WhatsApp Privacy Settings: A Checklist With Trade-offs

#cyber-hygiene #whatsapp #privacy-settings #consumer-security #two-step-verification #encrypted-backup

November 7, 2026 · PlayCISO

TL;DR · the short version

Open Settings, then Privacy, and run Privacy Checkup, which WhatsApp describes as covering who can contact you, your personal info, extra privacy for chats and account protection. Then decide who sees your profile photo, about and last seen, who can add you to groups, and turn on two-step verification with a recovery email, app lock, chat lock for sensitive chats and an end-to-end encrypted backup. Every setting has a trade-off: hide your last seen and you cannot see anyone else's; disappearing messages can survive in forwards and older backups; Protect IP address in calls may reduce call quality.

Put it into practice

Weigh the trade-offs in the WhatsApp Privacy Settings Lab

Eleven scored decisions on a new phone's settings. Fictional people, no real accounts.

Open the lab

The quickest way to tighten WhatsApp is to open Settings, then Privacy, and run Privacy Checkup. WhatsApp describes it as a guided walk through four areas: who can contact you, your personal info, extra privacy for your chats, and protection for your account. This checklist goes through the same ground, and for each setting tells you what it does and what it costs. Menus change between versions and platforms, so where the exact path matters we link WhatsApp's own help page.

There is no single "most private" setting. Each choice trades a little convenience for a little privacy, and the right answer depends on how you use the app. If your account has already been taken over, start with our guide to a hacked WhatsApp instead; this page is about getting the settings right before anything goes wrong.

Do this now: the 10-minute pass

Run Privacy Checkup. Tap the three dots (or Settings on iPhone), go to Privacy, then Privacy Checkup, and tap each section. WhatsApp says it covers contact controls, personal info, chat privacy and account protection.
Review who sees your profile photo, about and last seen. Pick My contacts unless you have a reason to be public. Read the last seen trade-off below first.
Limit who can add you to groups. WhatsApp says the default lets any user add you.
Turn on two-step verification and add a recovery email. This protects the account itself.
Turn on app lock and put sensitive chats behind chat lock.
Silence unknown callers and decide whether Protect IP address in calls is worth the quality cost to you.
Protect your chat backup with end-to-end encryption, and store the password or key safely.

You can rehearse these choices in the WhatsApp Privacy Settings Lab, a scenario with fictional people where nothing real is at stake.

Who can see your details

For last seen and online, profile photo, about and groups, WhatsApp's help page lists the options Everyone, My contacts, My contacts except and Nobody. Its stated defaults: any user can see your profile photo, read receipts and when you are online; your contacts can see your statuses, about information and last seen; and any user can add you to groups. Defaults are a starting point, not a decision made on your behalf.

Last seen and online

The trade-off is reciprocity. WhatsApp says that if you do not share your last seen or online status, you cannot see other users' either. If you like knowing when a friend was last on, hiding yours costs you theirs. A middle path is to limit it to My contacts.

Profile photo and about

These are visible to any user by default according to WhatsApp's page for the photo, and the risk is as much about content as audience. A photo with a house number visible, or an about line that says you are away until the 20th, tells a stranger more than you intended. Limiting the audience and choosing the picture both help. The cost of Nobody is that people you know may not recognise you when they save your number.

Status

WhatsApp notes you cannot set status privacy to Everyone; it is limited to contacts or a narrower list.

Groups

Being added to a group by someone you barely know is a common way to end up among strangers who can see your number. Limiting who can add you means fewer surprises. The cost is that a friend may need to invite you another way. If a group looks like spam, leave it, and read how to spot WhatsApp scams before tapping any links.

Read receipts

Read receipts are on by default. WhatsApp says that if you turn them off you cannot see other people's read receipts, that read receipts are always sent in group chats, and that turning them off also means you cannot see who viewed your statuses. They also affect view-once media: WhatsApp says a sender can only see that a view-once message was opened if the recipient has read receipts on. This is a comfort setting more than a security one: it changes what people can infer about you, not whether they can read your messages.

Disappearing messages

Timers are 24 hours, 7 days or 90 days, and you can set a default for new individual chats under Settings, Privacy, Default message timer; WhatsApp says the default is off. The limits matter:

The timer applies only to new messages, not ones already sent or received.
A disappearing message forwarded to a chat where the feature is off will not disappear there.
A message included in a backup made before it disappeared stays in that backup, and WhatsApp says disappearing messages are deleted when a user restores from a backup.
In a group, anyone can keep a disappearing message before its timer expires, unless the sender has restricted it, and kept messages stay visible to everyone in the chat.

Treat it as tidy-up, not a guarantee. If a door code or wifi password was shared, change it rather than trusting the timer.

Useful next, if this was relevant to you

Locks: two-step verification, app lock and chat lock

Two-step verification

WhatsApp describes this as an optional extra layer, where you can choose a phone number, password or email address for additional authentication. It also says an email gives a recovery route that does not depend on SMS or a phone call, and can help you reset your PIN. Add one: our hacked-account guide notes that without an email, a forgotten PIN can mean a seven-day wait. WhatsApp also states that these features protect an account you can still access; they cannot restore one you have lost.

App lock and chat lock

WhatsApp says app lock can require biometrics on supported devices, or a password on WhatsApp Web, Windows or Mac, to open the app. Chat lock puts chosen chats behind an extra layer of authentication such as your device passcode, Face ID, fingerprint or secret code, and WhatsApp's help page says other people in the chat are not notified. The trade-off is a little friction every time you open those chats. These protect against a borrowed or stolen phone, not against someone tricking you into sharing a code.

Passkey

WhatsApp describes a passkey as linking your account to your device's security system such as your fingerprint, face or screen lock. See our Passkey Lab to understand how they work.

Calls: unknown callers and IP address

WhatsApp says unknown callers can call you by default and that you can silence them. Under Settings, Privacy, Advanced, the Protect IP address in calls setting relays your calls through WhatsApp's servers so the other person does not see your IP address. The help page lists the trade-offs plainly: calls are not connected directly, so you might find the call quality is reduced. Group calls are already relayed, and calls relayed through WhatsApp's servers are end-to-end encrypted.

Blocking and reporting

WhatsApp says that when you block someone you stop receiving their messages, calls and status updates, and your last seen, online status, status updates and profile photo changes are hidden from them. Blocking will not stop that person seeing your messages in a group you both belong to, and it does not delete the chat. Reporting is separate: WhatsApp says it sends the sender's recent messages to WhatsApp and does not notify the person, and reporting alone does not stop their messages. For a scam or harassment, block and report.

Backups and their encryption

WhatsApp says end-to-end encrypted backup is protected by a password or a 64-digit encryption key (and a passkey is offered in some versions). The catch is stated clearly: the password or key is the only way to access the backup or move it to a new device, and WhatsApp cannot reset it or help restore it. So before you turn it on, store the password or key in a password manager or somewhere equally safe. The benefit is that chats in your cloud backup are protected by something other than your cloud account.

Other settings worth knowing

Strict account settings. WhatsApp says this applies its strictest privacy and security controls and suggests enabling it only if you think you may be targeted. Expect some features to work less smoothly.
Link previews and live location. WhatsApp's page says link previews can be disabled under advanced settings and live location can be turned off.
Things you cannot hide. WhatsApp states your phone number cannot be hidden from recipients, and members' phone numbers cannot be hidden in groups. Plan around that.

Prevent it next time: a checklist

Run Privacy Checkup every few months and after a new phone.
Never share the 6-digit registration code, with anyone, for any reason.
Set photo, about and last seen to an audience you chose, knowing the last seen trade-off.
Limit who can add you to groups.
Turn on two-step verification with a recovery email.
Use app lock and chat lock; keep your phone's screen lock on.
Back up with end-to-end encryption and record the password or key.
Check what is publicly findable about you with the Digital Footprint Check.

Frequently asked questions

What are the most important WhatsApp privacy settings?

Start with Privacy Checkup, then check who can see your profile photo, about and last seen, who can add you to groups, two-step verification with a recovery email, app lock and chat lock, and an end-to-end encrypted backup. WhatsApp's Privacy Checkup groups these into four sections.

If I hide my last seen, can I still see other people's?

No. WhatsApp says that if you do not share your last seen or online status, you cannot see other users' last seen or online status either.

Can I stop strangers adding me to WhatsApp groups?

Yes. WhatsApp lists groups among the settings where you can choose Everyone, My contacts, My contacts except or Nobody. By default WhatsApp says any user can add you to groups.

Do disappearing messages stop people keeping a copy?

Not reliably. WhatsApp says a message forwarded to a chat where the feature is off will not disappear there, and a backup made before a message disappeared keeps it. The timer applies only to new messages.

What does Protect IP address in calls do?

WhatsApp says it relays your calls through its servers so the other person does not see your IP address. Call quality may be reduced, group calls are already relayed, and relayed calls remain end-to-end encrypted.

What happens if I forget my encrypted backup password?

WhatsApp says the password or 64-digit key is the only way to access an end-to-end encrypted backup, and WhatsApp cannot reset it or help you restore it. Store it somewhere safe before you turn the backup on.

Sources

This is general guidance. WhatsApp's menus and wording change by version and platform; follow the official help pages above for the current steps.

Weigh the trade-offs in the WhatsApp Privacy Settings Lab

Eleven scored decisions on a new phone's settings. Fictional people, no real accounts.

Open the lab