Edited by Paul Elegbeleye
Meta switched off Instagram’s private messaging encryption on 8 May 2026, ending a feature the company had spent seven years promising to expand.
This change means Meta can now read every direct message sent on the platform. Instagram has roughly two billion monthly users, and none received a notification. However, the announcement was a single line added to the company’s Help page in March.
The feature Meta removed locks a message on the sender’s phone before it travels. Only the recipient’s device holds the key to open it. Not Meta’s servers, not a police officer with a court order. Instagram had offered this as an opt-in since December 2023 but never switched it on by default. Meanwhile, the lock icon sat inside every DM thread. Most users never touched it.
Meta’s explanation for the reversal was brief. A spokesperson told The Guardian in March that “very few people were opting in to encrypted messaging in DMs, so we’re removing this option”.
Analysts were not convinced. Tom Sulston, head of policy at Digital Rights Watch, said the low-uptake argument is hard to accept when a feature is never set as the default. “Why not improve the product”, he asked, “rather than continue to enshittify it?”
However, the real picture is more complicated. Child safety pressure combined with US legislation on harmful content, alongside commercial incentives, all appear to have played a role. This article looks at each one.
Table of Contents
Key Takeaways
- Meta removed Instagram’s message encryption on 8 May 2026
- The company gave no direct notification to users before the change
- Meta can now read all DM content, including photos and voice notes
- Child protection groups welcomed the decision; privacy groups condemned it
- WhatsApp and Signal both remain fully encrypted alternatives
- A new US law on harmful content took effect just eleven days later
The Child Safety Argument Meta Did Not Lead With
Child protection organisations had lobbied against Instagram’s encryption plans for years. The NSPCC welcomed the reversal. Rani Govender from the charity said the feature “can allow perpetrators to evade detection, enabling the grooming and abuse of children to go unseen”. Interpol and the UK’s National Crime Agency had both written to Meta with the same warning.
Meta leaned on this framing after the fact. Privacy groups pointed out the company had defeated those same arguments for seven years. Something changed in 2026.
A US Law, a Commercial Motive, Eleven Days Apart
The United States Take It Down Act came into force on 19 May 2026, eleven days after Meta flipped the switch on Instagram. This law requires platforms to find and remove non-consensual intimate imagery within 48 hours of a takedown request. If a platform cannot read its own messages, it cannot do that scan. Meta has not confirmed the law drove the decision. However, the timing, noted by multiple security researchers, speaks for itself.
Victoria Baines, professor of IT at Gresham College, offered a harder assessment to the BBC. “Social media platforms monetise our communications so they can serve targeted advertising,” she said. “And increasingly, companies like Meta are focusing on training AI models, for which messaging data can be extremely valuable. I think the decision is more complex.” Instagram has said DMs are not used to train its AI. Without encryption, that policy is a choice, not a technical limit.
“I think the decision is more complex.” — Victoria Baines, Gresham College.
TikTok told the BBC in March 2026 it would not introduce message encryption because it “complicates safety teams and law enforcement investigations”. Instagram updated its terms fourteen days later. The direction across the industry is clear.
What Changes for Users, and What Nigerian Users Should Know
Before 8 May, a user who activated the lock icon had a guarantee: Meta could not read those messages even if it wanted to. That guarantee is gone. Standard encryption still protects messages while they travel to Meta’s servers, the same way a banking app secures a login. But Meta holds the contents once they arrive and can share them with law enforcement under a valid request or scan them for policy violations.
Nigeria has one of the largest Instagram user bases on the continent. Journalists and activists regularly use DMs for sensitive work. Those users should treat Instagram messages the way they treat email: fine for ordinary exchanges, unsuitable for anything genuinely private. WhatsApp remains fully encrypted by default. Signal, which is independent of Meta, offers the same protection.
A Seven-Year Promise, Reversed in a Help Page Update
In 2019, Mark Zuckerberg published a manifesto he called “A Privacy-Focused Vision for Social Networking“. He wrote that “the future is private”. Meta spent seven years defending that position. Then, in March 2026, it updated a support page.
Maya Thomas of Big Brother Watch said she was “disappointed” and warned that the removal could set a precedent across the industry. She is probably right to be concerned. Instagram is not a niche platform. When the world’s second-largest social network decides private messages do not need to stay private, other companies notice.
