of 2025-01-29
Acquisition by Facebook/Meta
Meta Platforms (Wikipedia, corroborating SEC filings) · as of 2014-10-06
Voting control of the parent
Meta Platforms DEF 14A FY2025 proxy · as of 2026-04-16
Data →
Where your data lives and who can reach it
Data & Infrastructure
12
WhatsApp's own EEA privacy policy states data is transferred primarily to the US (Meta Companies and service providers) for infrastructure and hosting. Message content is protected by Signal-protocol end-to-end encryption — a real, meaningful safeguard — but metadata, account data and (non-default) backups are not, and sit under US jurisdiction with CLOUD Act exposure. Hosting is on US-owned infrastructure; the E2EE on content is the only reason this clears the floor of the US-hosting band.
Why 12? 4 sourced facts · click to expand
Primary data transfer/hosting destination for EEA user data
WhatsApp Privacy Policy (EEA) · as of 2026-06-08
EEA data processed by WhatsApp Ireland and transferred to WhatsApp LLC and Meta Platforms Inc (US)
WhatsApp Business Data Transfer Addendum · as of 2026-06-08
Message content protected by end-to-end encryption (Signal protocol); metadata is not
WhatsApp Help Center — About end-to-end encryption · as of 2026-06-12
Encryption marketing claims contested; allegation of unencrypted message storage / employee access
Texas Attorney General — Meta/WhatsApp petition · as of 2026-05-21
Operations & People
15
Operating HQ is Meta's Menlo Park, California (WhatsApp retains a Mountain View campus); leadership, financial control and USD reporting are all US. The Irish entity is the EEA controller-of-record and Meta has substantial Dublin operations, but the centre of gravity for WhatsApp's product, engineering and management is the US — firmly foreign-centered.
Why 15? 3 sourced facts · click to expand
Operating headquarters
Meta Platforms 10-K FY2024 (principal offices 1 Meta Way, Menlo Park) · as of 2025-01-29
Parent reporting currency and scale
Meta Reports Fourth Quarter and Full Year 2024 Results · as of 2025-01-29
Founders departed; no employee/founder EU control over operations
Who Owns WhatsApp (Untaylored, corroborating) · as of 2018-04-30
Aligned to the EU Commission’s official Cloud Sovereignty Framework (SEAL, Jun 2026) →
What we don’t know
3 open questions — they lower confidence, never the score
- ?
Exact physical location and ownership of the data centers serving EEA WhatsApp data (Meta-owned facilities vs. co-location vs. any EU-region storage).
Could nuance the infra score slightly, but the EEA policy is explicit that primary transfers are to the US, so material change is unlikely.
- ?
Whether and how much WhatsApp operational/AI processing now occurs in EU data centers under Meta's EU data-residency commitments (EU Data Boundary-style arrangements).
If meaningful EU-region processing exists for EEA users, infra could move up modestly; currently unverified for WhatsApp specifically.
- ?
Outcome and merits of the Texas AG (May 2026) and California (Mar 2026) suits alleging unencrypted message storage / internal employee access.
If substantiated, would materially undercut the E2E-encryption credit and lower infra; currently contested allegations, Meta denies.
EU Cloud Sovereignty Framework lens
SEAL is designed for cloud/infrastructure providers; this is an analogous sovereignty mapping for a consumer messaging service, not a certification.
Strategic
Controlled by US-listed Meta; Zuckerberg holds majority voting power. No EU strategic autonomy over the product.
Legal & jurisdictional
EEA controller WhatsApp Ireland Ltd brings genuine GDPR/Irish DPC reach (EUR 5.5M fine 2023), but ultimate entity is US Delaware LLC under Meta Inc.
Data & AI
EEA data transferred primarily to the US. Message content is E2E encrypted (Signal protocol), but metadata, account data and backups are not.
Operational
Operations, leadership and engineering centered in California; USD reporting. Dublin handles EEA legal/controller role.
Supply chain
Built on Meta's own US-controlled infrastructure and Meta Companies as sub-processors; no EU-sovereign supply chain.
Technological
Strong, audited E2E encryption (open Signal protocol) for message content is a real technical safeguard; client is proprietary and server-side metadata is centralized.
Security & compliance
Mature security program and GDPR compliance under DPC oversight, but US CLOUD Act exposure and contested encryption/access claims (Texas/California suits) temper this.
Environmental sustainability
No WhatsApp-specific environmental disclosures verified; Meta publishes group-level sustainability data not broken out for WhatsApp.
EU alternatives
Same Signal protocol, far less metadata (court-verified minimal data), E2E backups — but run by a US non-profit foundation, so not EU-sovereign.
Swiss-based, privacy-first, servers in Switzerland and no phone number required. Switzerland is outside the EU but has strong data protection and an EU adequacy decision.
Open Matrix protocol with self-hostable EU servers (e.g. via EU providers); vendor Element is UK-based, so EU control depends on chosen hosting.
How the method works
Methodology v2 (provisional): the score is the midpoint of two axes — Control (who owns and governs the company) and Data (where your data lives and who can reach it). Each axis is scored only on verified evidence; unknowns reduce confidence, never the score. Every input below is sourced; the weights and judgments are open to challenge.
Spotted an error? Every claim is sourced — challenge it and we correct the record.
- 2026-06-12 — Initial golden profile, authored from primary sources (human + AI review).
Report Incorrect Data
Found an error in this company's profile? Help us improve our data by submitting a correction.
Verified 2026-06-12 · Human + AI joint review (sources independently checked) · Methodology