WhatsApp ‘Delete for Everyone’ Doesn’t Always ‘Delete For Everyone’

WhatsApp, the world’s most popular chat and messaging app, offers a “Delete for Everyone” feature that allows users to ostensibly delete messages, pictures, and videos from users and groups to whom the materials were sent, thereby saving users from all sorts of embarrassment and other problems that can develop if they inadvertently send various items to the wrong person.

But, “Delete For Everyone” does not always actually delete for everyone…

By default, WhatsApp stores all images and videos received by a user in that user’s camera roll (i.e., an iPhone device’s Camera Roll or an Android device’s Media Gallery). As reported in The Hacker News this week, security researcher, Shitesh Sachan, found that while WhatsApp will delete images from Android camera rolls if a user invokes the “Delete for Everyone” feature, it will not delete images or videos from iPhone camera rolls – meaning that, by default, many materials that users request to be deleted, if not most of them, actually remain on recipients’ Apple devices.

Furthermore, I have confirmed that even on Android, if a user simply moves WhatsApp images to another folder – and even if that folder has the same name – WhatsApp will also not delete the images; such an issue is not trivial – due to the default copying of images and videos by WhatsApp to the camera roll, the relevant WhatsApp folders tend to consume quite a bit of memory, and many Android users regularly move items from these folders to memory cards in order to preserve maximum internal memory.

Of course, if an image or video has been copied from a WhatsApp folder to other devices – such as home computers or laptops – or has been captured in a screen capture – all bets are also off .

What is perhaps most concerning about this vulnerability is that even when WhatsApp does not delete images or videos from a camera roll, invoking “Delete For Everyone” will cause it to display a message saying “This message has been deleted.” – while the intent may be that the message has been deleted from the WhatsApp chat session and not from camera rolls, many people may be unaware that the delete is incomplete – especially since some folks have seen files deleted from camera rolls when using this feature and others may not even realize that by default WhatsApp images and videos are automatically copied elsewhere.

While WhatsApp’s inability to delete the relevant images and videos (and chat information in the case of screenshots) is clearly the result of factors beyond its control (including Apple’s security features), it would be best to warn users more clearly of the incomplete nature of any Delete function whenever they invoke it, and whenever its existence is publicized.

And, in any case, here is the bottom line – never rely on the ability to delete messages or images after sending them. Of course, you should invoke such features if you discover that you mis-sent something – possible and partial protection is better than none – but, always assume that once something has been sent out, it’s out. So think before sending.