Meta Stripped Instagram Encryption, Then Launched "Incognito Chat" for WhatsApp

Smartphone screen glowing in a dark room with a shadowed figure reflected

TL;DR:

May 8: Meta killed end-to-end encryption in Instagram DMs. 2 billion users lost private messaging
May 13: Meta launched "Incognito Chat" for WhatsApp AI, claiming even Meta can't read your messages
The tech behind it: "Private Processing" uses Trusted Execution Environments (TEEs) to run AI queries in sealed hardware enclaves
The catch: Trail of Bits audited Private Processing and found 28 security flaws, including 8 high-severity issues; one allowed code injection that could silently steal user data
The pattern: Meta removes real encryption where it hurts ad revenue, then markets "privacy" where it drives AI engagement
What to do: Use Signal for private conversations. Don't trust Meta's privacy claims on any platform.

Five Days Between "Privacy Is Dead" and "Privacy Is Back"

May 8, 2026: Meta flipped the switch on Instagram DM encryption. Two billion users lost the ability to have private conversations on the platform. Meta's explanation ("very few people were opting in") was corporate speak for "we buried the setting and nobody found it."

May 13, 2026: Meta announced Incognito Chat for WhatsApp and the Meta AI app. The pitch? "A completely private way to chat with AI." Messages processed in secure hardware enclaves. Conversations that disappear. Privacy so strong that "no one, not even Meta, can read your conversations."

Five days. That's how long it took Meta to strip encryption from one product and sell it as a feature on another.

Follow the Money

This isn't a contradiction. It's a strategy.

Instagram makes money from advertising. Ads work better when Meta can read your messages, analyze your interests, and serve targeted content. Encryption got in the way of that. So encryption had to go.

WhatsApp makes money from business messaging and, increasingly, from AI engagement. Meta needs people to interact with Meta AI on WhatsApp. But WhatsApp users chose the app specifically for its encryption promise. If they feel their AI conversations aren't private, they won't use them.

So Meta built Private Processing: a system that lets them run AI queries on your messages while claiming they can't see the content. It's the technical architecture that lets Meta have it both ways: harvest data on Instagram, sell privacy on WhatsApp.

The December 2025 policy change makes this even clearer. Meta confirmed that interactions with Meta AI in regular (non-incognito) WhatsApp conversations can be used for targeted advertising. Incognito Chat is the premium tier. Regular AI chat? Still surveillance-friendly.

How Private Processing Actually Works

Meta's Incognito Chat runs on something called Private Processing, a system built around Trusted Execution Environments, or TEEs. Here's the simplified version:

Your message gets encrypted on your phone before leaving the device
It travels to a TEE: a sealed hardware enclave on Meta's servers, running on AMD's SEV-SNP technology
The AI processes your message inside the enclave, supposedly without Meta's systems, employees, or logging infrastructure being able to access it
The response comes back encrypted to your phone
Nothing gets stored: conversations disappear when you leave

The concept mirrors Apple's Private Cloud Compute for Apple Intelligence. But there's a critical difference: Apple has spent decades building a reputation on privacy. Meta has spent decades demolishing one.

As Beebom's analysis put it: Meta is "effectively creating a third layer of access (beyond the sender and receiver) into the messaging chain." Even if that third layer is wrapped in hardware encryption, it's a new attack surface that didn't exist before.

The Audit That Should Worry You

Before launching Private Processing, Meta hired Trail of Bits, a respected security firm, to audit the system. To Meta's credit, they published the results. To everyone's concern, the results were ugly.

Trail of Bits found 28 security issues. Eight were high-severity. Several could have completely undermined the privacy guarantees Meta was advertising.

The worst findings:

Code injection via environment variables: Configuration files loaded after the system's security measurements were taken. A malicious Meta insider could have injected code using LD_PRELOAD to silently exfiltrate user data, while the system still passed all security checks.
Hardware table tampering: ACPI tables weren't included in security measurements, letting a compromised hypervisor inject fake hardware devices with access to user messages and encryption keys.
Fake firmware patch levels: The system trusted firmware's self-reported version numbers instead of checking AMD's cryptographic certificates. An attacker running vulnerable firmware could bypass security entirely.
Attestation replay attacks: No timestamps or unique identifiers in security reports meant an attacker could replay a single compromised attestation indefinitely: a permanent backdoor.

Meta fixed 16 issues completely, partially addressed 4 others, and left 8 open with "documented justifications." Trail of Bits' conclusion: TEEs provide strong isolation, but "every unmeasured input, every missing validation" becomes exploitable.

Put plainly: the system that Meta says "not even Meta can access" had a vulnerability that would have let a single Meta employee steal every message flowing through it.

The Trust Problem Meta Can't Engineer Away

Even if every Trail of Bits finding gets fixed, Meta has a deeper problem: nobody can independently verify that Private Processing works as advertised.

Cybersecurity expert Alan Woodward warned that private AI systems create an accountability gap. If Meta genuinely can't see conversations, outside researchers can't audit harmful outputs either. The same walls that keep Meta out keep oversight out too.

And TEE verification isn't something you can do from your phone. You can't check that the hardware enclave is running the code Meta says it's running. You're trusting Meta's attestation infrastructure, Meta's deployment pipeline, and Meta's word.

This is the company that:

Promised "the future is private" in 2019, then killed Instagram encryption in 2026
Said it couldn't track users across apps, then got caught doing exactly that
Claimed it deleted Cambridge Analytica's data, then admitted it hadn't
Marketed end-to-end encryption as a feature while making it nearly impossible to find and enable

Meta's track record doesn't earn the benefit of the doubt. And "trust us, we literally can't see your data" is an extraordinary claim from a company that has been caught seeing, and selling, data it promised to protect.

The Take It Down Act Connection

The timing of Instagram's encryption removal isn't coincidental. The Take It Down Act takes effect May 19, 2026, 11 days after Meta killed Instagram DM encryption.

The law requires platforms to remove certain content within 48 hours. That's hard to do when messages are encrypted and Meta can't read them. By removing encryption first, Meta gets ahead of the compliance problem.

Meanwhile, Incognito Chat on WhatsApp only covers AI conversations, not messages between people. WhatsApp's person-to-person encryption remains intact. For now. But Meta has shown it's willing to remove encryption when regulation demands it. The precedent is set.

What You Should Do

Don't use Instagram for private conversations. After May 8, Meta can read, scan, and hand over everything you send. Treat DMs like a public post.

Be skeptical of Incognito Chat. The underlying tech had 28 security flaws. Even post-fix, you're trusting Meta's infrastructure, Meta's employees, and Meta's honesty. There's no way to verify from your end.

Use Signal for anything sensitive. Signal's encryption is open-source, independently audited, and doesn't involve hardware enclaves controlled by an advertising company.

Turn on Advanced Chat Privacy in WhatsApp. This blocks others from forwarding your messages to Meta AI for processing. Go to chat settings and enable it for sensitive conversations.

The Bottom Line

Meta didn't suddenly start caring about privacy on May 13. It started marketing privacy where it drives engagement and stripping it where it hurts revenue.

Incognito Chat is a product feature, not a privacy commitment. It exists because users won't talk to AI if they think Meta is listening. Instagram encryption died because Meta wanted to listen.

Same company. Same week. Opposite moves. That tells you everything about where your privacy actually sits on Meta's priority list.

Sources

Published: May 15, 2026