WhatsApp to soon use AI to summarise your chats, but it doesn't read your chats. How is it possible?

Meta is set to roll out AI-powered features like message summarisation and writing suggestions to WhatsApp users, but with a twist. Unlike other platforms where user data is routed through AI models on external servers, WhatsApp is using a technology called Private Processing, designed to ensure that your encrypted chats stay unreadable even to Meta.

Why This Matters

WhatsApp, used by over two billion people globally, has long prided itself on end-to-end encryption. That’s made implementing advanced AI features particularly challenging, since most AI tools require access to data on cloud servers. Meta’s Private Processing aims to solve this by creating a secure environment for AI to operate in, without ever exposing user messages.

How Private Processing Works

At its core, Private Processing is built on confidential computing infrastructure using a Trusted Execution Environment (TEE), essentially a secure enclave that ensures data remains invisible during processing. The system operates in six stages:

1. Authentication: The WhatsApp client verifies itself using anonymous credentials.
2. Oblivious Routing: Requests are routed through a third-party relay to hide IP addresses from Meta or WhatsApp.
3. Secure Session: A Remote Attestation TLS connection ensures only verified, transparent code runs in the TEE.
4. End-to-End Encryption: Message summaries or suggestions are requested using keys inaccessible to Meta or any third party.
5. Confidential AI Processing: AI runs inside a Confidential Virtual Machine (CVM) that never stores messages.
6. Encrypted Response: Only the user’s device can decrypt and view the AI-generated output.

Once the session ends, the system immediately forgets all message content. This stateless design ensures forward security, attackers can’t retroactively gain access even if they compromise the system later.

Designed for Transparency, Not Just Security

Meta has outlined three "foundational requirements" that define Private Processing:

1. Confidential Processing: No access to user data, even during transit or processing.
2. Enforceable Guarantees: If the system is modified, it fails by design or becomes visibly unverifiable.
3. Verifiable Transparency: Researchers and users can audit the system to ensure it behaves as promised.

In short, the company wants users to be able to verify Meta’s privacy claims rather than just trust them.

Addressing Real-World Threats

The system is built with a detailed threat model in mind. Meta has considered attacks from malicious insiders, compromised supply chain vendors, and even users trying to target others.

Attack scenarios include zero-day exploits, prompt injection in AI, and hardware-level vulnerabilities. Meta says it’s mitigating these risks with hardened binaries, containerised environments, and strict observability controls to prevent logs from leaking data.

First Use Cases and What’s Next

The first wave of AI features enabled by Private Processing will be optional tools like summarising unread WhatsApp messages, and providing AI-assisted writing suggestions.

These features are expected to begin rolling out in the coming weeks, but only at the user’s direction — nothing is automatic or turned on by default.

Meta believes this infrastructure could eventually power other secure AI interactions on its platforms. The launch of Private Processing marks a significant shift in how tech giants can handle sensitive data while still offering next-gen AI features.