End-to-End Encryption: Why Instagram is Rolling Back While Apple & Google Expand E2EE for RCS

Featured image: Photo by Markus Winkler on Pexels.

The landscape of digital communication privacy is currently marked by a striking divergence among major technology companies. While some giants are taking significant strides to enhance user security through end-to-end encryption (E2EE), others appear to be retreating from similar commitments. This contrast is vividly illustrated by Instagram’s recent decision to roll back its optional E2EE feature for direct messages, even as Apple and Google collaborate to expand E2EE capabilities for Rich Communication Services (RCS) in cross-platform messaging. These differing approaches highlight fundamental disagreements about the importance of default privacy protections and the responsibility of companies to safeguard user data, setting a new precedent for the future of secure digital interactions.

The Retreat of Instagram’s End-to-End Encrypted DMs

For years, Meta, the parent company of Instagram, had publicly championed the cause of end-to-end encryption. In 2022, a white paper from the company articulated a clear vision: “We want people to have a trusted private space that’s safe and secure, which is why we’re taking our time to thoughtfully build and implement e2ee by default across Messenger and Instagram DMs” [1]. This commitment was reiterated in 2023, with Meta boasting about the successful encryption of Messenger and hinting at progress for Instagram. The promise was to extend the robust privacy protections of E2EE, already a cornerstone of WhatsApp, to its other widely used platforms.

However, that promise for Instagram has recently been put on hold. Instagram ended its opt-in end-to-end encryption feature for direct messages, effectively abandoning a privacy option for millions of users [1]. Meta’s explanation for this reversal was straightforward: “Very few people were opting in to end-to-end encrypted messaging in DMs” [1]. This statement, however, overlooks a crucial aspect of user behavior and product design. The feature was not enabled by default; instead, it required users to navigate a four-step opt-in process, a barrier that many users might not have been aware of or found cumbersome to complete. The Electronic Frontier Foundation (EFF) pointed out that “Defaults matter,” arguing that Meta’s decision to blame users for low adoption of an optional feature underscores this principle [1].

The consequence of this rollback is significant. Users of one of the world’s largest social media platforms have lost an option for more secure conversations. While Meta directs users seeking encrypted messaging to WhatsApp, this sidesteps the fundamental issue of meeting users where they already are. If the goal is truly to provide a trusted private space, then E2EE should be a default offering across all Meta’s communication channels, not just a select few or an obscure opt-in. This move is particularly disheartening given that other promised features, such as end-to-end encryption for Facebook Messenger group messages, remain undelivered [1]. The rollback on Instagram serves as a stark reminder of the challenges in implementing widespread E2EE, especially when it conflicts with other business objectives or perceived technical complexities.

A Leap Forward for Cross-Platform Messaging: E2EE RCS

In stark contrast to Instagram’s retreat, Apple and Google have recently delivered a significant victory for digital privacy: end-to-end encryption for Rich Communication Services (RCS) [2]. This development marks a monumental step forward, particularly for the billions of conversations that occur daily between Android and iPhone users. With Apple’s release of iOS 26.5, conversations taking place between Apple’s Messages app and Google Messages on Android will soon be end-to-end encrypted by default, bridging a long-standing privacy gap between the two mobile ecosystems [2].

RCS itself is designed as a modern replacement for the aging SMS standard, offering a richer messaging experience that includes higher-quality images, larger file sharing, read receipts, and typing indicators. Apple’s support for RCS, introduced in 2024, already marked a significant improvement in the quality of media shared between Android and iPhone devices. Now, the addition of E2EE elevates these interactions to a new level of security and privacy. This means that the content of messages exchanged over RCS between these devices will be inaccessible to Google, Apple, and even the cellular carriers [2].

The technical foundation for this enhanced security lies in both companies supporting the GSMA RCS Universal Profile 3.0, which integrates the robust Messaging Layer Security (MLS) protocol for encryption. This collaborative effort demonstrates a commitment to a universal standard for secure communication, moving beyond proprietary solutions and fostering a more private internet ecosystem. The EFF has lauded this achievement, emphasizing that it represents a “significant step forward for the privacy of millions of conversations worldwide” [2]. This move underscores the potential for industry leaders to work together on difficult but necessary steps to protect user privacy, setting a positive example for other tech companies.

Understanding the Nuances of E2EE RCS

While the implementation of E2EE for RCS is a monumental step, it’s important for users to understand its nuances and current limitations. The feature is currently marked as beta on Apple devices, indicating that its full rollout is dependent on several factors. These include carrier support for both RCS and encrypted messages, as well as all participants in a conversation running the most recent version of Google Messages on Android and iOS 26.5 or later on iPhones [2]. Until all these conditions are met, conversations may not be protected with E2EE, and users should be aware of this transitional phase.

Furthermore, while the content of messages is end-to-end encrypted, certain aspects of communication may still be subject to collection. For instance, metadata—information about who communicated with whom, when, and how frequently—will likely still be collected and stored for these conversations [2]. This is a common practice even with E2EE services, as it’s often necessary for network operation and service delivery. For users seeking the highest level of privacy, even for metadata, alternatives like Signal continue to offer a more comprehensive solution.

Another important consideration pertains to cloud backups. If users choose to back up their conversations to the cloud, these backups may be stored unencrypted unless specific privacy features are enabled. On iOS, users can enable Advanced Data Protection (ADP) to encrypt their cloud backups. For Google Messages, the text of messages in backups is end-to-end encrypted, but media files are not [2]. This highlights the ongoing need for users to be proactive about their privacy settings and for companies to offer robust, default encryption for all aspects of data storage, including backups. Despite these considerations, the visible confirmation of E2EE—a lock icon and the text “Encrypted” at the top of a conversation—will provide clear assurance to users when their RCS chats are protected [2].

The Broader Implications for Digital Privacy

The contrasting paths of Instagram and the Apple-Google RCS collaboration reveal a critical juncture in the evolution of digital privacy. Meta’s decision to discontinue Instagram’s E2EE due to low opt-in rates, coupled with its history of unfulfilled promises regarding default E2EE, suggests a prioritization that may place user convenience or other business considerations above robust, default privacy protections. This approach risks eroding user trust and leaving sensitive communications vulnerable to interception or surveillance.

Conversely, the concerted effort by Apple and Google to integrate E2EE into RCS demonstrates a commitment to privacy by default, even when it involves complex technical challenges and inter-company cooperation. This move not only enhances the security of billions of cross-platform messages but also sets a powerful precedent for the industry. It signals that foundational privacy features, like E2EE, can and should be implemented as standard, rather than as obscure, optional add-ons. The success of this collaboration illustrates that with sufficient political will and technical investment, widespread secure communication is achievable.

Ultimately, the diverging strategies of these tech giants underscore the ongoing debate about who is responsible for protecting user privacy in the digital age. Is it solely the user’s burden to seek out and activate privacy features, or do companies have a fundamental obligation to build privacy into the core of their services by default? The actions of Apple and Google with E2EE RCS suggest the latter, providing a hopeful vision for a more secure and private digital future. It is a call for more companies to embrace these sorts of difficult but necessary steps, ensuring that privacy is not an afterthought but a foundational element of all digital communication.

Key Takeaways

• Instagram has rolled back its opt-in end-to-end encryption for direct messages, citing low user adoption.
• Meta’s decision to discontinue the feature has been criticized for blaming users for not opting into an optional, non-default privacy setting.
• Apple and Google have successfully implemented end-to-end encryption for Rich Communication Services (RCS), securing conversations between Android and iPhone users by default.
• E2EE RCS uses the GSMA RCS Universal Profile 3.0 and Messaging Layer Security protocol, ensuring message content is inaccessible to companies and carriers.
• While E2EE RCS is a significant privacy win, users should be aware of its beta status, carrier dependencies, and potential limitations regarding metadata and cloud backups.
• The contrasting approaches highlight the importance of default privacy features and the responsibility of tech companies to prioritize user security.

Sources

1. [1] Broken Promises: RIP Instagram’s End-to-End Encrypted DMs (www.eff.org)
2. [2] Victory! End-to-End Encrypted RCS Comes to Apple and Android Chats (www.eff.org)

StealthAnon is a news and analysis site covering cybersecurity, privacy, web analytics, anonymity, and tech tools.