Stiftung Warentest took a closer look at WhatsApp Messenger and recommends changing three settings. We have reviewed the recommendations and assess how useful the suggestions really are.

Stiftung Warentest: You should change these settings on WhatsApp

At Stiftung Warentest, WhatsApp Messenger has been taken on and recommendations are made on how to create a little more privacy. Many users are somewhat careless with the data and information provided via the messenger. Stiftung Warentest is now drawing attention to this and mentions three WhatsApp settings that everyone should change.

  1. profile pic: When setting up WhatsApp, you not only enter your name, but usually also upload a profile picture of yourself. But that is exactly what you can do from this point on everyone see who has their own number, not just their own contacts. To change this, go to “Account and Privacy” in the settings. There you select the item “Profile picture” and have three options: “Everyone”, “My contacts” or “No one”. You should definitely not choose “everyone”. The decision should fall between “My Contacts” and “Nobody”. If you only have friends among the contacts, then “My contacts” is sufficient. Otherwise, you should not share the profile picture with anyone – or take and upload none at all.
  2. Last online: Who should actually be concerned when you were last online on WhatsApp and used the app? Actually nobody. In fact, if you don’t change it, everyone can see it. Under settings, account and data protection you will find the item “last seen”. Also set from “Everyone” to “My Contacts” or “Nobody”. We also recommend selecting “Nobody” in the item.
  3. read receipt: When you receive a message, there are three different ticks that send different information to the sender. A gray tick means the message has been sent. Two gray ticks mean the message has arrived. Two blue ticks mean you’ve read the message. The latter is not optimal. If you don’t want to send a read receipt, go to Settings → “Account” → “Privacy” and deselect the sending of a read receipt. This means that blue ticks no longer appear for the recipient. We also recommend this option – disadvantage: You will then no longer receive any read receipts.

Stiftung Warentest goes one step further

As a final step, Stiftung Warentest recommends (look at Stiftung Warentest) also to go into the settings of the smartphone and revoke permissions there. For example, for location or access to storage or photos. We do not recommend this, as WhatsApp loses important functionality. For example, you can no longer send photos, use the internal camera or share your location. However, everyone should change the settings mentioned above.

Our recommendations

In addition to the settings mentioned above, we recommend three further measures for more data protection in/with WhatsApp.

  • Do not sync address book: When (re)installing WhatsApp, almost everyone uploads all the contacts saved in the address book along with the phone number to the WhatsApp/Facebook server. From a data protection point of view, this is questionable, because not every contact was asked whether he or she agreed. That’s why you should avoid it. WhatsApp works well even if you reject the corresponding option during installation – you may have to add new contacts to whom you want to write once in WhatsApp itself.
  • No backups in the cloud: They are convenient, but offer another target for hackers, at least in theory. That means: If someone gets access to your Google Drive or your iCloud, this person also gets access to all of your WhatsApp communication saved in the backup. In a separate article, we explain how you can manually back up your WhatsApp chat histories instead.
  • Use alternatives: Signal and Threema are less questionable alternatives in terms of data protection, too Apple iMessage is considered safe – but only when Apple devices communicate with each other. Whenever possible, you should switch to the alternatives mentioned so that Facebook, as the WhatsApp operator, can collect less metadata. Also important: Telegram is not an alternative.