Loading story…
Meta said it will discontinue end-to-end encryption (E2EE) for Instagram direct messages after May 8, 2026, reversing an earlier privacy push that began with testing in 2021 and a limited rollout in 2023. The feature was never enabled by default, remained available only in some regions, and Meta said adoption was low. Users with affected encrypted chats are being told to download messages and shared media before the cutoff, and some may need to update the Instagram app to export that data.
The change means Instagram DMs that had been protected by E2EE will revert to a standard format accessible to Meta for moderation and other internal purposes. Reporting also notes broader tension around encrypted messaging: privacy advocates and researchers criticized the rollback as a retreat from user privacy, while child-safety and law-enforcement voices have long argued that E2EE can hinder detection of CSAM, terrorist content, and other abuse. The move follows years of debate inside and outside Meta over whether stronger message privacy should outweigh platform safety and compliance concerns.
See the reporting duties and controls this puts on the clock.
5 events from the most recent confirmed update back to the earliest known activity.
Meta began showing in-app notifications and updating Instagram help documentation to tell affected users to save or download messages and media before encrypted chats are removed. Some users may need to update the Instagram app to access the export guidance.
Meta announced in March 2026 that Instagram will discontinue support for end-to-end encrypted chats after May 8, 2026, citing very low adoption. The company directed users who want encrypted messaging to WhatsApp instead.
In late 2023, Meta formally rolled out Instagram's end-to-end encrypted direct messaging as an opt-in feature in select regions. It still was not made the default for all users.
In February 2022, Meta expanded Instagram's encrypted direct messaging capability to adult users in Russia and Ukraine during the Russo-Ukrainian war. This marked a broader regional availability of the optional feature.
Instagram first tested end-to-end encrypted direct messaging in 2021 as part of Meta's broader privacy-focused messaging strategy. The feature was limited, optional, and not enabled by default.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
7 references tracked. Mallory keeps watching after this page renders.
vulnu.com
Open sourcetechrepublic.com
Open sourcescworld.com
Open sourcehelpnetsecurity.com
Open sourceghacks.net
Open sourcecybersecuritynews.com
Open sourcethehackernews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Meta said it will discontinue Instagram’s optional end-to-end encrypted direct messages on **May 8, 2026**, ending a feature introduced in 2023 after reporting that few users enabled it. After the cutoff, Instagram DMs will rely on standard transport encryption instead of end-to-end encryption, allowing message content to be decrypted on Meta’s servers. Users with existing encrypted threads are being notified to save or export content they want to keep before the feature is turned off, and Meta has pointed privacy-conscious users toward **WhatsApp** for encrypted messaging. The change has triggered criticism from privacy advocates, who warn that server-readable messages expand the risk surface for breaches, internal access, moderation scanning, and legal disclosure. Reports also say the move could make private message content more available for automated processing and other internal uses, though Meta’s public rationale focused on low adoption and operational needs rather than explicitly confirming advertising or AI training. The decision also contrasts with earlier public commitments by Meta leadership favoring broader deployment of private, encrypted communications.
Jun 29, 2026
Meta disclosed a set of new **platform safety and enforcement actions** aimed at reducing harm and abuse on its services. The company filed multiple lawsuits against alleged scam-ad operators in **Brazil, China, Vietnam** and elsewhere, describing tactics including **deepfakes/celebrity impersonation**, “celeb-bait” investment lures, and **cloaking** used to evade ad review; Meta said it also took technical steps such as disabling accounts, suspending scam-linked payment methods, and blocking associated domains, and shared information with industry partners to help them block the same actors. Separately, Meta announced new **Instagram parental-supervision alerts** that notify parents when a teen repeatedly searches for **self-harm or suicide-related terms** within a short time window (initially for supervised accounts in the **U.S., U.K., Australia, and Canada**), and said it is developing similar notifications for teens’ **AI-related conversations** about self-harm. In parallel regulatory developments, EU lawmakers advanced a non-binding opinion supporting **privacy-friendly age verification** and proposing restrictions that would require **parental consent for under-16s** and bar access for children under 13, positioning these measures for potential inclusion in a future **Digital Fairness Act** focused on child protection online, targeted advertising, and addictive design patterns.
Jun 29, 2026
Meta launched an Instagram AI capability powered by its **Muse Image** model that let users generate images from text prompts, uploaded photos, and references to public Instagram accounts, including posts and Reels invoked through `@` mentions. The feature was made available through Meta AI surfaces including the web, iOS and Android apps, and chats in Instagram and WhatsApp, as part of a broader push of AI creative tools and Story effects. Meta then removed the public-account image reference feature after backlash over privacy and misuse risks, saying public feedback showed it had "missed the mark." Critics warned that public Instagram content could be repurposed into misleading or unflattering images without meaningful consent, and SAG-AFTRA urged members to opt out; researcher Neal K. Shah also cited scam ads allegedly using his likeness. Meta said users had controls in Instagram's **Sharing and reuse** settings to limit reuse of Posts, Reels, and original audio, and it kept the rest of its AI creative features online while discontinuing only the public-account reuse function.
Jul 11, 2026