Signal vs WhatsApp — which is actually private for Australians?
Both apps claim to use end-to-end encryption. One of them means it. This comparison cuts through the marketing to explain what each app logs, who can access it, and what that means under Australian law.
Signal is meaningfully more private than WhatsApp. WhatsApp is owned by Meta, collects substantial metadata, and has responded to Australian law enforcement requests. Signal collects almost nothing and has repeatedly demonstrated in court that it has nothing to hand over. For sensitive conversations, Signal is the clear choice. For the highest-security use cases, Threema removes the requirement to link your phone number entirely.
The encryption question is the wrong starting point
Both Signal and WhatsApp use end-to-end encryption for message content — in fact, WhatsApp licences the Signal Protocol from Open Whisper Systems. So the encryption itself is, in principle, similar. The difference is everything else: what metadata is collected, who owns the infrastructure, what the privacy policy actually permits, and what happens when a government agency asks for data.
Encryption protects the content of your messages in transit. It does not protect who you messaged, when, how often, from what IP address, what device you were using, or what your social graph looks like. That information — the metadata — is often more revealing than the messages themselves, and it is where Signal and WhatsApp part ways dramatically.
What each app actually collects
| Data point | Signal | |
|---|---|---|
| Message content | E2E encrypted, not readable by Signal | E2E encrypted, not readable by Meta* |
| Contact list | Hashed, not stored on servers | Uploaded to Meta servers |
| Message timestamps | Not stored | Stored with metadata |
| Who you message | Not stored | Stored as metadata |
| Read receipts | Optional | Default on |
| Online/last-seen status | Optional | Default on |
| IP address | IP proxy available (paid) | Exposed to Meta |
| Device identifiers | Minimal | Extensive |
| Backup encryption | E2E encrypted by default | Optional E2E backup |
| Cross-app data sharing | None | Shared with Meta family |
| Phone number required | Yes (usernames available) | Yes, always |
| Open source | Fully open source | Closed source |
* WhatsApp's parent company Meta has broader access to metadata, usage patterns, and device information, even if the message content itself is encrypted. The asterisk matters.
The Australian legal context
Australia's Telecommunications (Interception and Access) Act 1979 and the more recent Assistance and Access Act 2018 (the "encryption bill") give law enforcement agencies significant powers to compel telecommunications providers to assist with data access. Meta, as a company with substantial Australian operations and revenue, operates within this legal framework.
Signal, by contrast, has demonstrated repeatedly — in US federal court proceedings that have been made public — that it cannot comply with broad data requests because it simply does not hold the data. The most notable example: when served a grand jury subpoena in 2016, Signal was able to produce only two pieces of information about a user: the date the account was created and the date it last connected to Signal servers. Everything else did not exist.
WhatsApp has cooperated with law enforcement requests globally, including producing metadata that has been used in criminal prosecutions. The content of messages remains encrypted, but the metadata — who communicated with whom, and when — has proven useful enough that investigators actively seek it.
For Australians who are concerned about government access to their communications — journalists protecting sources, legal professionals, executives negotiating sensitive deals, or anyone subject to regulatory scrutiny — this distinction is not theoretical. Signal's no-data architecture is a meaningful protection that WhatsApp cannot offer.
The Meta factor
WhatsApp's acquisition by Meta (then Facebook) in 2014 was followed by repeated privacy policy changes that progressively integrated WhatsApp data with the broader Meta advertising ecosystem. The 2021 policy update — which caused a mass migration to Signal — explicitly stated that WhatsApp would share more data with Meta, including phone numbers, transaction data, IP addresses, device information, and usage patterns.
In the European Union, regulators imposed a €225 million fine on WhatsApp in 2021 for GDPR violations related to data transparency. Australian privacy law is less stringent, but the underlying data flows remain the same regardless of jurisdiction.
Signal is operated by the Signal Foundation, a US-based nonprofit that does not have an advertising business and does not monetise user data. Its business model is donations and grants, not surveillance capitalism. That structural difference matters more than any particular privacy policy clause.
Security features compared
Signal's security advantages
- Fully open source — code can be independently audited
- Sealed sender — recipients cannot tell which Signal server routed the message
- Note to Self — encrypted notes visible only to you
- Disappearing messages — default or per-conversation
- Safety numbers — verify contacts out-of-band
- Screen security — prevents screenshots and app-switcher previews
- Incognito keyboard — prevents keyboard learning your typed content
- Phone number privacy — usernames allow contact without sharing your number
WhatsApp's limitations
- Closed source — cannot be independently audited
- Metadata retained and shared with Meta
- Requires a phone number — no pseudonymous option
- Cloud backups historically unencrypted (optional E2E now available)
- Link preview generation happens server-side in some cases
- Contact upload to Meta servers is mandatory
- Business accounts — messages may be read by the business
- Owned by an advertising company with different incentives
When WhatsApp is "good enough" — and when it is not
For the majority of everyday conversations — organising a dinner, sharing photos with family, coordinating a local sports team — WhatsApp's encryption is adequate and its ubiquity is a practical advantage. The fact that Meta can see your metadata is not a meaningful risk for most people in most situations.
WhatsApp is not adequate for:
- Legal privilege. Lawyer-client communications should not flow through an advertising platform's infrastructure. Many Australian law firms are now specifying Signal or Threema for sensitive client matters.
- Journalistic source protection. A journalist protecting a confidential source cannot afford metadata that reveals who they spoke to and when. Signal is the standard tool for source-sensitive reporting.
- Business negotiations. Pre-announcement M&A discussions, pricing strategy, and board deliberations have real commercial value. Treating them as acceptable WhatsApp content is a risk decision that most executives would not consciously make.
- Political communications. Politicians and their staff operate in an environment of intelligence gathering, opposition research, and — in some international contexts — state-sponsored surveillance.
- Domestic violence situations. An abuser with access to a shared phone account, carrier records, or a family Meta account can extract WhatsApp metadata. Signal's minimal retention is a meaningful protection in these contexts.
The third option: Threema
Both Signal and WhatsApp require a phone number to create an account. For people who need to communicate without linking their real identity to their messaging account, this is a fundamental limitation. Threema is a Swiss-hosted messaging app that requires no phone number, no email address, and no personally identifying information to register. You generate a random Threema ID, share it with trusted contacts, and your account is not connected to your real-world identity in any way.
Threema is not free — a one-time purchase is required — which also means there is no advertising business funding it. The app is audited by external security researchers, uses end-to-end encryption for all content, and is subject to Swiss privacy law rather than US or Australian jurisdiction.
For executives, legal professionals, journalists, and anyone who needs genuinely anonymous communications, Threema is worth considering as a complement or replacement to Signal. We stock Threema licences and pre-configure them on our prepared devices.
Signal and WhatsApp on GrapheneOS
Both Signal and WhatsApp run on GrapheneOS, which matters because the operating system itself is a significant part of the privacy picture. A phone running stock Android or iOS can leak information at the OS level — telemetry, location history, advertising identifiers — regardless of which messaging app you use. GrapheneOS removes those background data flows, meaning the privacy guarantees of Signal can actually be realised rather than undermined by the OS below it.
On a Privacy Devices prepared phone, Signal is pre-installed and configured with recommended settings: disappearing messages set to a sensible default, screen security on, phone number privacy enabled, and the IP proxy active. WhatsApp can be installed via sandboxed Google Play if needed, isolated to a separate user profile so its data access is scoped to that profile only.
See our full guide on secure messaging on GrapheneOS for the detailed setup.
Practical recommendation for Australians
Use Signal for
Day-to-day private conversations where you want meaningful protection without complexity. Legal communications, medical discussions, financial matters, source-sensitive journalism, and any conversation you would not want your phone carrier, Meta, or a third party to analyse.
Use Threema for
Situations where linking your phone number to your communications is itself a risk. Anonymous reporting, identity-sensitive professional work, and high-risk environments where even Signal's knowledge of your phone number is undesirable.
WhatsApp is acceptable for
Low-stakes social coordination where the network effect (everyone is already there) outweighs the privacy trade-off, and where metadata retention and Meta data sharing are not meaningful risks for your specific situation.
What we configure on prepared devices
Signal pre-installed with recommended settings. Threema licensed on request. WhatsApp available via isolated sandboxed profile if needed. The OS-level protections of GrapheneOS ensure neither app leaks data at the system level.
Signal vs WhatsApp Australia — FAQ
Is WhatsApp end-to-end encrypted?
WhatsApp uses end-to-end encryption for message content, based on the Signal Protocol. The message text is not readable by Meta in transit. However, WhatsApp collects extensive metadata — who you message, when, how often, from what device — and shares it with the Meta advertising ecosystem. The content is encrypted; the context is not.
Can Australian police access Signal messages?
Signal has demonstrated repeatedly — including in US federal court — that it cannot comply with requests for message content, contact lists, or conversation metadata because it does not retain that information. What Signal can confirm is the date an account was created and the date it last connected. Australian law enforcement agencies cannot compel Signal to produce data that does not exist.
Can Australian police access WhatsApp messages?
WhatsApp message content is end-to-end encrypted and not readable by Meta, so that specific content is not available to law enforcement via a request to Meta. However, WhatsApp metadata — who you communicated with, when, from what device — is retained and has been provided to law enforcement under legal process in numerous cases globally.
Is Signal safe in Australia?
Yes. Signal is a lawful communication tool used by journalists, lawyers, medical professionals, and privacy-conscious individuals worldwide. It is not illegal in Australia. Its use does not create legal liability; it simply protects the privacy of communications in the same way that a sealed letter or face-to-face conversation does.
Does Signal require a phone number?
Signal requires a phone number to register an account, though you can now create a username and share that instead of your number with contacts. Your phone number is used for account registration but can be kept hidden from people you message. If you need an account with no phone number linkage at all, Threema is the better choice.
Which is better for business use in Australia — Signal or WhatsApp?
For sensitive business communications, Signal is significantly better. WhatsApp's metadata retention and Meta data sharing make it inappropriate for legal privilege, pre-announcement negotiations, board discussions, and regulatory matters. Many Australian law firms and professional services firms now specify Signal for client-sensitive work.
What is the most private messaging app in Australia?
For ease of use with strong privacy, Signal is the leading choice. For maximum anonymity — no phone number, no identity linkage — Threema is the strongest option. Both outperform WhatsApp on privacy substantially. On a GrapheneOS device, either app's privacy guarantees are realised more fully because the operating system does not undermine them with background telemetry.
Private communications start with the device.
Signal and Threema pre-installed, configured, and running on a GrapheneOS Pixel. Dispatched from Australia, ready to use.
Browse Prepared Devices → Get a Threema Licence