End-to-end encryption ensures the confidentiality of message contents such that only the parties involved in the conversation can decrypt them and view their contents. Where end-to-end encryption is done well, the messaging app cannot just decrypt messages and access their texts, pictures, or conversations.
For instance, WhatsApp claims that personal messages and calls are end-to-end encrypted. However, encryption does not necessarily conceal all usage patterns. Messaging apps may gather metadata, which refers to communication information as opposed to its content.
Such metadata differs depending on the messaging app but may include account information, phone number, device information, IP address, connect times, and group information. The messaging apps may also process some feature usage information for purposes of reliability and to guard against any abuse.
For instance, an app may determine that a certain account was connected to its servers at a certain time without knowing the content of the message encrypted and exchanged via that connection.
Even where the actual message contents are kept confidential, the metadata can help uncover patterns. It can tell something about communication habits in terms of repeated connection times or group memberships. Yet, at the same time, metadata is unlikely to tell what was discussed and for what reason.
Each app uses this information differently. In particular, Signal states that its goal is to collect minimum possible information and thus reduce the risk of leaks. WhatsApp explains that it gathers some information about accounts and some technical data, yet the contents of personal messages stay protected by end-to-end encryption.
Yet there are other limitations to be aware of. Encryption is powerless against the user who wants to make a screenshot or share the content. Moreover, in case the phone is unlocked or somehow compromised, it can be used to get access to the stored messages. The privacy rules for backups and business communications also differ.
The main idea is that encryption does not equate complete anonymity. In order to know about privacy guarantees provided by the messaging app, one should consider encryption and data collection, set up proper settings, and protect the device.
