Case 3:26-cv-00751-LB Document 1 Filed 01/23/26 Page 1 of 51

1 QUINN EMANUEL URQUHART & SULLIVAN, LLP

Adam Wolfson (Bar No. 262125)
2 adamwolfson@[Link]
Stephen A. Broome (Bar No. 314605)
3 stephenbroome@[Link]
Kevin Teruya (Bar No. 235916)
4 kevinteruya@[Link]
Valerie Roddy (Bar No. 235163)
5 valerieroddy@[Link]
Lauren B. Lindsay (Bar No. 280516)
6 laurenlindsay@[Link]
865 South Figueroa Street, 10th Floor
7 Los Angeles, CA 90017
Telephone: (213) 443-3000
8 Facsimile: (213) 443-3100

9 KELLER POSTMAN, LLC

Warren Postman (Bar No. 330869)
10 wdp@[Link]
Ashley Keller (pro hac vice forthcoming)
11 ack@[Link]
J.J. Snidow (pro hac vice forthcoming)
12 [Link]@[Link]
1101 Connecticut Avenue, N.W., Suite 1100
13 Washington, D.C. 20036
Telephone: (833) 633-0118
14
BARNETT LEGAL, PLLC
15 Jay W. Barnett (pro hac vice forthcoming)
jay@[Link]
16 3404 NW 135th Street
Oklahoma City, OK 73120
17 Telephone: (405) 456-9343

18 Attorneys for Plaintiffs

19 UNITED STATES DISTRICT COURT

NORTHERN DISTRICT OF CALIFORNIA, SAN FRANCISCO DIVISION
20
EMMA DAWSON, MICHAEL DAWSON, CASE NO. 26-cv-0751
21 LUIZ FILHO, ALKA GAUR, DAMIAN
REYEZ JAQUEZ, YOLISA MKELE, and CLASS ACTION COMPLAINT
22 FERNANDA TATTO, on behalf of themselves
and all others similarly situated, DEMAND FOR JURY TRIAL
23
Plaintiffs,
24
vs.
25
META PLATFORMS, INC., and
26 WHATSAPP, LLC,

27 Defendants.

28

CLASS ACTION COMPLAINT – 26-cv-0751

 Case 3:26-cv-00751-LB Document 1 Filed 01/23/26 Page 2 of 51

1 TABLE OF CONTENTS
Page
2

3 INTRODUCTION ..............................................................................................................................1

4 PARTIES ............................................................................................................................................4

5 JURISDICTION AND VENUE.........................................................................................................5

6 FACTUAL ALLEGATIONS .............................................................................................................6

7 I. The WhatsApp Promise: Encryption for Everyone, Accessible to No One...............6

8 II. WhatsApp’s and Meta’s Unrestricted Access to Users’ Encrypted

Communications.......................................................................................................12
9
III. The Value of Truly Private, End-to-End Encrypted Messages Cannot Be
10 Overstated .................................................................................................................14

11 IV. Meta’s History of Blatant Disregard for User Privacy and Subsequent Cover-
Ups ...........................................................................................................................17
12
CLASS ACTION ALLEGATIONS.................................................................................................28
13
CAUSES OF ACTION ....................................................................................................................31
14
PRAYER FOR RELIEF ...................................................................................................................48
15
JURY DEMAND .............................................................................................................................48
16

17

18

19

20

21

22

23

24

25

26

27

28

-i-
CLASS ACTION COMPLAINT – 26-cv-0751
 Case 3:26-cv-00751-LB Document 1 Filed 01/23/26 Page 3 of 51

1 Plaintiffs Emma Dawson, Michael Dawson, Luiz Filho, Alka Gaur, Damian Reyez Jaquez,

2 Yolisa Mkele, and Fernanda Tatto (“Plaintiffs”) bring this action on behalf of themselves and all

3 others similarly situated against Meta Platforms, Inc. (“Meta”) and WhatsApp, LLC (“WhatsApp”)

4 (collectively, “Defendants”). Plaintiffs bring this action for Defendants’ (1) violation of the Wiretap

5 Act (18 U.S.C. § 2510 et seq.); (2) violation of the California Comprehensive Computer Data

6 Access and Fraud Act (Cal. Penal Code § 502 et seq.); (3) violation of the California Invasion of

7 Privacy Act (Cal. Penal Code § 630 et seq.); (4) invasion of privacy rights protected by Article 1,

8 Section 1 of the California Constitution; (5) intrusion upon seclusion; (6) breach of contract;

9 (7) breach of the implied covenant of good faith and fair dealing; (8) unjust enrichment under quasi-

10 contract theories (pled in the alternative); (9) statutory larceny (Cal. Penal Code §§ 484, 496); and

11 (10) violation of California’s Unfair Competition Law (Cal. Bus. & Prof. Code § 17200).

12 INTRODUCTION

13 1. WhatsApp is the most popular messaging app in the world. It purports to offer its

14 more than three billion users in over 180 countries1 privacy, security, and peace of mind by making

15 two important promises. First, WhatsApp has advertised that it is “[e]ncrypted for everyone” and

16 allows users to “[m]essage privately with everyone.”2 Second, reinforcing the sense of privacy

17 among users, WhatsApp claims it “does not store messages once they are delivered.” 3 To this day,

18 WhatsApp claims that “[y]our privacy is our priority. With end-to-end encryption on WhatsApp,

19 your personal messages, photos, calls and more stay between you and the people you choose,

20

21

22
1
23 WhatsApp, About WhatsApp, available at [Link] (last accessed Jan.
19, 2026).
24 2
WhatsApp, Homepage, available at [Link] (last accessed Nov. 30, 2025)
25 (emphases added).
3
WhatsApp, Information for Law Enforcement Authorities, available at
26 [Link] (last accessed Jan. 19, 2026); see also WhatsApp,
“WhatsApp Privacy Policy” (effective Jan. 4, 2021), available at
27 [Link] (last accessed Jan. 19, 2026) (“We do not retain
your messages in the ordinary course of providing our Services to you. Instead, your messages are
28 stored on your device and not typically stored on our servers. Once your messages are delivered,
they are deleted from our servers.”).
-1-
CLASS ACTION COMPLAINT – 26-cv-0751
 Case 3:26-cv-00751-LB Document 1 Filed 01/23/26 Page 4 of 51

1 meaning not even WhatsApp can see them.”4 Mark Zuckerberg, the founder, Chairman, and Chief

2 Executive Officer of Meta (which has owned WhatsApp since 2014), reinforced this claim to the

3 United States Senate in sworn public testimony, asserting that “we do not see any of the content in

4 WhatsApp; it is fully encrypted . . . . Facebook systems do not see the content of messages being

5 transferred over WhatsApp.”5 And, since at least 2016, WhatsApp chats begin with the following

6 statement:

10

11

12

13 2. These claims are false. WhatsApp and its parent company, Meta, store, analyze, and

14 can access virtually all of WhatsApp users’ purportedly “private” communications. Senior

15 leadership at Meta has tried over the years to prevent the dissemination of this information by siloing

16 different teams that might be able to piece together the truth and directing them to “stay in [their]

17 own lane[s].” Nevertheless, through the assistance of courageous whistleblowers, the truth can now

18 come to light. On information and belief, to this day, Meta and WhatsApp store, maintain access to,

19 and use WhatsApp’s three billion users’ “encrypted” messages. This lawsuit seeks to expose the

20 fundamental privacy violations and fraud Meta is perpetrating against the billions of people

21
4
22 WhatsApp, Privacy, available at [Link] (last accessed Jan. 19, 2026)
(emphasis added); see also WhatsApp, Does WhatsApp collect or sell your data?, available at
23 [Link] (last accessed Jan. 19, 2026)
(“Every personal message, call, media, voice message, or document you send on WhatsApp is
24 private and protected with end-to-end encryption by default. That means all your personal messages
stay between you and who you send them to—no one else, not even WhatsApp (or Meta), can read,
25
listen to, or share them.”).
26 5 Tr. of Testimony of Mark Zuckerberg, United States Senate, S. Hrg. 115-683, Joint Hearing
Before the Committee on Commerce, Science and Transportation and the Committee on the
27 Judiciary, “Facebook, Social Media Privacy, and the Use and Abuse of Data,” 115th Cong., 2d

28 Session (Apr. 10, 2018), available at [Link]

event/LC64510/text (last accessed Jan. 19, 2026).
-2-
CLASS ACTION COMPLAINT – 26-cv-0751
 Case 3:26-cv-00751-LB Document 1 Filed 01/23/26 Page 5 of 51

1 worldwide who have used WhatsApp believing their communications would be private from

2 everyone, even from WhatsApp and Meta.

3 3. The gravity of Meta’s and WhatsApp’s violation of users’ privacy and trust cannot

4 be overstated. Across the globe, activists, independent journalists, those living under authoritarian

5 regimes, and many others rely on WhatsApp to communicate based on their erroneous (but well-

6 justified) belief that the substance of their communications is beyond scrutiny by anyone without

7 some element of self-reporting. Although unencrypted metadata alone can be used to identify and

8 locate such users, for some, access to the substance of their communications can literally mean the

9 difference between life or death. Even for users who do not face such high stakes if their

10 communications are accessible to third parties, their belief in the inviolability of their private

11 communications is an essential aspect of psychological health and well-being (among other things),

12 particularly in a time when people’s most intimate relationships are developed and maintained

13 increasingly via digital communications instead of, and in addition to, face-to-face interactions. In

14 any event, all users were entitled to believe their communications were private because WhatsApp

15 and Meta unequivocally and repeatedly promised that they did not store users’ delivered messages

16 and that no one—not even WhatsApp and Meta—can access their encrypted messages.

17 4. Plaintiffs bring this class action on behalf of themselves and all others similarly

18 situated and, specifically, all users of WhatsApp worldwide since April 5, 2016, excluding users

19 residing in the United States or Canada (who are subject to an arbitration requirement under

20 WhatsApp Terms of Service), the “European Region”6 (who are subject to Terms of Service that

21 require users to bring claims in their own country—if jurisdiction exists there—or Ireland), or the

22

23
6
24 WhatsApp defines the European Region as including “Andorra, Austria, Azores, Belgium,
Bulgaria, Canary Islands, Channel Islands, Croatia, Czech Republic, Denmark, Estonia, Finland,
25 France, French Guiana, Germany, Gibraltar, Greece, Guadeloupe, Hungary, Iceland, Ireland, Isle of
Man, Italy, Latvia, Liechtenstein, Lithuania, Luxembourg, Madeira, Malta, Martinique, Mayotte,
26 Monaco, Netherlands, Norway, Poland, Portugal, Republic of Cyprus, Réunion, Romania, San
Marino, Saint-Martin, Slovakia, Slovenia, Spain, Sweden, Switzerland, United Kingdom sovereign
27 bases in Cyprus (Akrotiri and Dhekelia), and Vatican City.” See, e.g., WhatsApp, “FAQ: Who is
28 providing your WhatsApp services,” available at [Link] (last
accessed Jan. 19, 2026).
-3-
CLASS ACTION COMPLAINT – 26-cv-0751
 Case 3:26-cv-00751-LB Document 1 Filed 01/23/26 Page 6 of 51

1 United Kingdom.7 Under WhatsApp’s own Terms of Service, all other users either must bring

2 claims against WhatsApp in either this Court or the Superior Court of San Mateo County. 8

3 5. Like other members of the Class, Plaintiffs are WhatsApp users whose end-to-end

4 encrypted communications have been stored by and accessible to WhatsApp and Meta,

5 notwithstanding WhatsApp’s and Meta’s assurances to the contrary. Plaintiffs bring this action to

6 enforce their privacy rights and seek damages and other relief for the harm WhatsApp and Meta have

7 caused them by willfully misrepresenting to them that their private communications were just that—

8 private and inaccessible even to WhatsApp and Meta. In fact, WhatsApp and Meta have access to all

9 WhatsApp users’ encrypted communications in their entirety.

10 PARTIES

11 6. Plaintiff Emma Dawson is an adult domiciled in Australia. Dawson has been a

12 WhatsApp user during the entire Class Period.

13 7. Plaintiff Michael Dawson is an adult domiciled in Australia. Dawson has been a

14 WhatsApp user during the entire Class Period.

15 8. Plaintiff Luiz Filho is an adult domiciled in Brazil. Filho has been a WhatsApp user

16 during the entire Class Period.

17 9. Plaintiff Alka Gaur is an adult domiciled in India. Gaur has been a WhatsApp user

18 during the entire Class Period.

19

20

21 7
WhatsApp, “FAQ: Who is providing your WhatsApp services,” available at
22 [Link] (last accessed Jan. 19, 2026).
8
See, e.g., WhatsApp, Terms of Service, “Dispute Resolution,” available at
23 [Link]

24 (“If you are not subject to the ‘Special Arbitration Provision for United States or Canada Users’
section below, you agree that any claim or cause of action you have against WhatsApp relating to,
25 arising out of, or in any way in connection with our Terms or our Services, and for any claim or
cause of action that WhatsApp files against you, you and WhatsApp agree that any such claim or
26 cause of action . . . will be resolved exclusively in the United States District Court for the Northern
District of California or a state court located in San Mateo County in California, and you agree to
27 submit to the personal jurisdiction of such courts for the purpose of litigating any such claim or

28 cause of action, and the laws of the State of California will govern any such claim or cause of action
without regard to conflict of law provisions.”) (last accessed Jan. 19, 2026).
-4-
CLASS ACTION COMPLAINT – 26-cv-0751
 Case 3:26-cv-00751-LB Document 1 Filed 01/23/26 Page 7 of 51

1 10. Plaintiff Damian Reyez Jaquez is an adult domiciled in Mexico. Jaquez has been a

2 WhatsApp user during the entire Class Period.

3 11. Plaintiff Yolisa Mkele is an adult domiciled in South Africa. Mkele has been a

4 WhatsApp user during the entire Class Period.

5 12. Plaintiff Fernanda Tatto is an adult domiciled in Brazil. Tatto has been a WhatsApp

6 user during the entire Class Period.

7 13. Defendant Meta is a Delaware corporation, organized and existing under the laws of

8 the State of Delaware, with its principal place of business at 1 Meta Way, Menlo Park, California

9 94025. With a $1.72 trillion market capitalization (subject to market fluctuations), Meta is

10 consistently ranked as one of the ten largest corporations in the world. 9 Prior to October 28, 2021,

11 Meta operated as Facebook, Inc. (“Facebook”). 10 For simplicity, this Complaint may refer to Meta

12 and Facebook, Inc. (the corporate entity) interchangeably as “Meta.”

13 14. Defendant WhatsApp is a Delaware limited liability company, organized and

14 existing under the laws of the State of Delaware, with its principal place of business at 1 Meta Way,

15 Menlo Park, California, 94025. Since 2014, WhatsApp has been a wholly-owned subsidiary of

16 Meta, acquired by (then-)Facebook for approximately $19 billion in cash and stock. 11

17 JURISDICTION AND VENUE

18 15. This Court has subject matter jurisdiction over the federal claims in this action

19 pursuant to 28 U.S.C. § 1331.

20 16. This Court also has subject matter jurisdiction over this action pursuant to the Class

21 Action Fairness Act, 28 U.S.C. § 1332(d), because the amount in controversy exceeds $5,000,000

22 exclusive of interest and costs, there are more than 100 putative Class Members as defined below,

23

24 9
J. Pinkerton, “The 10 Most Valuable Companies in the World by Market Capitalization,” U.S.
25 News (June 24, 2025), available at [Link]
companies-in-the-world-by-market-cap (last accessed Jan. 19, 2026).
26 10
Meta, “Introducing Meta: A Social Technology Company” (Oct. 28, 2021), available at
27 [Link] (last accessed Jan. 19, 2026).
11
28 Meta, “Facebook to Acquire WhatsApp” (Feb. 19, 2014), available at
[Link] (last accessed Jan. 19, 2026).
-5-
CLASS ACTION COMPLAINT – 26-cv-0751
 Case 3:26-cv-00751-LB Document 1 Filed 01/23/26 Page 8 of 51

1 at least one member of the putative class is a citizen of a foreign state, and Defendants are citizens

2 of California and Delaware.

3 17. This Court also has supplemental jurisdiction over the state law claims in this action

4 pursuant to 28 U.S.C. § 1367 because the state law claims form part of the same case or controversy

5 as those that give rise to the federal claims.

6 18. This Court has general personal jurisdiction over Defendants because their principal

7 places of business are in California. Additionally, Defendants are subject to specific personal

8 jurisdiction in this state because a substantial part of the events and conduct giving rise to Plaintiffs’

9 claims occurred in this state.

10 19. Venue is proper in this District under the provisions of 28 U.S.C. § 1391(b), because

11 Defendants are headquartered in this district and a substantial portion of the events or omissions

12 giving rise to the claims occurred in this judicial district.

13 FACTUAL ALLEGATIONS

14 I. The WhatsApp Promise: Encryption for Everyone, Accessible to No One

15 20. Founded in 2009 by Jan Koum and Brian Acton, WhatsApp historically prided itself

16 on being outside the big data economy driven by tech giants like Facebook—an oasis of privacy in

17 a world where Facebook seemingly knew everything about everyone. In a 2009 blog post,

18 Mr. Koum “set the record straight”: “We have not, we do not and we will not ever sell your personal

19 information to anyone. Period. End of story.” 12 In 2012, WhatsApp’s co-founders explained they

20 charged for WhatsApp to keep it ad-free because “[a]t every company that sells ads, a significant

21 portion of their engineering team spends their day tuning data mining, writing better code to collect

22 all your personal data, upgrading the servers that hold all the data and making sure it’s all being

23 logged and collated and sliced and packaged and shipped out[.]” 13 They cautioned: “Remember,

24

25

26 12
WhatsApp, “Just wanted to say a few things” (Nov. 19, 2009), available at
27 [Link] (last accessed Jan. 19, 2026).
13
28 WhatsApp, “Why we don’t sell ads” (Jun. 18, 2012), available at [Link]
we-don-t-sell-ads (last accessed Jan. 19, 2026).
-6-
CLASS ACTION COMPLAINT – 26-cv-0751
 Case 3:26-cv-00751-LB Document 1 Filed 01/23/26 Page 9 of 51

1 when advertising is involved you the user are the product.”14 But at WhatsApp, they stressed,

2 “[y]our data isn’t even in the picture. We are simply not interested in any of it.”15

3 21. When Facebook acquired WhatsApp in 2014, there was widespread concern that

4 WhatsApp’s respect for users’ data and privacy would be compromised. But Mr. Koum again “set[]

5 the record straight,” reminding users of his experience growing up in Ukraine, where KGB

6 monitoring of phone calls was commonplace and part of the reason his family emigrated; at

7 WhatsApp, he stated, “[r]espect for your privacy is coded into our DNA[.]”16 Complaining that

8 speculation that WhatsApp’s partnership with Facebook would change its core principles was

9 “baseless,” “unfounded,” and “irresponsible,” Mr. Koum assured users that WhatsApp’s “focus

10 remains on delivering the promise of WhatsApp far and wide, so that people around the world have

11 the freedom to speak their mind without fear.”17 Facebook CEO Mark Zuckerberg also assured the

12 public that “[t]he vision is to keep the [WhatsApp] service exactly the same,” noting WhatsApp

13 “neither uses nor stores any of the billions of photos and chats exchanged on the app daily.” Instead,

14 WhatsApp content is deleted “almost instantly,” which is “what people want,” and “[w]e would be

15 pretty silly to get in the way of that.”18

16 22. Given the consumer concern that Meta might obtain access to WhatsApp messages,

17 WhatsApp has repeatedly and emphatically promised that end-to-end encryption for everyone

18 prevents anyone—even WhatsApp and Meta—from accessing private communications. It is clear

19 WhatsApp and Meta marketed WhatsApp in this way because they (correctly) determined that this

20

21
14
Id. (emphasis original).
22
15
Id. (emphases added).
23 16
WhatsApp, “Setting the record straight” (Mar. 17, 2014), available at
24 [Link] (last accessed Jan. 19, 2026) (emphases
added).
25 17
Id. (emphases added).
26 18 See, e.g., B. Bosker, “Zuckerberg Promises Facebook Won’t Read Your WhatsApp Chats,” The
Huffington Post (Feb. 24, 2014), available at [Link]
27 facebook-whatsapp_n_4848205#:~:text=top%20stories%20here.-

28 ,Zuckerberg%20Promises%20Facebook%20Won't%20Read%20Your%20WhatsApp%20Chats,of
%20that%2C%22%20he%20added (last accessed Jan. 19, 2026).
-7-
CLASS ACTION COMPLAINT – 26-cv-0751
 Case 3:26-cv-00751-LB Document 1 Filed 01/23/26 Page 10 of 51

1 promise would maintain and grow WhatsApp’s user base, despite users’ obvious and well-founded

2 concerns about Meta’s broader privacy problems.

3 23. For example, until recently, the first image that greeted users upon visiting

4 WhatsApp’s website touted that WhatsApp is “[e]ncrypted for everyone” and allows users to

5 “[m]essage privately with everyone”:19

10

11

12

13

14

15

16 24. WhatsApp’s “Privacy” page—which is the second section on the WhatsApp website,

17 following only the “Features” section, highlights at the very top of the page that: users can “Message

18 privately,” “[y]our privacy is our priority,” and “[w]ith end-to-end encryption on WhatsApp, your

19 personal messages, photos, calls and more stay between you and the people you choose, meaning

20 not even WhatsApp can see them”:20

21

22

23

24

25

26
19
27 WhatsApp, Homepage, available at [Link] (last accessed Nov. 30, 2025).
20
28 WhatsApp, “Privacy,” available at [Link] (last accessed Jan. 19,
2026) (emphases added).
-8-
CLASS ACTION COMPLAINT – 26-cv-0751
 Case 3:26-cv-00751-LB Document 1 Filed 01/23/26 Page 11 of 51

8
25. WhatsApp continues boasting that only the recipient and the sender can read private
9
conversations such as “confessions, [] difficult debates, or silly inside jokes”: 21
10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27
21
28 WhatsApp, “Privacy,” available at [Link] (last accessed Jan. 19,
2026) (excerpted).
-9-
CLASS ACTION COMPLAINT – 26-cv-0751
 Case 3:26-cv-00751-LB Document 1 Filed 01/23/26 Page 12 of 51

1 26. WhatsApp’s “FAQ” again reinforces that “not even WhatsApp[] can read, listen to,

2 or share” users’ personal images and calls,” emphasizing that end-to-end encryption happens

3 “automatically”:22

10 27. Notably, WhatsApp chats have this header emblazoned at the top:
11

12

13

14

15

16

17 28. Importantly, neither WhatsApp nor Meta discloses anywhere their unlimited access

18 to users’ encrypted communications—not even in the fine print. WhatsApp discloses only certain

19 limited exceptions to its end-to-end encryption and the ability of WhatsApp, Meta, and third parties

20 to access encrypted message content. For example, WhatsApp discloses that when a user reports

21 another user in an individual chat, WhatsApp receives up to five of the last messages the reported

22 user sent to the reporting user.23 Similarly, when a user reports abuse in a group chat, WhatsApp

23 receives up to five of the last messages sent to the reporting user within the reported group. Where

24

25 22
WhatsApp, “About end-to-end encryption,” available at
26 [Link] (last accessed Jan. 19, 2026)
(annotations added).
27 23 WhatsApp, “About reporting and blocking on WhatsApp,” available at

28 [Link] (last
accessed Jan. 19, 2026).
-10-
CLASS ACTION COMPLAINT – 26-cv-0751
 Case 3:26-cv-00751-LB Document 1 Filed 01/23/26 Page 13 of 51

1 calls take place in an individual chat, WhatsApp may also receive basic information about the last

2 five calls with that user, such as who initiated the call and the duration of the call. 24 Nothing in these

3 disclosures suggests that WhatsApp or Meta can access all of any user’s communications. Nor do

4 the disclosures suggest that WhatsApp or Meta can access a user’s communications even when the

5 limited circumstances identified in the disclosures do not apply.

6 29. WhatsApp likewise discloses that when customers contact WhatsApp for customer

7 support, they may provide WhatsApp with information, “including copies of [their] messages.” 25

8 Here too, however, this disclosure does not suggest WhatsApp and Meta can access any message

9 the user does not provide to customer support.

10 30. WhatsApp also carves out from its claims that WhatsApp and Meta cannot see users’

11 messages certain specific use cases, including business messaging services (which it says are clearly

12 distinguished from personal messages) and communications that are not encrypted (such as

13 communications with Meta services or communications with businesses using Cloud API. 26 Once

14 again, nothing in these disclosures suggests WhatsApp and Meta can access all of a user’s encrypted

15 messages.

16 31. Finally, regarding disclosures to law enforcement, WhatsApp states in relevant part:

17 In the ordinary course of providing our service, WhatsApp does not

store messages once they are delivered or transaction logs of such
18 delivered messages. Undelivered messages are deleted from our
servers after 30 days. . . [W]e may collect, use, preserve, and share
19 user information if we have a good-faith belief that it is reasonably
necessary to (a) keep our users safe, (b) detect, investigate, and
20
24
21 Id.
25
22 WhatsApp, “WhatsApp Privacy Policy” (effective Jan. 4, 2021), available at
[Link] (last accessed Jan. 19, 2026).
23 26
WhatsApp, “How you interact with others,” available at
24 [Link] (last accessed Jan. 19, 2026); WhatsApp, “About
end-to-end encryption,” available at [Link] (last accessed
25 Jan. 19, 2026); WhatsApp, “WhatsApp Encryption Overview: Technical White Paper,” available at
[Link]
26 6/455962147_1148247109601582_1673264986279156121_n.pdf?_nc_cat=101&ccb=1-
7&_nc_sid=e280be&_nc_ohc=QeHE3hZyqTUQ7kNvwHTaYvz&_nc_oc=AdnI2TA1TwLkU-
27 lslAuP5ZdFKjtEW2P5xXkvd1XDRqebpLQHtAmKQUBysG47pnDIsbw&_nc_zt=14&_nc_ht=sc
28 [Link]&_nc_gid=zODDu4H8Iis7NtbQUdNW6Q&oh=00_AfrHORvnclt45MEsoeo1KIAhIOvs
vWV8uzMwxNqLPGAaJA&oe=69747019 (last accessed Jan. 19, 2026).
-11-
CLASS ACTION COMPLAINT – 26-cv-0751
 Case 3:26-cv-00751-LB Document 1 Filed 01/23/26 Page 14 of 51

1 prevent illegal activity, (c) respond to legal process, or to government

requests, (d) enforce our Terms and policies. This may include
2 information about how some users interact with others on our service.
We also offer end-to-end encryption for our services, which is
3 always activated. End-to-end encryption means that messages are
encrypted to protect against WhatsApp and third parties from
4 reading them.27

5 Here too, far from disclosing it can access users’ encrypted communications, WhatsApp is

6 representing to both users and law enforcement authorities that it cannot read users’ encrypted

7 messages.

8 II. WhatsApp’s and Meta’s Unrestricted Access to Users’ Encrypted Communications

9 32. End-to-end encryption is a method of securing digital communications wherein data

10 is encrypted on the sender’s device and only decrypted once it reaches the recipient’s device. As

11 WhatsApp analogizes, “with end-to-end encryption, your messages are secured with a lock, and

12 only the recipient and you have the special key needed to unlock and read them. All of this happens

13 automatically: no need to turn on any special settings to secure your messages.” 28 In theory, even

14 though encrypted communications may pass through a service provider’s servers on their way to the

15 intended recipient, they remain encrypted and unreadable to everyone but that intended recipient,

16 because only the sender and the recipient have the key to “unlock” them on their respective devices.

17 33. In November 2014, shortly after its acquisition by Facebook (now Meta), WhatsApp

18 partnered with Open Whisper Systems to integrate the Signal Protocol, an end-to-end encryption

19 cryptographic protocol, into its platform.29 (Open Whisper Systems offers its own end-to-end

20 encrypted messaging application, called Signal.) By April 5, 2016, WhatsApp had completed

21 integration of end-to-end encryption for all forms of communication across all user devices. 30

22

23
27
WhatsApp, “Information for Law Enforcement Authorities,” available at
24 [Link] (last accessed Jan. 19, 2026) (emphases added).
28
25 WhatsApp, “FAQ: How does WhatsApp work?” available at
[Link] (last accessed Jan. 19, 2026).
26 29
Signal, “Open Whisper Systems partners with WhatsApp to provide end-to-end encryption”
27 (Nov. 18, 2014), available at [Link] (last accessed Jan. 19, 2026).
30
28 Signal, “WhatsApp’s Signal Protocol integration is now complete,” (Apr. 5, 2016), available at
[Link] (last accessed Jan. 19, 2026).
-12-
CLASS ACTION COMPLAINT – 26-cv-0751
 Case 3:26-cv-00751-LB Document 1 Filed 01/23/26 Page 15 of 51

1 34. Lest there be any confusion, the Signal Protocol does not protect all user information

2 (nor does it purport to). Only the contents of the communication are encrypted; the metadata

3 associated with the communication is not. Thus, as even they concede, Meta and WhatsApp have

4 access to users’ metadata and can identify the who, when, and where (among other circumstances)

5 of users’ communications. Thus, if Alice and Bob message each other 90 times between 2 a.m. and

6 3 a.m. while Alice is in Seattle and Bob is in Sacramento, all of that information is undisputedly

7 available to Meta and WhatsApp (and any other parties to whom they may make it available).

8 WhatsApp represented, however, that the contents of those messages are (theoretically)

9 undiscoverable. That claim necessarily represents that the Signal Protocol has been implemented

10 without the inclusion of any “backdoor” in the application’s source code that would allow either the

11 platform itself or third parties to circumvent encryption. Such backdoors are called “kleptographic

12 backdoors.”

13 35. Signal itself notably makes its source code available for public inspection to promote

14 both transparency and security (by allowing the public at large, including security analysts and

15 researchers, to test for and identify vulnerabilities), and reviews of Signal’s source code have in fact

16 confirmed that it has no backdoor to its end-to-end encryption. But under Meta’s ownership,

17 WhatsApp does not make its source code available to the public or even to third party security

18 auditors. Accordingly, although cryptosecurity experts are confident the Signal app functions

19 without any kleptographic backdoor, the public can only take the word of Meta and WhatsApp that

20 they do not have access to the substance of WhatsApp users’ communications.

21 36. Meta’s and WhatsApp’s claim that they do not have access to the substance of

22 WhatsApp users’ communications is false. As the whistleblowers here have explained, WhatsApp

23 and Meta store and have unlimited access to WhatsApp encrypted communications, and the process

24 for Meta workers to obtain that access is quite simple. A worker need only send a “task” (i.e., request

25 via Meta’s internal system) to a Meta engineer with an explanation that they need access to

26 WhatsApp messages for their job. The Meta engineering team will then grant access—often without

27 any scrutiny at all—and the worker’s workstation will then have a new window or widget available

28

-13-
CLASS ACTION COMPLAINT – 26-cv-0751
 Case 3:26-cv-00751-LB Document 1 Filed 01/23/26 Page 16 of 51

1 that can pull up any WhatsApp user’s messages based on the user’s User ID number, which is unique

2 to a user but identical across all Meta products.

3 37. Once the Meta worker has this access, they can read users’ messages by opening the

4 widget; no separate decryption step is required. The WhatsApp messages appear in widgets

5 commingled with widgets containing messages from unencrypted sources. Messages appear almost

6 as soon as they are communicated—essentially, in real-time. Moreover, access is unlimited in

7 temporal scope, with Meta workers able to access messages from the time users first activated their

8 accounts, including those messages users believe they have deleted.

9 38. Some users—such as certain celebrities, politicians, and Meta employees—are

10 afforded special handling by Meta such that access to their encrypted messages is more closely

11 tracked within Meta and WhatsApp. Meta workers still have access to these users’ messages, but

12 their access of the accounts flags the worker for investigation. Even as to these privileged few

13 WhatsApp users, however, Meta and WhatsApp are still misleading them and violating their privacy

14 by storing their supposedly private, end-to-end encrypted, messages.

15 39. Although Meta has kept the circle on its fraud small, it has not kept it small enough.

16 It attempted to prevent dissemination of this information by heavily siloing workers in different

17 groups and telling them to “stay in [their] lane” when and if they started to piece together the truth.

18 As discussed below, Meta also actively misrepresented the facts about its access and storage when

19 journalists came close to discovering the truth. Meta has also tried to prevent the truth from coming

20 out by imposing onerous nondisclosure agreements on its workers, essentially threatening the full

21 force of one of the world’s richest companies if any of these individuals dared reveal what goes on

22 behind closed doors at the company. These efforts have now failed, but they worked for many, many

23 years by obscuring the truth.

24 III. The Value of Truly Private, End-to-End Encrypted Messages Cannot Be Overstated

25 40. In an age where (i) Meta can trace Facebook users’ every click and scroll and

26 (ii) Internet surfers are called on to choose (or ignore) cookie preferences multiple times per day,

27 invasions of online privacy can too easily be undervalued. But that is not the case for the private

28

-14-
CLASS ACTION COMPLAINT – 26-cv-0751
 Case 3:26-cv-00751-LB Document 1 Filed 01/23/26 Page 17 of 51

1 substance of WhatsApp users’ encrypted communications, which both WhatsApp and Meta have

2 conditioned WhatsApp users to believe are inviolate.

3 41. Indeed, WhatsApp has long been used throughout the world by journalists,

4 dissidents, activists, and others for whom maintaining confidences can mean the difference between

5 life and death, freedom and incarceration, or exposing truth and letting it languish in shadows.

6 42. For example, end-to-end encryption of voice memos, which prevents access by third

7 parties, is a particularly useful feature of WhatsApp for journalists reporting news from war-torn

8 regions. As CBS reporter Amjad Tadros explained: “I use it a lot, especially in covering the news

9 in Yemen as it is hard to get a clean phone line there. I end up sending the questions on WhatsApp

10 and get the answers back in text or voice.” 31

11 43. In Venezuela, for example, where state surveillance under the authoritarian

12 dictatorship of Nicolas Maduro reached a “massive scale,” independent media advocates urged

13 “[m]embers of at-risk organizations such as journalists, human rights defenders, and social and

14 political activists” to “take measures to protect the security and privacy of their communications”

15 by using “instant messaging apps that have end-to-end encryption such as . . . WhatsApp.” 32

16 44. In many countries in which WhatsApp is a popular communication tool, a person’s

17 private expressions of intimacy can expose them to dire penalties. Nearly 40% of people use

18 WhatsApp in Egypt, for example, where the United States Department of State cautions that

19 Egyptian authorities use both social media and dating apps to entrap suspected gay and lesbian

20 people for “debauchery,” a crime punishable there by up to 10 years in prison. 33 In such places, the

21 ability to send truly private messages to intimate partners is priceless.

22

23
31
24 See, e.g., Foreign Press Correspondents USA, “Using WhatsApp as a Journalistic Tool,” (June
26, 2022), available at [Link]
25 journalistic-tool (last accessed Jan. 19, 2026).
32
26 D. Aragort, “The Reality of Digital Authoritarianism in Venezuela,” Center for International
Media Assistance (Sept. 20, 2022), available at [Link]
27 digital-authoritarianism-in-venezuela/ (last accessed Jan. 19, 2026).
33
28 See, e.g., U.S. Dept. of State, “Egypt,” available at [Link]
travel/travel-advisories/[Link]#local (last accessed Jan. 19, 2026).
-15-
CLASS ACTION COMPLAINT – 26-cv-0751
 Case 3:26-cv-00751-LB Document 1 Filed 01/23/26 Page 18 of 51

1 45. The life-or-death stakes for dissidents who mistakenly believe their communications

2 on WhatsApp are private is illustrated by the fallout from the Pegasus spyware, developed by Israeli

3 surveillance firm NSO Group and sold only to governments. Most prominently, self-exiled Saudi

4 activist Omar Abdulaziz communicated with (also self-exiled) Saudi journalist and regime critic

5 Jamal Khashoggi in hundreds of WhatsApp messages they believed were private and encrypted. As

6 CNN journalists Nina dos Santos and Michael Kaplan noted, Mr. Khashoggi’s public criticism of

7 Saudi Crown Prince Mohammad bin Salman was “measured,” but “[i]n private, the Washington

8 Post columnist didn’t hold back,” calling the Crown Prince a “‘beast’ [and] a ‘pac-man’ who would

9 devour all in his path,” citing hundreds of WhatsApp messages they were provided to review. 34

10 Messrs. Abdulaziz and Khashoggi used WhatsApp to coordinate funding and SIM cards for a cyber-

11 army of social media warriors to combat state-sponsored propaganda in Saudi Arabia in messages

12 that would be deemed “treasonous” by Saudi authorities. 35 Just one day after the University of

13 Toronto’s Citizen Lab published a report detailing how it had concluded with “high confidence”

14 that a Saudi “operator” infected Mr. Abdulaziz’s cell phone with Pegasus spyware that permitted

15 the Saudis to surveil his communications (including his WhatsApp messages), 36 Mr. Khashoggi was

16 killed and dismembered in the Saudi embassy in Istanbul, Turkey. 37 To be clear, Plaintiffs do not

17 allege—or even suggest—that Meta’s and WhatsApp’s secret access to Mr. Khashoggi’s private

18 WhatsApp communications caused or contributed to his death. Indeed, WhatsApp obtained a legal

19

20
34
N. dos Santos and M. Kaplan, “Jamal Khashoggi’s private WhatsApp messages may offer new
21
clues to killing,” CNN World (Dec. 4, 2018), available at
22 [Link]
intl/[Link] (last accessed Jan. 19, 2026) (emphases added).
23 35
Id.
24 36 B. Marczak et al., “The Kingdom Came to Canada: How Saudi-Linked Digital Espionage
Reached Canadian Soil,” Citizen Lab (Oct. 1, 2018), available at [Link]
25
kingdom-came-to-canada-how-saudi-linked-digital-espionage-reached-canadian-soil/ (last
26 accessed Jan. 19, 2026).
37
A. Schmidt, “‘I know why Jamal was killed’: Saudi activist in Canada says hacked phones led
27 to Jamal Khashoggi’s murder,” CBC (Nov. 1, 2021), available at
28 [Link]
(last accessed Jan. 19, 2026).
-16-
CLASS ACTION COMPLAINT – 26-cv-0751
 Case 3:26-cv-00751-LB Document 1 Filed 01/23/26 Page 19 of 51

1 victory against the NSO Group for its targeting of WhatsApp users using spyware exploits (not

2 decryption). But Mr. Khashoggi’s experience illustrates two important points that are relevant to

3 Plaintiffs’ allegations in this case: (i) people are more likely to express uninhibited and private

4 thoughts—even those for which they could be targeted or severely punished—when they believe

5 their communications with trusted individuals cannot be compromised; and (ii) unintended access

6 to such private communications on trusted platforms can have devastating consequences.

7 46. Even in societies where concerns about persecution for dissenting opinions,

8 government opposition, or sexual orientation are less prevalent, digital communications are an

9 essential (and even primary) component of how people develop and conduct their most intimate

10 relationships.38 Intimacy requires self-disclosure and vulnerability, which depends on a sense of

11 control (i.e., privacy).39 Fear that communications may be monitored by others thus can produce

12 chilling effects that inhibit authentic disclosure. Without reasonable expectations of privacy in

13 digital communication, individuals will avoid the authentic self-disclosure necessary for intimate

14 relationships and engage in self-censorship.40 Accordingly, privacy of digital communications is

15 essential to the development of most close personal and intimate relationships in the modern era.

16 IV. Meta’s History of Blatant Disregard for User Privacy and Subsequent Cover-Ups

17 47. Over the years, Meta’s name has become synonymous with user privacy violations.

18 Again and again, Meta/Facebook has violated users’ privacy rights by using their information in

19 undisclosed ways, such as disclosing their personal data en masse to third parties with no verified

20 need for the information in violation of stated privacy policies, failing to apprise users of data

21

22 38
See, e.g., S. Hardman Taylor & N. Bazaroya, “Always Available, Always Attached: A Relational
Perspective on the Effects of Mobile Phones and Social Media on Subjective Well-Being,” 26 J. of
23
Comp.-Mediated Commc’n 187 (Aug. 24, 2021), available at
24 [Link] (last accessed Jan. 19, 2026).
39
See, e.g., A. Stuart, A. Bandara & M. Levine, “The Psychology of Privacy in the Digital Age,”
25
Social and Personality Psychology Compass (Nov. 2019), available at
26 [Link]
_age (last accessed Jan. 19, 2026).
27 40 See, e.g., M. Büchi, N. Festic & M. Latzer, “The Chilling Effects of Digital Dataveillance: A

28 Theoretical Model and an Empirical Research Agenda,” Big Data & Society (2022), available at
[Link] (last accessed Jan. 19, 2026).
-17-
CLASS ACTION COMPLAINT – 26-cv-0751
 Case 3:26-cv-00751-LB Document 1 Filed 01/23/26 Page 20 of 51

1 breaches and misuses—including in the data misuse at the center of the infamous 2016 Cambridge

2 Analytica scandal—and then affirmatively misleading the public as to whether such privacy

3 violations had occurred. One would think Meta would have learned from this history. It clearly has

4 not.

5 48. For example, on November 29, 2011, the United States Federal Trade Commission

6 (“FTC”) announced Facebook had agreed to enter into a 20-year consent order (finalized in 2012)

7 in settlement of an eight-count complaint alleging Facebook “deceived consumers by telling them

8 they could keep their information on Facebook private, and then repeatedly allowing [that

9 information] to be shared and made public.”41 Among other things, the FTC charged Facebook with

10 (i) failing to warn users that information they designated private (such as their “Friends List[s]”)

11 would be made public; (ii) giving third-party apps access to “nearly all of users’ personal data”—

12 data the apps did not need—despite Facebook’s representations these apps would have access only

13 to user information needed to operate; (iii) misrepresenting to users that they could restrict data

14 sharing to “Friends Only” when that information was shared with third-party applications their

15 friends used; (iv) claiming it certified the security of apps in its “Verified Apps” program when it

16 did not; (v) falsely promising it would not share users’ personal information with advertisers; and

17 (vi) allowing access to users’ photos and videos even after users deactivated or deleted their

18 accounts, despite claiming they would be inaccessible.42

19 49. The consent order (among other things) barred Facebook from making any further

20 misrepresentations about the privacy or security of consumers’ personal information; required

21

22 41
Federal Trade Commission, “Facebook Settles FTC Charges That It Deceived Consumers By
23 Failing To Keep Privacy Promises” (Nov. 29, 2011), available at [Link]
events/news/press-releases/2011/11/facebook-settles-ftc-charges-it-deceived-consumers-failing-
24 keep-privacy-promises (last accessed Jan. 19, 2026); In the Matter of Facebook, Inc., No. 092 3184,
Agreement Containing Consent Order, available at
25
[Link] (last
26 accessed Jan. 19, 2026).
42
Federal Trade Commission, “Facebook Settles FTC Charges That It Deceived Consumers By
27 Failing To Keep Privacy Promises” (Nov. 29, 2011), available at [Link]

28 events/news/press-releases/2011/11/facebook-settles-ftc-charges-it-deceived-consumers-failing-
keep-privacy-promises (last accessed Jan. 19, 2026).
-18-
CLASS ACTION COMPLAINT – 26-cv-0751
 Case 3:26-cv-00751-LB Document 1 Filed 01/23/26 Page 21 of 51

1 Facebook to get consumers’ affirmative express consent before enacting changes overriding their

2 privacy preferences; required Facebook to establish and maintain a “comprehensive privacy

3 program designed to address privacy risks associated with the development and management of new

4 and existing products and services and to protect the privacy and confidentiality of consumers’

5 information”; and subjected Facebook to periodic assessments of its privacy practices by

6 independent, third-party auditors for the 20-year life of the consent order. 43

7 50. The FTC commenced a wide-ranging investigation into Facebook’s continuing

8 privacy violations in March 2018, catalyzed by the revelation of Cambridge Analytica’s use of data

9 from tens of millions of Facebook users to build voter profiles and sprawled from there. 44 On July

10 24, 2019, the FTC announced it was levying an historic $5 billion penalty against Facebook

11 (approved by a court in 2020) for violations of the 2012 consent order, which was “the largest ever

12 imposed on any company for violating consumers’ privacy and almost 20 times greater than the

13 largest privacy or data security penalty ever imposed worldwide” and “one of the largest penalties

14 ever assessed by the U.S. government for any violation” of any kind. 45

15 51. As then-FTC Chairman Joe Simons explained, “[d]espite repeated promises to its

16 billions of users worldwide that they could control how their personal information is shared,

17 Facebook undermined consumers’ choices.”46 Specifically, notwithstanding the 2012 consent order,

18 Facebook “repeatedly used deceptive disclosures and settings to undermine users’ privacy

19

20

21 43
Id.
22 44
T. Romm & C. Timberg, “FTC opens investigation into Facebook after Cambridge Analytica
scrapes millions of users’ personal information,” Washington Post (Mar. 20, 2018), available at
23
[Link]
24 facebook-after-cambridge-analytica-scrapes-millions-of-users-personal-information/ (last accessed
Jan. 19, 2026).
25 45
Federal Trade Commission, “FTC Imposes $5 Billion Penalty and Sweeping New Privacy
26 Restrictions on Facebook: FTC settlement imposes historic penalty, and significant requirements to
boost accountability and transparency” (July 24, 2019), available at [Link]
27 events/news/press-releases/2019/07/ftc-imposes-5-billion-penalty-sweeping-new-privacy-
restrictions-facebook (last accessed Jan. 19, 2026).
28 46
Id.
-19-
CLASS ACTION COMPLAINT – 26-cv-0751
 Case 3:26-cv-00751-LB Document 1 Filed 01/23/26 Page 22 of 51

1 preferences” and “share[d] users’ personal information with third party-apps that were downloaded

2 by the users’ Facebook ‘friends.’”47

3 52. In addition to requiring Facebook to pay $5 billion in fines, the 2019 announcement

4 required Facebook CEO Mark Zuckerberg (and others) to submit independently to the FTC quarterly

5 certifications that Facebook is compliant with the privacy program mandated by the order and

6 annual certifications that Facebook is in overall compliance with the order. Any false certifications

7 can subject the signatories to individual civil and criminal penalties. 48

8 53. Unfortunately, the FTC grossly overestimated the impact of the $5 billion fine and

9 strengthened reporting requirements on trillion-dollar Meta. Indeed, the value of Facebook’s stock

10 actually went up by 1% following the announcement of the $5 billion penalty; the market—like

11 Facebook—realized that “despite the penalty’s unprecedented size,” it was “still just a drop in the

12 ocean compared to the gigantic amount of cash Facebook regularly produces.” 49 Following the

13 announcement of the penalty, Facebook CEO Mark Zuckerberg’s shares increased in value by more

14 than $1 billion in just thirty minutes.50

15

16

17

18 47
Id.; United States v. Facebook, Inc., No. 19-cv-2184, ECF No. 1, Complaint for Civil Penalties,
19 Injunction, and Other Relief (D.D.C. July 24, 2019), available at
[Link]
20 [Link] (last accessed Jan. 19, 2026).
48
21 Federal Trade Commission, “FTC Imposes $5 Billion Penalty and Sweeping New Privacy
Restrictions on Facebook; FTC settlement imposes historic penalty, and significant requirements to
22 boost accountability and transparency” (July 24, 2019), available at [Link]
events/news/press-releases/2019/07/ftc-imposes-5-billion-penalty-sweeping-new-privacy-
23
restrictions-facebook (last accessed Jan. 19, 2026).
24 49 R. Price, “Why Facebook’s stock jumped despite facing a record-breaking $5 billion FTC
penalty: ‘A slap on the wrist,’” Business Insider (July 12, 2019), available at
25
[Link]
26 2019-7 (last accessed Jan. 19, 2026).
50
B. Gilbert, “Mark Zuckerberg actually got $1 billion richer following the news of Facebook’s
27 $5 billion fine for the biggest scandal in the company’s history,” Business Insider (July 15, 2019),

28 available at [Link]
billion-facebook-fine-2019-7 (last accessed Jan. 19, 2026).
-20-
CLASS ACTION COMPLAINT – 26-cv-0751
 Case 3:26-cv-00751-LB Document 1 Filed 01/23/26 Page 23 of 51

1 54. Although the FTC claimed the $5 billion penalty was “designed . . . to change

2 Facebook’s entire privacy culture to decrease the likelihood of continued violations,” 51 as the facts

3 alleged in this Complaint show, Meta has not only failed to “change [its] entire privacy culture,” but

4 has continued full speed ahead and business-as-usual in both its violations of its users’ privacy and

5 its misleading claims to the public regarding privacy.

6 55. Indeed, in May 2023, the FTC charged Meta with violations of the 2020 order that

7 was entered at the conclusion of the 2019 proceedings, alleging (among other things) that Meta had

8 “misled parents about their ability to control with whom their children communicated through its

9 Messenger Kids app” and “misrepresented the access it provided some app developers to private

10 user data.”52 Once again, the FTC expressed its dismay with Meta’s behavior, with the Director of

11 the FTC’s Bureau of Consumer Protection stating, “Facebook has repeatedly violated its privacy

12 promises. . . . The company’s recklessness has put young users at risk, and Facebook needs to answer

13 for its failures.”53 These proceedings against Meta are ongoing.

14 56. The SEC also fined then-Facebook $100 million for misleading the public regarding

15 the Cambridge Analytica scandal. 54 For more than two years, Facebook knew Cambridge Analytica

16 had actually used tens of millions of Facebook users’ data, but misrepresented the risk of misuse of

17 user data as a purely hypothetical occurrence in its communications to investors (and, by extension,

18

19

20 51
Federal Trade Commission, “FTC Imposes $5 Billion Penalty and Sweeping New Privacy
Restrictions on Facebook; FTC settlement imposes historic penalty, and significant requirements to
21
boost accountability and transparency” (July 24, 2019), available at [Link]
22 events/news/press-releases/2019/07/ftc-imposes-5-billion-penalty-sweeping-new-privacy-
restrictions-facebook (last accessed Jan. 19, 2026).
23 52
Federal Trade Commission, “FTC Proposes Blanket Prohibition Preventing Facebook from
24 Monetizing Youth Data: FTC says that the company violated 2020 privacy order; proposes new
protections for children and teens” (May 3, 2023), available at [Link]
25 events/news/press-releases/2023/05/ftc-proposes-blanket-prohibition-preventing-facebook-
monetizing-youth-data (last accessed Jan. 19, 2026).
26 53
Id.
27 54 Securities & Exchange Commission, “Facebook to Pay $100 Million for Misleading Investors

28 About the Risks It Faced From Misuse of User Data” (July 24, 2019), available at
[Link] (last accessed Jan. 19, 2026).
-21-
CLASS ACTION COMPLAINT – 26-cv-0751
 Case 3:26-cv-00751-LB Document 1 Filed 01/23/26 Page 24 of 51

1 the public generally).55 The SEC noted “Facebook exacerbated its disclosure failures when it misled

2 reporters who asked the company about its investigation into Cambridge Analytica.” 56

3 57. Meta’s disregard for user privacy has also resulted in European regulators imposing

4 penalties against it totaling billions of dollars for its repeated violation of the General Data

5 Protection Regulation (“GDPR”). For example, in November 2022, the Irish Data Protection

6 Commission fined Meta €265 million for a massive data leak in 2021 that resulted in the data—

7 including mobile numbers, Facebook IDs, names, genders, locations, relationship statuses,

8 occupations, dates of birth, and email addresses—of 533 million Facebook users in 106 countries

9 worldwide appearing in a public hacking forum. 57 In addition to drawing the ire and penalties of

10 regulators, Meta’s initial decision not to notify impacted users individually was roundly condemned

11 by security experts because the data could be used for targeted phishing attacks and identity theft. 58

12 58. In January 2023, the Irish Data Protection Commission fined Meta €390 million for

13 improperly processing user data for advertising targeting purposes in violation of the GDPR. 59

14 59. Then, on May 22, 2023, the Irish Data Protection Commission, acting on findings by

15 the European Data Protection Board, imposed the largest GDPR fine ever issued—€1.2 billion—on

16

17

18

19 55
Id.
56
Id.
20 57
An Coimisiún um Chosaint Sonraí (Irish Data Protection Commission), “Data Protection
21 Commission announces decision in Facebook ‘Data Scraping’ Inquiry” (Nov. 28, 2022), available
at [Link]
22 announces-decision-in-facebook-data-scraping-inquiry#Meta (last accessed Jan. 19, 2026); E.
Bowman, “After Data Breach Exposes 530 Million, Facebook Says It Will Not Notify Users,” NPR
23
(Apr. 9, 2021), available at [Link]
24 exposes-530-million-facebook-says-it-will-not-notify-users (last accessed Jan. 19, 2026).
58
Id.; Sec. Mag., “Facebook breach exposes 533 million users” (Apr. 6, 2021), available at
25
[Link]
26 (last accessed Jan. 19, 2026).
59
An Coimisiún um Chosaint Sonraí (Irish Data Protection Commission), “Data Protection
27 Commission announces conclusion of two inquiries into Meta Ireland” (Jan. 4, 2023), available at

28 [Link]
two-inquiries-meta-ireland#Meta (last accessed Jan. 19, 2026).
-22-
CLASS ACTION COMPLAINT – 26-cv-0751
 Case 3:26-cv-00751-LB Document 1 Filed 01/23/26 Page 25 of 51

1 Meta’s Irish subsidiary for “systematic, repetitive and continuous” illegal transfers of the personal

2 data of millions of European users to the United States. 60

3 60. On September 27, 2024, the Irish Data Protection Commission fined Meta €91

4 million for storing user passwords in plain text without encryption or other protective measures.61

5 As the Data Protection Deputy Commissioner noted, “It is widely accepted that user passwords

6 should not be stored in plaintext, considering the risks of abuse that arise from persons accessing

7 such data. It must be borne in mind, that the passwords the subject of consideration in this case, are

8 particularly sensitive, as they would enable access to users’ social media accounts.” 62 Notably,

9 although the violation was self-reported by Meta in 2019, regulators reprimanded Meta’s Irish

10 subsidiary for failing to report and document the violation appropriately. 63 According to one

11 Facebook source, between 200 million and 600 million users’ account passwords were plaintext

12 searchable by more than 20,000 Facebook employees, and some 2,000 engineers and developers

13 made approximately nine million internal queries for data elements that contained plain text user

14 passwords during the time the passwords were mishandled. 64

15 61. Yet again, on December 17, 2024, the Irish Data Protection Commission imposed an

16 additional €251 million fine on Meta for a 2018 data breach compromising data including the full

17 names, email addresses, phone numbers, locations, places of work, dates of birth, religions, genders,

18 timeline posts, group memberships, and children’s personal data of approximately 29 million users,

19

20
60
European Data Protection Board, “1.2 billion euro fine for Facebook as a result of EDPB binding
21 decision” (May 22, 2023), available at [Link]
euro-fine-facebook-result-edpb-binding-decision_en (last accessed Jan. 19, 2026).
22
61
An Coimisiún um Chosaint Sonraí (Irish Data Protection Commission), “Irish Data Protection
23 Commission fines Meta €91 million” (Sept. 27, 2024), available at
[Link]
24 Meta#Meta (last accessed Jan. 19, 2026).
62
25 Id.
63
26 Id.
64
B. Krebs, “Facebook Stored Hundreds of Millions of User Passwords in Plain Text for Years”
27 (Mar. 21, 2019), Krebs on Security, available at [Link]

28 stored-hundreds-of-millions-of-user-passwords-in-plain-text-for-years/ (last accessed Jan. 19,

2026).
-23-
CLASS ACTION COMPLAINT – 26-cv-0751
 Case 3:26-cv-00751-LB Document 1 Filed 01/23/26 Page 26 of 51

1 including three million users in Europe. 65 Once again, the Data Protection Commission reprimanded

2 Meta for failing to document and make a full disclosure to the Commission regarding the breach. 66

3 The Deputy Commission noted the severity and dangers of the breach: “[F]ailure to build in data

4 protection requirements . . . can expose individuals to very serious risks and harms, including a risk

5 to the fundamental rights and freedoms of individuals. Facebook profiles can, and often do, contain

6 information about matters such as religious or political beliefs, sexual life or orientation, and similar

7 matters that a user may wish to disclose only in particular circumstances.” 67

8 62. These examples of regulatory penalties are merely representative and not exhaustive

9 (even for Europe/Ireland). Yet they reveal a pattern of misconduct: Meta violates or disregards user

10 privacy, fails to disclose or document the full extent of the problem, receives its “punishment” from

11 regulators in the form of fines that—even at hundreds of millions of dollars or euros—barely register

12 on Meta’s balance sheet. Then, Meta continues violating users’ privacy—business as usual.

13 63. Aside from privacy violations, on May 18, 2017, European regulators also fined

14 then-Facebook for providing “incorrect or misleading information” during European review of

15 Facebook’s acquisition of WhatsApp in 2014.68 Specifically, Facebook assured regulators that any

16 technical integration of Facebook and WhatsApp users’ accounts could not be accomplished

17 reliably.69 Yet in 2016, when WhatsApp announced changes to its Terms of Service and Privacy

18 Policy, it expressly included the possibility of linking WhatsApp users’ phone numbers with

19 Facebook user identities—precisely what Facebook had assured European regulators it could not

20

21

22 65
An Coimisiún um Chosaint Sonraí (Irish Data Protection Commission), “Irish Data Protection
23 Commission fines Meta €251 million” (Dec. 17, 2024), available at
[Link]
24 fines-meta-eu251-million (last accessed Jan. 19, 2026).
66
25 Id.
67
Id.
26 68
European Commission, “Mergers: Commission fines Facebook €110 million for providing
27 misleading information about WhatsApp takeover” (May 17, 2017), available at
[Link] (last accessed Jan. 19, 2026).
28 69
Id.
-24-
CLASS ACTION COMPLAINT – 26-cv-0751
 Case 3:26-cv-00751-LB Document 1 Filed 01/23/26 Page 27 of 51

1 do.70 Although the European Commission did not take steps to unwind the long-closed merger, it

2 fined Facebook, finding that contrary to Facebook’s statements to regulators during the merger

3 review process, “the technical possibility of automatically matching Facebook and WhatsApp users’

4 identities already existed in 2014, and that Facebook staff were aware of such a possibility.”71

5 Accordingly, Meta’s and WhatsApp’s false claims they cannot access WhatsApp users’ encrypted

6 communications are not the first time Meta has misrepresented its technical capabilities with respect

7 to WhatsApp users’ data to get what it wanted.

8 64. At the same time regulators have been reprimanding and fining Meta for its repeated

9 privacy violations and failures to safeguard users’ information, Meta has downsized several of the

10 very business units charged with user protection. For example, Meta recently laid off more than 100

11 people in its risk review organization, which includes the employees responsible for making sure

12 Meta’s platforms comply with its obligations under the FTC consent order and privacy requirements

13 imposed by regulatory bodies worldwide. 72 Meta employees described the layoffs “as a ‘gutting’ of

14 the workers in the department who review projects at Meta for privacy and integrity risks.” 73

15 According to Meta insiders, “Meta executives have become frustrated with the pace of product

16 development,” and “[o]ne division holding things up—by design—was the company’s risk

17 organization.”74 Although Meta claims the layoffs reflect a transition to automated processes that

18 will be superior to manual review, “[c]urrent and former employees in the risk organization said

19 they were skeptical that replacing [the laid-off employees] with automated systems would be as

20 effective, particularly around issues as sensitive as user privacy.” 75

21

22
70
Id.
23 71
Id.
24 72
M. Isaac & E. Tan, “Meta Layoffs Included Employees Who Monitored Risks to User Privacy,”
25 New York Times (Oct. 23, 2025), available at
[Link] (last accessed
26 Jan. 19, 2026).
73
Id.
27
74
Id.
28 75
Id.
-25-
CLASS ACTION COMPLAINT – 26-cv-0751
 Case 3:26-cv-00751-LB Document 1 Filed 01/23/26 Page 28 of 51

1 65. Meta also has a prolific track record of deceiving the public. In addition to its

2 concealment of the Cambridge Analytica scandal and its repeated censure by European regulators

3 for its privacy and disclosure failures, Meta has come under fire for its concealment and

4 misrepresentation of information regarding risks posed by its platforms. As but one example, former

5 Facebook employee and whistleblower Frances Haugen’s 2021 disclosure of “The Facebook

6 Papers” revealed that Meta had conducted internal research regarding the negative impact of

7 Instagram on teenage mental health (concluding, for example, that “[w]e [Facebook-owned

8 Instagram] make body image issues worse for one in three teen girls”), yet concealed these findings

9 from regulators and the public while downplaying these risks to the public. 76 Meta reportedly

10 abandoned a research project into the effects of a Facebook/Instagram hiatus after data suggested

11 users benefited. One Meta employee warned Meta’s concealment of its research findings could be

12 likened to the tobacco industry’s concealment of negative research findings relating to the dangers

13 of cigarettes.77

14 66. According to filings in a recent multi-district litigation against Meta by parents,

15 children, school districts, and state attorneys general, Meta “was aware that millions of adult

16 strangers were contacting minors on its sites; that its products exacerbated mental health issues in

17 teens; and that content related to eating disorders, suicide, and child sexual abuse was frequently

18 detected, yet rarely removed,” but Meta failed to disclose these dangers to the public or to

19 Congress.78 In fact, when the Senate Judiciary Committee asked Meta in written questions in

20

21
76
S. Ramachandran, “Whistleblower’s testimony has resurfaced Facebook’s Instagram problem,”
22 NPR (Oct. 5, 2021), available at [Link]
testimony-facebook-instagram (last accessed Jan. 19, 2026); J. Wakefield, “Facebook under fire
23
over secret teen research,” BBC (Sept. 15, 2021), available at
24 [Link] (last accessed Jan. 19, 2026); C. Duffy, “Lawsuit
alleges social media giants buried their own research on teen mental health harms,” CNN (Nov. 26,
25 2025), available at [Link]
lawsuit-meta-tiktok-snap-youtube (last accessed Jan. 19, 2026).
26 77
Id.
27 78 C. Alter, “Court Filings Allege Meta Downplayed Risks to Children and Misled the Public,”

28 Time (Nov. 22, 2025), available at [Link] (last

accessed Jan. 19, 2026).
-26-
CLASS ACTION COMPLAINT – 26-cv-0751
 Case 3:26-cv-00751-LB Document 1 Filed 01/23/26 Page 29 of 51

1 December 2020 whether it could “determine whether increased use of its platform among teenage

2 girls has any correlation with increased signs of depression” and “increased signs of anxiety,” the

3 company answered simply “No.”79

4 67. On November 14, 2023, a bipartisan group of United States Senators sent a letter to

5 Meta CEO Mark Zuckerberg accusing Meta of misleading Congress. 80 According to these Senators,

6 “Meta’s representations to the public and in response to Congressional inquiries concealed and

7 misrepresented its extensive knowledge about the threats to young people on its platforms.” 81 They

8 also stated: “Members of Congress have repeatedly asked Meta for information on its awareness of

9 threats to young people on its platforms and the measures that it has taken, only to be stonewalled

10 and provided non-responsive or misleading information. . . . Rather than act on these stunning

11 findings, Meta hid this information from the public and Congressional oversight while providing

12 misleading statistics, ignoring recommendations to protect teens, and even rolling back safety

13 tools.”82 That Meta is misleading the public, the U.S. Congress, and regulators worldwide regarding

14 the extensive evidence of the risks its platforms pose to teens is consistent with what one

15 whistleblower described as Meta’s fostered culture of “see no evil, hear no evil.” 83

16 68. Meta’s documented misrepresentations are not limited to risks to youth posed by its

17 platforms. Meta has also recently come under fire for misrepresenting its activities in China and

18

19
79
20 Id.
80
Office of Senator Dick Durbin (R.-Ill.), “Durbin, Blumenthal, Bipartisan Group of Senators
21
Demand Documents from Mark Zuckerberg After Newly Unsealed Court Filing Alleges Meta Hid
22 Evidence of Harms to Kids: Newly unsealed disclosures suggest Meta executives’ direct knowledge
of the harms of its product & concealment from Congress and the public, supporting whistleblower
23 Arturo Béjar’s testimony to the Senate Judiciary Committee” (Nov. 15, 2023), available at
[Link]
24 senators-demand-documents-from-mark-zuckerberg-after-newly-unsealed-court-filing-alleges-
25 meta-hid-evidence-of-harms-to-kids (last accessed Jan. 19, 2026).
81
Id.
26 82
Id.
27 83
D. Kerr, “Meta failed to address harm to teens, whistleblower testifies as senators vow action,”
28 NPR (Nov. 7, 2023), available at [Link]
address-harm-to-teens-whistleblower-testifies-as-senators-vow-act (last accessed Jan. 19, 2026).
-27-
CLASS ACTION COMPLAINT – 26-cv-0751
 Case 3:26-cv-00751-LB Document 1 Filed 01/23/26 Page 30 of 51

1 sharing certain user data with the Chinese Communist Party following the release of former Meta

2 employee Sarah Wynn-Williams’ best-selling, revealing memoir, Careless People.84

3 69. As one Republican U.S. Senator said of Mark Zuckerberg’s testimony over the

4 course of multiple Congressional hearings, “[e]very time it’s a different answer. Every time it’s a

5 different façade. . . . But every time the one consistent through-line is every time it’s something

6 misleading. Every time is something other than the truth.” 85

7 70. The pattern is clear: Meta consistently prioritizes profit over the privacy and safety

8 of its users and is willing to lie to achieve its priorities. Because even record-breaking fines imposed

9 by regulators are essentially rounding errors to Meta’s bottom line, Meta’s conduct continues

10 undeterred and unabated, as evidenced by Meta’s brazen willingness to mislead WhatsApp users

11 regarding its and WhatsApp’s ability to access users’ encrypted communications.

12 CLASS ACTION ALLEGATIONS

13 71. Class: Plaintiffs seek to represent the following Class of similarly situated

14 individuals defined as follows:

15 All WhatsApp users, excluding residents of the United States,

Canada, Andorra, Austria, Azores, Belgium, Bulgaria, Canary
16 Islands, Channel Islands, Croatia, Czech Republic, Denmark, Estonia,
Finland, France, French Guiana, Germany, Gibraltar, Greece,
17 Guadeloupe, Hungary, Iceland, Ireland, Isle of Man, Italy, Latvia,
Liechtenstein, Lithuania, Luxembourg, Madeira, Malta, Martinique,
18 Mayotte, Monaco, Netherlands, Norway, Poland, Portugal, Republic
of Cyprus, Réunion, Romania, San Marino, Saint-Martin, Slovakia,
19 Slovenia, Spain, Sweden, Switzerland, the United Kingdom, United
Kingdom sovereign bases in Cyprus (Akrotiri and Dhekelia), and
20 Vatican City, who between April 5, 2016 and the present sent or
received any communications via WhatsApp.
21
72. Excluded from the Class are Defendants, any affiliate, parent, or subsidiary of
22
Defendants; any entity in which any Defendant has a controlling interest; any officer, director, or
23
employee of any Defendant; any successor or assign of any Defendant; anyone employed by counsel
24

25
84
26 K. Collier, “Senators vow to continue probe of Meta over its China record after ex-employee
testifies,” NBC News (Apr. 9, 2025), available at [Link]
27 media/facebook-meta-whistleblower-senate-video-book-careless-people-rcna200517 (last accessed
Jan. 19, 2026).
28 85
Id.
-28-
CLASS ACTION COMPLAINT – 26-cv-0751
 Case 3:26-cv-00751-LB Document 1 Filed 01/23/26 Page 31 of 51

1 in this action; any judge to whom this case is assigned, his or her spouse and immediate family

2 members; and members of the judge’s staff.

3 73. Numerosity (Rule 23(a)(1)): Members of the Class are so numerous that joinder of

4 all members would be unfeasible and not practicable. The exact number of members of the Class is

5 unknown to Plaintiffs at this time. However, it is estimated that there are at least three billion

6 individual members of the class. The identity of such membership is readily ascertainable from

7 Defendants’ records, including from Meta’s and WhatsApp’s records of WhatsApp account holders.

8 74. Typicality (Rule 23(a)(3)): Plaintiffs’ claims are typical of the claims of the Class.

9 Plaintiffs, like all Class Members, each have used WhatsApp on one or more occasions between

10 April 5, 2016 and the present, and had their private encrypted communications subjected to access

11 by WhatsApp and Meta.

12 75. Adequacy (Rule 23(a)(4)): Plaintiffs are fully prepared to take all necessary steps to

13 represent fairly and adequately the interests of the Class. Plaintiffs’ interests are coincident with,

14 and not antagonistic to, those of other Class Members. Plaintiffs are represented by attorneys with

15 experience in the prosecution of class action litigation generally and in the field of digital privacy

16 litigation specifically. Plaintiffs’ attorneys are committed to vigorously prosecuting this action on

17 behalf of all Class Members.

18 76. Commonality (Rule 23(a)(2)): Questions of law and fact are common to the members

19 of the Class because Defendants have acted on grounds generally applicable to the Class. Such

20 generally applicable conduct is inherent in Defendants’ wrongful conduct. Questions of law and fact

21 common to the Class include, inter alia:

22  Whether Defendants intercepted users’ WhatsApp communications;

23  Whether Defendants’ interception of users’ WhatsApp communications was
24 intentional;

25  Whether Defendants’ interception of users’ WhatsApp communications occurred

26 while those communications were in transit;

27  Whether Defendants store users’ WhatsApp communications;

28

-29-
CLASS ACTION COMPLAINT – 26-cv-0751
 Case 3:26-cv-00751-LB Document 1 Filed 01/23/26 Page 32 of 51

1  Whether Defendants’ interception and storage of users’ WhatsApp communications

2 was contrary to its privacy promises;

3  Whether Defendants can access the contents of users’ WhatsApp communications;

4  Whether Defendants used the contents of users’ WhatsApp communications;
5  Whether Plaintiffs and Class Members had a reasonable expectation of privacy in
6 their WhatsApp communications;

7  Whether Defendants’ interception and storage of users’ WhatsApp communications

8 was highly offensive to a reasonable person;

9  Whether Defendants’ interception and storage of users’ WhatsApp communications

10 was unfair;

11  Whether and to what extent Defendants were unjustly enriched through their
12 unlawful conduct;

13  Whether Plaintiffs and Class Members are entitled to declaratory and/or injunctive
14 relief to enjoin the unlawful conduct alleged herein.

15 77. Predominance & Superiority (Rule 23(b)(3)): In addition to satisfying the

16 prerequisites of Rule 23(a), Plaintiffs satisfy the requirements for maintaining a class action under

17 Rule 23(b)(3). Common questions of law and fact predominate over any questions affecting only

18 individual Class Members, and a class action is superior to individual litigation and all other

19 available methods for the fair and efficient adjudication of this controversy. The amount of damages

20 available to individual Plaintiffs is insufficient to make litigation addressing Defendants’ conduct

21 economically feasible in the absence of the class action procedure. Individualized litigation also

22 presents a potential for inconsistent or contradictory judgments, and increases the delay and expense

23 presented by the complex legal and factual issues of the case to all parties and court systems around

24 the world. By contrast, the class action device presents far fewer management difficulties and

25 provides the benefits of a single adjudication, economy of scale, and comprehensive supervision by

26 a single court.

27

28

-30-
CLASS ACTION COMPLAINT – 26-cv-0751
 Case 3:26-cv-00751-LB Document 1 Filed 01/23/26 Page 33 of 51

1 78. Injunctive Relief (Rule 23(b)(2)): Defendants have acted on grounds that apply

2 generally to the Class as a whole, such that class certification, injunctive relief, and declaratory relief

3 are appropriate on a class-wide basis.

4 CAUSES OF ACTION

5 FIRST CAUSE OF ACTION

6 Violation of the Wiretap Act: Unauthorized Interception of Electronic Communications

18 U.S.C. § 2510, et seq.
7
79. Plaintiffs hereby incorporate all other paragraphs as if fully stated herein.
8
80. The Federal Wiretap Act, as amended by the Electronic Communications Privacy
9
Act, prohibits the intentional interception of the contents of any wire, oral, or electronic
10
communication through the use of a device. 18 U.S.C. §§ 2510, 2511.
11
81. The Wiretap Act protects both the sending and receipt of communications.
12
82. 18 U.S.C. § 2520(a) provides a private right of action to any person whose wire, oral,
13
or electronic communication is intercepted.
14
83. Defendants intentionally intercepted the electronic communications of Plaintiffs and
15
other WhatsApp users by intercepting their WhatsApp messages. On information and belief,
16
Defendants are aware that they are intercepting WhatsApp messages and have taken no remedial
17
action.
18
84. The transmission of WhatsApp messages between Plaintiffs and other WhatsApp
19
users were “transfer[s] of signs, signals, writing, images, sounds, data, or intelligence . . . transmitted
20
in whole or in part by a wire, radio, electromagnetic, photoelectronic or photooptical system that
21
affects interstate or foreign commerce[,]” and are therefore “electronic communications” within the
22
meaning of 18 U.S.C. § 2510(12).
23
85. Defendants’ interception of Plaintiffs’ communications was done
24
contemporaneously with the Plaintiffs’ sending and receipt of those communications. On
25
information and belief, Plaintiffs’ and other WhatsApp users’ WhatsApp messages were intercepted
26
by Defendants essentially in real time, as soon as they were sent.
27

28

-31-
CLASS ACTION COMPLAINT – 26-cv-0751
 Case 3:26-cv-00751-LB Document 1 Filed 01/23/26 Page 34 of 51

1 86. The intercepted communications include substantially all WhatsApp messages for

2 substantially all WhatsApp users.

3 87. The following constitute “devices” within the meaning of 18 U.S.C. § 2510(5):

4 a. Plaintiffs’ and Class Members’ electronic devices on which the WhatsApp

5 application was installed;

6 b. The WhatsApp application;

7 c. Defendants’ web servers;

8 d. The computer code deployed by Defendants to effectuate their interception

9 of Plaintiffs’ and Class Members’ WhatsApp messages.

10 88. Defendants are not parties to Plaintiffs’ communications with other WhatsApp users.

11 89. Defendants received the “contents” of Plaintiffs’ electronic communications with

12 other WhatsApp users because they received the full text of Plaintiffs’ WhatsApp messages, which

13 constitute the “substance, purport or meaning of th[ose] communication[s]” within the meaning of

14 18 U.S.C. § 2510(8).

15 90. Defendants’ interception of Plaintiffs’ WhatsApp messages occurred in the United

16 States.

17 91. Plaintiffs did not consent to Defendants’ acquisition of the contents of their

18 WhatsApp messages with other WhatsApp users. For example, WhatsApp expressly promised in its

19 Privacy Policy that “[w]e offer end-to-end encryption for our Services[,]” which “means that your

20 messages are encrypted to protect against us and third parties from reading them.” 86 It also claimed

21 on its website that “all your personal messages stay between you and who you send them to—no

22 one else, not even WhatsApp (or Meta), can read, listen to, or share them.” 87

23 92. The surreptitious interception of Plaintiffs’ WhatsApp messages was not done in the

24 “ordinary course” of Defendants’ business within the meaning of 18 U.S.C. § 2510(5)(a). As

25

26
86
27 WhatsApp, “WhatsApp Privacy Policy” (effective Jan. 4, 2021), available at
[Link] (last accessed Jan. 19, 2026).
28 87 WhatsApp, “Does WhatsApp collect or sell your data?”, available at
[Link] (last accessed Jan. 19, 2026).
-32-
CLASS ACTION COMPLAINT – 26-cv-0751
 Case 3:26-cv-00751-LB Document 1 Filed 01/23/26 Page 35 of 51

1 explained, this interception was directly contrary to Defendants’ representations about their

2 treatment of WhatsApp users’ messages.

3 93. The surreptitious interception of Plaintiffs’ WhatsApp messages was not done in the

4 “normal course” of Defendants’ officers’, employees’, or agents’ employment, was not a “necessary

5 incident to the rendition” of WhatsApp’s electronic communications service, and was not done for

6 the purpose of “mechanical or service quality control checks” within the meaning of 18 U.S.C.

7 § 2511(2)(a)(i). Defendants’ interceptions are contrary to their representations about their treatment

8 of WhatsApp users’ messages, are for their own benefit, and are unrelated to providing WhatsApp

9 users with the ability to send and receive WhatsApp messages.

10 94. The surreptitious interception of Plaintiffs’ WhatsApp messages was not done for

11 “the protection of the rights or property” of Defendants within the meaning of 18 U.S.C.

12 § 2511(2)(a)(i).

13 95. As a result of the above actions and pursuant to 18 U.S.C. § 2520(b), the Court may

14 provide injunctive and declaratory relief; assess as damages the greater of the sum of the actual

15 damages suffered by Plaintiffs and any profits made by Defendants as a result of the violation, or

16 statutory damages of whichever is the greater of $100 a day for each day of violation or $10,000;

17 punitive damages in an amount to be determined by a jury, but sufficient to prevent the same or

18 similar conduct by Defendants in the future; and reasonable attorneys’ fees and other litigation costs

19 reasonably incurred.

20 SECOND CAUSE OF ACTION

21 Violation of the California Comprehensive Computer Data Access and Fraud Act
Cal. Penal Code § 502, et seq.
22
96. Plaintiffs hereby incorporate all other paragraphs as if fully stated herein.
23
97. Cal. Penal Code § 502(j) provides: “For purposes of bringing a civil or a criminal
24
action under this section, a person who causes, by any means, the access of a computer, computer
25
system, or computer network in one jurisdiction from another jurisdiction is deemed to have
26
personally accessed the computer, computer system, or computer network in each jurisdiction.”
27

28

-33-
CLASS ACTION COMPLAINT – 26-cv-0751
 Case 3:26-cv-00751-LB Document 1 Filed 01/23/26 Page 36 of 51

1 Smart phone devices with the capability of using web browsers are “computers” within the meaning

2 of the statute.

3 98. Defendants violated Cal. Penal Code § 502(c)(1) by knowingly and without

4 permission accessing and using Plaintiffs’ and Class Members’ private WhatsApp messages in order

5 to execute a scheme to deceive or defraud consumers by claiming that Defendants cannot read and

6 do not store users’ WhatsApp messages, when in fact Defendants have intercepted and made copies

7 of substantially all WhatsApp users’ private messages.

8 99. Defendants violated Cal. Penal Code § 502(c)(2) by knowingly accessing and

9 without permission taking, copying, and using Plaintiffs’ and the Class Members’ private WhatsApp

10 messages.

11 100. Defendants violated Cal. Penal Code § 502(c)(6) by knowingly and without

12 permission providing, or assisting in providing, a means of accessing Plaintiffs’ and Class Members’

13 computer systems and/or computer networks.

14 101. Defendants violated Cal. Penal Code § 502(c)(7) by knowingly and without

15 permission accessing, or causing to be accessed, Plaintiffs’ and Class Members’ computer systems

16 and/or computer networks.

17 102. Pursuant to Cal. Penal Code § 502(b)(12) a “Computer contaminant” is defined as

18 “any set of computer instructions that are designed to . . . record, or transmit information within a

19 computer, computer system, or computer network without the intent or permission of the owner of

20 the information.”

21 103. Defendants violated Cal. Penal Code § 502(c)(8) by knowingly introducing a

22 computer contaminant into Plaintiffs’ and the Class Members’ mobile devices; specifically, the code

23 used in the WhatsApp application that Defendants deployed to effectuate their interception, copying,

24 and storage of Plaintiffs’ and the Class Members’ WhatsApp messages.

25 104. Defendants accessed, copied, took, analyzed, and used data from Plaintiffs’ and

26 Class Members’ computers in and from the State of California, where Defendants: (1) have their

27 principal place of business; (2) used servers that provided communication links between Plaintiffs’

28 and Class Members’ computers and Defendants, which allowed Defendants to access and obtain

-34-
CLASS ACTION COMPLAINT – 26-cv-0751
 Case 3:26-cv-00751-LB Document 1 Filed 01/23/26 Page 37 of 51

1 Plaintiffs’ and Class Members’ data; and (3) designed and contrived their scheme to deploy

2 computer code to effectuate their interception of Plaintiffs’ WhatsApp messages. Accordingly,

3 Defendants caused the access of Plaintiffs’ and Class Members’ computers from California, and are

4 therefore deemed to have accessed Plaintiffs’ and Class Members’ computers in California. In

5 addition, Defendants have adopted California substantive law to govern their relationship with

6 WhatsApp users.

7 105. As a direct and proximate result of Defendants’ unlawful conduct under California

8 Penal Code § 502, Defendants have caused loss to Plaintiffs and Class Members and have been

9 unjustly enriched in an amount to be proven at trial. Despite Defendants’ false representations to the

10 contrary, Defendants effectively charged Plaintiffs, Class Members, and other consumers, and

11 Defendants were unjustly enriched, by acquiring their sensitive, private, and valuable WhatsApp

12 messages without permission and using them for Defendants’ own commercial benefit.

13 106. Plaintiffs and the Class Members seek compensatory damages, in an amount to be

14 proven at trial, and declaratory or other equitable relief, pursuant to Cal. Penal Code § 502(e)(1).

15 107. Plaintiffs and the Class Members are entitled to punitive or exemplary damages

16 pursuant to Cal. Penal Code § 502(e)(4) because Defendants’ violations were willful and, upon

17 information and belief, Defendants are guilty of oppression, fraud, or malice as defined in Cal. Civil

18 Code § 3294.

19 108. Plaintiffs and the Class Members are also entitled to recover their reasonable

20 attorneys’ fees pursuant to California Penal Code § 502(e)(2).

21 THIRD CAUSE OF ACTION

22 Violation of the California Invasion of Privacy Act

Cal. Penal Code § 630, et seq.
23
109. Plaintiffs hereby incorporate all other paragraphs as if fully stated herein.
24
110. The California Invasion of Privacy Act (“CIPA”) is codified at Cal. Penal Code
25
§§ 630 to 638. The Act begins with its statement of purpose:
26
The Legislature hereby declares that advances in science and
27 technology have led to the development of new devices and
techniques for the purpose of eavesdropping upon private
28 communications and that the invasion of privacy resulting from the

-35-
CLASS ACTION COMPLAINT – 26-cv-0751
 Case 3:26-cv-00751-LB Document 1 Filed 01/23/26 Page 38 of 51

1 continual and increasing use of such devices and techniques has

created a serious threat to the free exercise of personal liberties and
2 cannot be tolerated in a free and civilized society.

3 Cal. Penal Code § 630.

4 111. California Penal Code § 631(a) provides, in pertinent part:

5 Any person who, by means of any machine, instrument, or

contrivance, or in any other manner, intentionally taps, or makes any
6 unauthorized connection, whether physically, electrically,
acoustically, inductively, or otherwise, with any telegraph or
7 telephone wire, line, cable, or instrument, including the wire, line,
cable, or instrument of any internal telephonic communication
8 system, or who willfully and without the consent of all parties to the
communication, or in any unauthorized manner, reads, or attempts to
9 read, or to learn the contents or meaning of any message, report, or
communication while the same is in transit or passing over any wire,
10 line, or cable, or is being sent from, or received at any place within
this state; or who uses, or attempts to use, in any manner, or for any
11 purpose, or to communicate in any way, any information so obtained,
or who aids, agrees with, employs, or conspires with any person or
12 persons to lawfully do, or permit, or cause to be done any of the acts
or things mentioned above in this section, is punishable by a fine not
13 exceeding two thousand five hundred dollars . . . .

14 112. California Penal Code § 632(a) provides, in pertinent part:

15 A person who, intentionally and without the consent of all parties to

a confidential communication, uses an electronic amplifying or
16 recording device to eavesdrop upon or record the confidential
communication, whether the communication is carried on among the
17 parties in the presence of one another or by means of a telegraph,
telephone, or other device, except a radio, shall be punished by a fine
18 not exceeding two thousand five hundred dollars . . . .

19 113. Under either section of the CIPA, a defendant must show it had the consent of all

20 parties to a communication.

21 114. Defendants have their principal place of business in California and designed and

22 contrived their scheme to deploy computer code to effectuate their interception of Plaintiffs’

23 WhatsApp messages in California. Defendants have adopted California substantive law to govern

24 their relationship with WhatsApp users.

25 115. At all relevant times, Defendants’ interception of the Plaintiffs’ and Class Members’

26 private WhatsApp messages was without authorization and consent from the Plaintiffs (and Class

27 Members). The interceptions by Defendants in the aforementioned circumstances were unlawful

28 and tortious.

-36-
CLASS ACTION COMPLAINT – 26-cv-0751
 Case 3:26-cv-00751-LB Document 1 Filed 01/23/26 Page 39 of 51

1 116. The following items constitute “machine[s], instrument[s], or contrivance[s]” under

2 the CIPA, and even if they do not, Defendants’ scheme that facilitated its interceptions falls under

3 the broad statutory catch-all category of “any other manner”:

4 a. Plaintiffs’ and Class Members’ electronic devices on which the WhatsApp

5 application was installed;

6 b. The WhatsApp application;

7 c. Defendants’ web servers;

8 d. The computer code deployed by Defendants to effectuate their interception

9 of Plaintiffs’ and Class Members’ WhatsApp messages.

10 117. Defendants tapped or made an unauthorized connection with Plaintiffs’ and Class

11 Members’ telephones through Defendants’ use of computer code within the WhatsApp application,

12 which secretly intercepted Plaintiffs’ and Class Members’ private WhatsApp messages. The

13 WhatsApp application requires that users enter a cellular telephone number in order to register to

14 use the application.

15 118. Defendants’ non-consensual interception of Plaintiffs’ and Class Members’

16 WhatsApp messages was designed to learn the contents of those communications, and occurred

17 while Plaintiffs’ and Class Members’ communications were in transit. Plaintiffs’ and Class

18 Members’ private WhatsApp messages were available for Defendants and their agents to read or

19 review essentially in real time.

20 119. The data collected by Defendants constituted “confidential communications,” as that

21 term is used in Section 632, because Plaintiffs and Class Members had objectively reasonable

22 expectations of privacy in their private WhatsApp messages. WhatsApp expressly promised in its

23 Privacy Policy that “[w]e offer end-to-end encryption for our Services[,]” which “means that your

24 messages are encrypted to protect against us and third parties from reading them.” 88 It also claimed

25

26

27
88
28 WhatsApp, “WhatsApp Privacy Policy” (effective Jan. 4, 2021), available at
[Link] (last accessed Jan. 19, 2026).
-37-
CLASS ACTION COMPLAINT – 26-cv-0751
 Case 3:26-cv-00751-LB Document 1 Filed 01/23/26 Page 40 of 51

1 on its website that “all your personal messages stay between you and who you send them to—no

2 one else, not even WhatsApp (or Meta), can read, listen to, or share them.” 89

3 120. Plaintiffs and Class Members have suffered loss by reason of these violations,

4 including, but not limited to, violation of their rights to privacy and loss of value in their personally

5 identifiable information.

6 121. Pursuant to California Penal Code § 637.2, Plaintiffs and Class Members have been

7 injured by the violations of California Penal Code §§ 631 and 632, and each seek damages for the

8 greater of $5,000 per violation or three times the amount of actual damages, as well as injunctive

9 relief.

10 FOURTH CAUSE OF ACTION

11 Invasion of Privacy
Cal. Constitution, Article 1, Section 1
12
122. Plaintiffs hereby incorporate all other paragraphs as if fully stated herein.
13
123. The right to privacy in California’s Constitution creates a right of action against
14
private entities such as Defendants.
15
124. Plaintiffs’ and Class Members’ expectation of privacy is deeply enshrined in
16
California’s Constitution. Article I, section 1 of the California Constitution provides: “All people
17
are by nature free and independent and have inalienable rights. Among these are enjoying and
18
defending life and liberty, acquiring, possessing, and protecting property, and pursuing and
19
obtaining safety, happiness, and privacy.”
20
125. The phrase “and privacy” was added in 1972 after voters approved a proposed
21
legislative constitutional amendment designated as Proposition 11. Critically, the argument in favor
22
of Proposition 11 reveals that the legislative intent was to curb businesses’ control over the
23
unauthorized collection and use of consumers’ personal information, stating:
24
The right of privacy is the right to be left alone… It prevents
25 government and business interests from collecting and stockpiling
unnecessary information about us and from misusing information
26 gathered for one purpose in order to serve other purposes or to
embarrass us. Fundamental to our privacy is the ability to control
27
89
28 WhatsApp, “Does WhatsApp collect or sell your data?”, available at
[Link] (last accessed Jan. 19, 2026).
-38-
CLASS ACTION COMPLAINT – 26-cv-0751
 Case 3:26-cv-00751-LB Document 1 Filed 01/23/26 Page 41 of 51

1 circulation of personal information. This is essential to social

relationships and personal freedom. 90
2
126. The principal purpose of this constitutional right was to protect against unnecessary
3
information gathering, use, and dissemination by public and private entities, including Defendants.
4
127. To plead a California constitutional privacy claim, a plaintiff must show (1) a legally
5
protected privacy interest; (2) a reasonable expectation of privacy under the circumstances; and (3)
6
conduct by the defendant constituting a serious invasion of privacy.
7
128. As described herein, Defendants have intruded upon the following legally protected
8
privacy interests:
9
a. The Federal Wiretap Act as alleged herein;
10
b. The California Invasion of Privacy Act as alleged herein;
11
c. The California Constitution, which guarantees the right to privacy;
12
d. WhatsApp’s Privacy Policy and policies referenced therein and other public
13
promises it made not to intercept or store the Plaintiffs’ and Class Members’
14
WhatsApp messages.
15
129. Plaintiffs and Class Members had a reasonable expectation of privacy under the
16
circumstances in that Plaintiffs and Class Members could not reasonably expect Defendants would
17
commit acts in violation of federal and state civil and criminal laws; and WhatsApp affirmatively
18
promised users (including Plaintiffs and Class Members) that their messages were end-to-end
19
encrypted, which “means that your messages are encrypted to protect against us and third parties
20
from reading them.”91 It also claimed on its website that “all your personal messages stay between
21
you and who you send them to—no one else, not even WhatsApp (or Meta), can read, listen to, or
22
share them.”92 WhatsApp’s website also asserted that WhatsApp “does not store messages once they
23

24

25 90
UC Law SF Scholarship Repository, 1972 “Right of Privacy” Ballot Proposition, available at
26 [Link] (last
accessed Jan. 19, 2026).
27 91 WhatsApp, “WhatsApp Privacy Policy” (effective Jan. 4, 2021), available at
[Link] (last accessed Jan. 19, 2026).
28 92 WhatsApp, Does WhatsApp collect or sell your data?, available at
[Link] (last accessed Jan. 19, 2026).
-39-
CLASS ACTION COMPLAINT – 26-cv-0751
 Case 3:26-cv-00751-LB Document 1 Filed 01/23/26 Page 42 of 51

1 are delivered” and that “undelivered messages are deleted from [its] servers after 30 days.” 93 In

2 reality, Defendants’ intercepted substantially all WhatsApp users’ private messages such that they

3 were available for Defendants’ review in real time, and stored those messages for an unlimited time.

4 130. Defendants’ actions constituted a serious invasion of privacy in that they:

5 a. Invaded the privacy of billions of WhatsApp users worldwide (including

6 Plaintiffs and Class Members) without their consent;

7 b. Violated federal and California state laws on wiretapping and invasion of

8 privacy, as set forth herein;

9 c. Constituted the unauthorized taking of valuable information from billions of

10 WhatsApp users worldwide through deceit; and

11 d. Further violated Plaintiffs’ and Class Members’ reasonable expectation of

12 privacy via Defendants’ storage, review, analysis, and subsequent uses of

13 Plaintiffs’ and Class Members’ private messages that Plaintiffs and Class

14 Members considered sensitive and confidential.

15 131. Committing criminal acts against billions of WhatsApp users worldwide constitutes

16 an egregious breach of social norms that is highly offensive.

17 132. The surreptitious and unauthorized interception and storage of the private messages

18 of billions of worldwide WhatsApp users, contrary to Defendants’ express promises that the

19 messages would not be stored or accessible to Defendants, constitutes an egregious breach of social

20 norms that is highly offensive.

21 133. Defendants’ intentional intrusion into Plaintiffs’ and Class Members’ private

22 messages and cellular telephones was highly offensive to a reasonable person. Defendants are well

23 aware that billions of users rely on their promises that WhatsApp messages are not stored or

24 accessible to anyone, including Defendants themselves, and that these promises induce users to

25 share their most sensitive and personal information on WhatsApp. Anyone who learned that

26

27
93
28 WhatsApp, “Information for Law Enforcement Authorities,” available at
[Link] (last accessed Jan. 19, 2026).
-40-
CLASS ACTION COMPLAINT – 26-cv-0751
 Case 3:26-cv-00751-LB Document 1 Filed 01/23/26 Page 43 of 51

1 Defendants’ promises are false, and that Defendants are in fact storing and accessing WhatsApp

2 users’ messages every day, would find Defendants’ conduct highly offensive.

3 134. Secret monitoring of private messages is highly offensive behavior, especially given

4 that Defendants expressly and falsely represent that no one—not even Defendants—can read users’

5 messages.

6 135. Wiretapping and surreptitious recording of communications is highly offensive

7 behavior.

8 136. Defendants lacked a legitimate business interest in intercepting and storing users’

9 private messages without their consent and contrary to Defendants’ privacy promises.

10 137. Plaintiffs and Class Members have been damaged by Defendants’ invasion of their

11 privacy and are entitled to just compensation and injunctive relief.

12 FIFTH CAUSE OF ACTION

13 Intrusion Upon Seclusion

14 138. Plaintiffs hereby incorporate all other paragraphs as if fully stated herein.

15 139. To state a claim for intrusion upon seclusion in California, a plaintiff must plead that

16 (1) the defendant intentionally intruded into a place, conversation, or matter as to which the plaintiff

17 has a reasonable expectation of privacy, and (2) the intrusion occurred in a manner highly offensive

18 to a reasonable person.

19 140. In carrying out their scheme to intercept and store Plaintiffs’ and Class Members’

20 private WhatsApp messages in violation of their own privacy promises, Defendants intentionally

21 intruded upon the Plaintiffs’ and Class Members’ solitude or seclusion in that they effectively placed

22 themselves in the middle of private conversations to which they were not authorized parties.

23 141. Plaintiffs and Class Members had a reasonable expectation of privacy under the

24 circumstances in that Plaintiffs and Class Members could not reasonably expect Defendants would

25 commit acts in violation of federal and state civil and criminal laws; and WhatsApp affirmatively

26 promised users (including Plaintiffs and Class Members) that their messages were end-to-end

27 encrypted, which “means that your messages are encrypted to protect against us and third parties

28

-41-
CLASS ACTION COMPLAINT – 26-cv-0751
 Case 3:26-cv-00751-LB Document 1 Filed 01/23/26 Page 44 of 51

1 from reading them.”94 It also claimed on its website that “all your personal messages stay between

2 you and who you send them to—no one else, not even WhatsApp (or Meta), can read, listen to, or

3 share them.”95 WhatsApp’s website also asserted that WhatsApp “does not store messages once they

4 are delivered” and that “undelivered messages are deleted from [its] servers after 30 days.” 96 In

5 reality, Defendants’ intercepted substantially all WhatsApp users’ private messages such that they

6 were available for Defendants’ review in real time, and stored those messages for an unlimited time.

7 142. Defendants’ interception and storage of Plaintiffs’ and Class Members’ WhatsApp

8 messages was not authorized by the Plaintiffs and Class Members or the WhatsApp users with whom

9 they were communicating.

10 143. The surreptitious and unauthorized interception and storage of the private messages

11 of billions of worldwide WhatsApp users constitutes an egregious breach of social norms that is

12 highly offensive.

13 144. Defendants’ intentional intrusion into Plaintiffs’ and Class Members’ private

14 messages and cellular telephones was highly offensive to a reasonable person. Defendants are well

15 aware that billions of users rely on their promises that WhatsApp messages are not stored or

16 accessible to anyone, including Defendants themselves, and that these promises induce users to

17 share their most sensitive and personal information on WhatsApp. Anyone who learned that

18 Defendants’ promises are false, and that Defendants are in fact storing and accessing WhatsApp

19 users’ messages every day, would find Defendants’ conduct highly offensive.

20 145. Secret monitoring of private messages is highly offensive behavior, especially given

21 that Defendants expressly and falsely represent that no one—not even Defendants—can read users’

22 messages.

23 146. Wiretapping and surreptitious recording of communications is highly offensive

24 behavior.

25
94
26 WhatsApp, “WhatsApp Privacy Policy” (effective Jan. 4, 2021), available at
[Link] (last accessed Jan. 19, 2026).
27 95 WhatsApp, Does WhatsApp collect or sell your data?, available at
[Link] (last accessed Jan. 19, 2026).
28 96 WhatsApp, “Information for Law Enforcement Authorities,” available at
[Link] (last accessed Jan. 19, 2026).
-42-
CLASS ACTION COMPLAINT – 26-cv-0751
 Case 3:26-cv-00751-LB Document 1 Filed 01/23/26 Page 45 of 51

1 147. Defendants lacked a legitimate business interest in intercepting and storing users’

2 private messages without their consent.

3 148. Plaintiffs and the Class Members have been damaged by Defendants’ invasion of

4 their privacy and are entitled to reasonable compensation, including but not limited to disgorgement

5 of profits related to the unlawful interception, use, and storage of their messages.

6 SIXTH CAUSE OF ACTION

7 Breach of Contract

8 149. Plaintiffs hereby incorporate all other paragraphs as if fully stated herein.

9 150. Defendants’ relationship with WhatsApp users is governed by the WhatsApp Terms

10 of Service, which incorporates the WhatsApp Privacy Policy.

11 151. The WhatsApp Privacy Policy asserts that “[r]espect for your privacy is coded into

12 our DNA. Since we started WhatsApp, we’ve built our services with a set of strong privacy

13 principles in mind.”97 It promises that “[w]e offer end-to-end encryption for our Services. End-to-

14 end encryption means that your messages are encrypted to protect against us and third parties from

15 reading them.”98

16 152. Defendants breached these promises; in fact, WhatsApp, Meta, and their agents have

17 access to and can read substantially all users’ private WhatsApp messages.

18 153. WhatsApp also promises in its Privacy Policy that “[w]e do not retain your messages

19 in the ordinary course of providing our Services to you. Instead, your messages are stored on your

20 device and not typically stored on our servers. Once your messages are delivered, they are deleted

21 from our servers.”99

22 154. Defendants breached these promises; in fact, Defendants stored substantially all

23 users’ private WhatsApp messages and could review them at any time.

24 155. Plaintiffs and Class Members performed their obligations under the relevant

25 contracts and are not in breach of any such obligations.

26
97
27 WhatsApp, “WhatsApp Privacy Policy” (effective Jan. 4, 2021), available at
[Link] (last accessed Jan. 19, 2026).
28 98 Id.
99
Id.
-43-
CLASS ACTION COMPLAINT – 26-cv-0751
 Case 3:26-cv-00751-LB Document 1 Filed 01/23/26 Page 46 of 51

1 156. As a result of Defendants’ breach(es), Defendants were able to obtain the personal

2 property of Plaintiffs and Class Members and earn unjust profits.

3 157. Plaintiffs and Class Members also did not receive the benefit of the bargain for which

4 they contracted and for which they provided valuable consideration in the form of their use of the

5 WhatsApp app, which has ascertainable value to be proven at trial, including but not limited to its

6 growth of the WhatsApp and broader Meta Companies user network.

7 158. Plaintiffs, on behalf of themselves and Class Members, seek compensatory damages,

8 consequential damages, and/or non-restitutionary disgorgement in an amount to be proven at trial,

9 and declarative, injunctive, or other equitable relief.

10 SEVENTH CAUSE OF ACTION

11 Breach of the Implied Covenant of Good Faith and Fair Dealing

12 159. Plaintiffs hereby incorporate all other paragraphs as if fully stated herein.

13 160. Every contract imposes upon each party a duty of good faith and fair dealing in its

14 performance and enforcement.

15 161. In dealings between Defendants and WhatsApp users, Defendants are invested with

16 discretionary power affecting the rights of WhatsApp users.

17 162. Defendants purport to respect and protect WhatsApp users’ privacy. For instance,

18 the WhatsApp Privacy Policy asserts that “[r]espect for your privacy is coded into our DNA.” Both

19 the WhatsApp Privacy Policy and WhatsApp Terms of Service state that “[s]ince we started

20 WhatsApp, we’ve built our services with a set of strong privacy principles in mind.”

21 163. Despite Defendants’ contractual privacy promises to keep WhatsApp users’

22 messages end-to-end encrypted such that Defendants and third parties could not read them, and its

23 promises not to store WhatsApp users’ messages, Defendants took actions outside those contractual

24 promises to deprive Plaintiffs and Class Members of the benefits of their contract with Defendants.

25 164. Defendants’ interception, storage, and use of WhatsApp users’ (including Plaintiffs’

26 and Class Members’) messages was objectively unreasonable given Defendants’ privacy promises,

27 and evaded the spirit of the bargain made between Defendants and Plaintiffs.

28

-44-
CLASS ACTION COMPLAINT – 26-cv-0751
 Case 3:26-cv-00751-LB Document 1 Filed 01/23/26 Page 47 of 51

1 165. Defendants’ conduct in this case abused their power to specify terms—in particular,

2 Defendants failed to accurately disclose their interception, storage, and use of WhatsApp users’

3 messages.

4 166. As a result of Defendants’ misconduct and breach of their duty of good faith and fair

5 dealing, Plaintiffs and Class Members suffered damages. Plaintiffs and Class Members did not

6 receive the benefit of the bargain for which they contracted and for which they paid valuable

7 consideration in the form of their use of the WhatsApp app, which, as alleged above, has

8 ascertainable value to be proven at trial, including but not limited to its growth of the WhatsApp

9 and broader Meta Companies user network.

10 EIGHTH CAUSE OF ACTION

11 Quasi-Contract (Restitution and Unjust Enrichment)

(In Alternative to Contract Claims)
12
167. Plaintiffs hereby incorporate all other paragraphs as if fully stated herein.
13
168. Defendants, intentionally and without consent or other legal justification, violated
14
the privacy, property, and statutory rights of Plaintiffs, Class Members, and other WhatsApp users.
15
169. As a result of Defendants’ tortious acts, Defendants received and unjustly retained a
16
benefit at the expense of Plaintiffs, Class Members, and other WhatsApp users.
17
170. It would be unjust for Defendants to retain the value of the Plaintiffs’ property and
18
any profits earned thereon.
19
171. If Plaintiffs’ contract claims fail, they have no adequate remedy at law to force the
20
disgorgement of Defendants’ unjustly earned profits. This count is therefore pled in the alternative
21
to the contract claims.
22
NINTH CAUSE OF ACTION
23
Statutory Larceny
24 Cal. Penal Code §§ 484 and 496

25 172. Plaintiffs hereby incorporate all other paragraphs as if fully stated herein.

26 173. California Penal Code section 496(a) prohibits the obtaining of property “in any

27 manner constituting theft.”

28 174. California Penal Code section 484 defines theft, and provides:

-45-
CLASS ACTION COMPLAINT – 26-cv-0751
 Case 3:26-cv-00751-LB Document 1 Filed 01/23/26 Page 48 of 51

1 Every person who shall feloniously steal, take, carry, lead, or drive
away the personal property of another, or who shall fraudulently
2 appropriate property which has been entrusted to him or her, or who
shall knowingly and designedly, by any false or fraudulent
3 representation or pretense, defraud any other person of money, labor
or real or personal property, or who causes or procures others to report
4 falsely of his or her wealth or mercantile character and by thus
imposing upon any person, obtains credit and thereby fraudulently
5 gets or obtains possession of money, or property or obtains the labor
or service of another, is guilty of theft.
6
175. Section 484 thus defines “theft” to include obtaining property by false pretense.
7
176. Defendants intentionally designed a program that would operate in a manner
8
unbeknownst to WhatsApp users, including Plaintiffs and Class Members, who were thus deceived
9
into providing their personal information (private WhatsApp messages) to Defendants.
10
177. Defendants acted in a manner constituting theft and/or false pretense.
11
178. Defendants stole, took, and/or fraudulently appropriated Plaintiffs’ and Class
12
Members’ personal information without Plaintiffs’ and Class Members’ consent.
13
179. Defendants concealed, aided in the concealing, and/or utilized Plaintiffs’ and Class
14
Members’ personal information that was obtained by Defendants for Defendants’ commercial
15
purposes and the financial benefit of Defendants.
16
180. Defendants knew that Plaintiffs’ and Class Members’ personal information was
17
stolen and/or obtained because Defendants designed the code that intercepted and stored Plaintiffs’
18
and Class Members’ private WhatsApp messages and operated it in a manner that was concealed
19
and/or withheld from Plaintiffs.
20
181. The reasonable and fair market value of the unlawfully obtained personal data can
21
be determined in the marketplace.
22
TENTH CAUSE OF ACTION
23
Violation of California Unfair Competition Law
24 Cal. Bus. & Prof. Code § 17200, et seq.

25 182. Plaintiffs hereby incorporate all other paragraphs as if fully stated herein.

26 183. The California Unfair Competition Law prohibits any “unlawful, unfair, or

27 fraudulent business act or practice and unfair, deceptive, untrue or misleading advertising.” Cal.

28

-46-
CLASS ACTION COMPLAINT – 26-cv-0751
 Case 3:26-cv-00751-LB Document 1 Filed 01/23/26 Page 49 of 51

1 Bus. & Prof. Code § 17200 (“UCL”). By engaging in the practices aforementioned, Defendants have

2 violated the UCL.

3 184. Defendants’ “unlawful” acts and practices include their violation of the Federal

4 Wiretap Act, 18 U.S.C. § 2510, et seq.; the California Computer Data Access and Fraud Act, Cal.

5 Penal Code § 502, et seq.; the California Invasion of Privacy Act, Cal. Penal Code §§ 630, et seq.;

6 Invasion of Privacy; Intrusion Upon Seclusion; Breach of Contract; Breach of the Implied Covenant

7 of Good Faith and Fair Dealing; Quasi-Contract; Statutory Larceny, Cal. Penal Code §§ 484 and

8 496; and California Bus. & Prof. Code § 22576.

9 185. Defendants’ conduct violated the spirit and letter of these laws, which protect

10 property, economic, and privacy interests and prohibit unauthorized collection of private

11 communications and personal information.

12 186. Defendants’ “unfair” acts and practices include its violation of property, economic,

13 and privacy interests protected by the statutes identified above. To establish liability under the unfair

14 prong, Plaintiffs and Class Members need not establish that these statutes were actually violated,

15 although the claims pleaded herein do so.

16 187. Defendants promised that Plaintiffs’, Class Members’, and other WhatsApp users’

17 messages would be end-to-end encrypted such that they could not be read by Defendants or third

18 parties, and that Defendants would not store those messages. Plaintiffs thus had no reason to know

19 and could not have anticipated this intrusion into their privacy by Defendants’ interception and

20 storage of their WhatsApp messages. Defendants’ conduct was immoral, unethical, oppressive,

21 unscrupulous, and substantially injurious to Plaintiffs, Class Members, and other WhatsApp users.

22 Further, Defendants’ conduct narrowly benefitted their own business interests at the expense of

23 Plaintiffs’ and Class Members’ fundamental privacy interests protected by the California

24 Constitution and the common law.

25 188. Plaintiffs and Class Members have suffered injury-in-fact, including the loss of

26 money and/or property as a result of Defendants’ unfair and/or unlawful practices, to wit, the

27 unauthorized disclosure and taking of their personal information which has value as demonstrated

28 by its use by Defendants. Plaintiffs and Class Members have suffered harm in the form of diminution

-47-
CLASS ACTION COMPLAINT – 26-cv-0751
 Case 3:26-cv-00751-LB Document 1 Filed 01/23/26 Page 50 of 51

1 of the value of their private and personally identifiable data and content. Plaintiffs and Class

2 Members have also suffered harm in the form of loss of the benefit of their bargain with Defendants.

3 189. Defendants’ actions caused damage to and loss of Plaintiffs’ and Class Members’

4 property right to control the dissemination and use of their personal information and

5 communications.

6 190. Defendants reaped unjust profits and revenues in violation of the UCL. Plaintiffs and

7 Class Members seek restitution and disgorgement of these unjust profits and revenues.

8 PRAYER FOR RELIEF

9 WHEREFORE, Plaintiffs, on behalf of themselves and the proposed Class, respectfully

10 request that this Court enter an order:

11 1. certifying this case as a class action on behalf of the Class defined above, appointing

12 Plaintiffs as representatives of the Class, and appointing their counsel as class counsel;

13 2. awarding damages, including nominal, statutory, and punitive damages where

14 applicable, to Plaintiffs and the Class in an amount to be determined at trial;

15 3. awarding Plaintiffs and the Class reasonable attorneys’ fees and costs of suit incurred

16 herein;

17 4. awarding Plaintiffs and the Class pre- and post-judgment interest, to the extent

18 allowable; and

19 5. awarding such injunctive and declaratory relief as is necessary to protect the interests

20 of Plaintiffs and the Class; and

21 6. awarding such other and further relief as the Court deems just and proper.

22 JURY DEMAND

23 Pursuant to Federal Rule of Civil Procedure 38(b), Plaintiffs hereby demand trial by jury of

24 all issues properly triable thereby.

25

26

27

28

-48-
CLASS ACTION COMPLAINT – 26-cv-0751
 Case 3:26-cv-00751-LB Document 1 Filed 01/23/26 Page 51 of 51

1 DATED: January 23, 2026 Respectfully submitted,

2 By /s/ Adam Wolfson

3 QUINN EMANUEL URQUHART &
SULLIVAN, LLP
4 Adam Wolfson (Bar No. 262125)
adamwolfson@[Link]
5 Stephen A. Broome (Bar No. 314605)
stephenbroome@[Link]
6 Kevin Teruya (Bar No. 235916)
kevinteruya@[Link]
7 Valerie Roddy (Bar No. 235163)
valerieroddy@[Link]
8 Lauren B. Lindsay (Bar No. 280516)
laurenlindsay@[Link]
9 865 South Figueroa Street, 10th Floor
Los Angeles, CA 90017
10 Telephone: (213) 443-3000
Facsimile: (213) 443-3100
11
KELLER POSTMAN, LLC
12 Warren Postman (Bar No. 330869)
wdp@[Link]
13 Ashley Keller (pro hac vice forthcoming)
ack@[Link]
14 J.J. Snidow (pro hac vice forthcoming)
[Link]@[Link]
15 1101 Connecticut Avenue, N.W., Suite 1100
Washington, D.C. 20036
16 Telephone: (833) 633-0118

17 BARNETT LEGAL, PLLC

Jay W. Barnett (pro hac vice forthcoming)
18 jay@[Link]
3404 NW 135th Street
19 Oklahoma City, OK 73120
Telephone: (405) 456-9343
20
Attorneys for Plaintiffs
21

22

23

24

25

26

27

28

-49-
CLASS ACTION COMPLAINT – 26-cv-0751