Delivering privacy, safety & security for billions of humans

Overview

Goals

The goal for this work was to create an attribution framework that helps people adjust to differing privacy expectations across a growing number of chat types with minimal disruption and appropriate reassurance.

Create alignment

Align on the problem space and audit existing privacy patterns across Meta products.

Increase privacy understanding

Create understanding of privacy differences across chat types.

Increase user trust & confidence

Help people feel aware and in-control of their privacy.

Initial findings

Early attempts at attribution created a lot of confusion and concern during testing:

1. Privacy expectations vary a lot among users
   Many see the value of encryption but they’re more worried about social rather than data privacy.
2. People expect security updates to happen in the background
   There was an expectation that end-to-end encryption wouldn’t affect their product experience.
3. Encryption isn’t viewed positively in many countries
   Different markets and cultures have different sentiments towards encryption, causing scale-blocking regression in some countries.
4. Lack of context is a disruption
   Users are disrupted by attribution when there are no contextual clues. In early tests people would delete encrypted threads because they didn’t like the attribution styling.

Explorations

Privacy and the attention demand scale

When is attribution too little so as to be confusing, vs. too much as to be a distraction?

Meeting Meta’s privacy disclosure obligations while also meeting user’s needs was achieved by defining a scale for how we demand attention based on the level of risk. This helps us determine when we need to provide contextual “pull levers” for users to learn more, vs. prominent “push levers” when we need to notify users of a security change.

By breaking the user journey down to the moments that matter, we can build trust and understanding.

Moments that matter

With a sense of the core moments to be providing transparency and awareness of the privacy state across chat types, I began exploring the different levers of push and pull information. A key restraint was to not introduce complexity that distracts from the core messaging experience, and it was an exercise in finding opportunities to reinforce the privacy setting contextually and subtly within the design system.

Solution

Launched in 2024

Because this was such a big change to the Messenger and Instagram platform, the end-to-end encryption update happened in stages. Not all private chats were becoming encrypted at once, and users would see chats “cutover” over time. Additionally, to sync between platforms, Meta had to introduce a new PIN code system to maintain chat parity between surfaces.

Messenger began rolling out default end-to-end encryption for personal messages and calls in 2023, and it was fully implemented across the platform in 2024.