Anonymous And Unsubstantiated: Court Dismisses Massive Whatsapp Privacy Class Action Over Vague Whistleblower Claims

The Northern District of California (Judge Rita F. Lin) dismissed a 10-count data privacy class action against Meta and WhatsApp because the plaintiffs relied on unspecified “whistleblowers” without pleading any actual facts to show how those informants knew what they were talking about.

But it was not a total sweep for the defense, as the court denied Meta’s motion for Rule 11 sanctions and rejected Meta’s argument that foreign users cannot sue under U.S. and California privacy laws.

Sooooo WhatsApp advertises itself to over three billion users as completely private, promising that messages are “encrypted for everyone” and that “not even WhatsApp can see them.” Despite those representations, a group of WhatsApp users from Australia, Brazil, India, Mexico, and South Africa filed a class action alleging that Meta and WhatsApp actually store and access users’ communications.

To back up this claim, the complaint relied on anonymous whistleblowers who claimed Meta employees could simply send an internal “task” requesting access to user messages. According to these whistleblowers, engineers would grant access, giving the employee a workstation widget that displayed the user’s messages in real-time without any separate decryption step. The plaintiffs brought claims under the Wiretap Act, CIPA, CDAFA, California’s UCL, breach of contract, and several other privacy and tort theories.

Now…the court found a problem with the whistleblower allegations under Rule 8. Judge Lin ruled that simply stating “whistleblowers here have explained” an alleged surveillance scheme is not enough to survive a Rule 12(b)(6) motion. While plaintiffs do not need to name their informants in the complaint, they do have to plead basic facts showing that the whistleblowers have firsthand knowledge or some other reliable basis for their claims. Without that foundation, the allegations that Meta can access the messages (unencrypted and in real-time) are not enough to meet the plausibility threshold required to survive a Rule 12(b)(6) challenge.

The court also held that the plaintiffs failed to satisfy Rule 9(b)’s heightened pleading standard for their fraud claims. Allegations about “senior leadership” hiding the truth, imposing nondisclosure agreements, and workers lacking the mandatory “who, what, when, where, and how” required by the rules. Because those specific details were missing, the judge dismissed the fraud-based claims from the complaint entirely.

The Wiretap Act and CIPA claims were also dismissed because the complaint did not plausibly allege that employees accessed messages for anything outside the normal course of operating WhatsApp or protecting Meta’s property. And additionally, the CDAFA, UCL, and statutory larceny claims were dismissed because the plaintiffs could not show how they suffered actual damages or cognizable financial loss from the alleged violations.

Additionally, Meta attempted to argue that foreign plaintiffs could not bring claims under U.S. and California laws like the Wiretap Act, CIPA, CDAFA, and the UCL. The court disagreed and held that because Meta’s servers and systems are located in the U.S. and California—the exact places where the alleged message interception and data access occurred—applying these statutes does not constitute an impermissible extraterritorial application of the law.

Meta also wanted plaintiffs’ counsel to be sanctioned under Rule 11 for filing a “factually baseless” lawsuit, arguing that technical evidence proves Meta cannot access encrypted messages. The court denied the motion. Judge Lin noted that breaking end-to-end encryption isn’t the only theoretical way messages could be accessed, such as through endpoint widgets before encryption or after decryption. And an expert declaration from the plaintiffs confirmed that Meta’s evidence did not conclusively rule out the whistleblowers’ story.

The court dismissed the complaint, but gave the plaintiffs until August 13, 2026, to file an amended complaint. We will keep watching this one!