Instagram Encryption: End-to-end encryption is technology that locks your messages as soon as they leave your phone and only opens them on the phone of the person you sent them to.
Instagram: End-to-end encryption on Instagram has ended as of May 8, 2026. This means that messages you send to a friend, partner, or business contact are no longer completely private. Instagram has removed end-to-end encryption in direct messages between its users, and now Meta can potentially see the content of messages between all users. This move is a major blow to Instagram's millions of users. It's worth noting that over 500 million people use Instagram in India.
What was E2EE before, what does it mean?
End-to-end encryption is technology that locks your messages as soon as they leave your phone and only opens them on the phone of the person you sent them to. With encryption, the message content was protected as soon as it left the sender's device and could not be read by anyone until it reached the receiver's device, not even the message itself. Encryption was introduced on Instagram as an optional feature in December 2023, but it never became the default. Users had to manually enable it. This was the first mistake that suffocated the feature.
What has changed now and why?
Starting May 8th, every one of your Instagram DMs will be scanned by Meta. It can read the content of messages, flag conversations for policy violations, show ads based on what you're talking about, and even provide everything to the government upon legal demand. Meta's official response is that too few people were opting in to E2EE in Instagram DMs, so this option is being removed. Those who want encrypted messaging can switch to WhatsApp.
What is the real reason?
Digital forensic experts say that Meta removed encryption not for security reasons, but as a business decision. Considering the timing, the Take It Down Act is set to come into effect in the US on May 19, 2026, requiring platforms to remove objectionable content within 48 hours. This wasn't possible with encrypted messages. Meta took this step just 11 days before that law came into effect. Another major reason is data and advertising. Meta's business model relies on understanding users. Encrypted messages were a black box in that data collection machine. This means that if you messaged someone about trekking shoes, you'd see ads for outdoor gear on Instagram.
Instagram has already given information
In December 2025, Meta itself stated that private conversations with AI tools could be used for targeted advertising. This means that your words will be used to train the AI and then serve ads directly to you.
What will be the impact on India?
India is one of Instagram's largest markets. Following the E2EE removal, the content of Indian users' Instagram DMs has become accessible to Meta, and the Indian government can obtain it through legal requisition. Under the DPDP Rules 2025, Meta is a data fiduciary and must obtain user consent before processing personal data. The removal of E2EE has fundamentally changed what Meta can do with message content. The question then is whether Meta's current privacy notice and consent mechanism are valid under the DPDP Rules 2025?
What things will change?
Simply put, if you were discussing any sensitive matter, business deal, political opinion or personal matter on Instagram DM, then it has now become a risky place. After the removal of E2EE, Meta has access to the entire text, photo-video, voice call metadata and communication patterns of Instagram DM. The removal of encryption has also increased the security risk. In fact, any system that stores readable data of users can become a target of hackers. With E2EE, even if the data on the server was stolen, it could not be read. Now this security shield is gone.
What can you do now?
If you used encrypted chat on Instagram, you can download your old messages by going to Settings, selecting "Your Activity," and then "Download Your Information." Meta's decision highlights how quickly social media privacy can change and how risky it is to rely solely on a single app's settings.
PC: Social Media
