WhatsApp Launches End‑to‑End Encrypted Voice & Video Calls on the Web
What Happened — WhatsApp announced that users can now place and receive voice and video calls directly from a web browser. The feature includes end‑to‑end encryption, a waiting‑room control for group calls, call transfer across devices, and background‑noise reduction. Roll‑out begins this week and will be global.
Why It Matters for Compliance & Audit Readiness
- Expanding a communication service to the browser introduces new data‑processing contexts that must be covered by privacy controls (consent, data‑subject rights, retention).
- End‑to‑end encryption helps meet SOC 2 CC6 (Confidentiality) but auditors will look for documented evidence that encryption is applied consistently across all platforms.
- The “Waiting Room” feature creates a consent checkpoint; organizations need to map this to their privacy policy and demonstrate it in a Trust Center audit artifact.
Who Is Affected — Consumer messaging platforms, enterprise collaboration tools, and any organization that allows employees to use WhatsApp Web for business communications (tech‑SaaS, education, finance, etc.).
Recommended Actions
- Update your privacy impact assessment (PIA) to include the web‑calling flow and the new waiting‑room consent step.
- Verify that end‑to‑end encryption keys are managed per your key‑management policy and document the process for audit evidence.
- Incorporate the web‑calling feature into your continuous‑compliance monitoring dashboard to capture usage logs, consent events, and any data‑subject requests.
Technical Notes – The web client uses WebRTC with DTLS‑SRTP for media encryption; calls are encrypted on the device before leaving the browser. No new CVEs were disclosed. Source: Help Net Security