Instagram ended end-to-end encrypted DMs — what it means for your customer conversations
Since May 8, 2026, Instagram no longer offers end-to-end encryption for direct messages. What changed, why Meta says it did it, and how to keep customer conversations private on your side.
In 2023 Instagram started offering optional end-to-end encryption (E2EE) for direct messages. On May 8, 2026, Meta switched it off. Chats that used the optional encrypted mode lost that protection. Instagram DMs are still encrypted in transit, but not end-to-end — which means Meta can technically access their content.
Why Meta made the change
Meta told The Verge that “very few people” were using encrypted DMs on Instagram. Commentators have also pointed to the cost of running two separate messaging systems and to new legal duties around harmful content, such as the U.S. Take It Down Act, whose enforcement deadline fell in the same month — although Meta has not linked the two.
What it means for businesses
- Business messaging through the Instagram API was never end-to-end encrypted — your DMs already travelled through Meta’s servers to your inbox tool. Day-to-day, nothing changes for how you send and receive.
- What changes is the expectation. Customers who share addresses, order details or photos over DM should be treated as sharing them with a platform that can read them.
- Where your copy of those conversations lives now matters more than ever — on a vendor’s cloud, on a shared phone, or on your own computer.
For payments, IDs or medical details, send the customer a secure payment or document link instead of asking for the details in chat. Use DMs for the conversation, not the paperwork.
How ThreadWave handles Instagram data
ThreadWave stores Instagram conversations and media encrypted on your own computer. New messages pass through our relay only long enough to reach your app, and files you send are hosted for at most an hour so Instagram can fetch them, then deleted. There is no ThreadWave cloud archive of your customers’ DMs.
Checklist for your team
- Update your privacy notice if it describes Instagram DMs as end-to-end encrypted.
- Tell agents which details must never be requested over Instagram.
- Decide where your conversation history lives and who can access it — and set a retention period.
- Use secure links or forms for payments and personal documents.