Meta Removes End-to-End Encryption From Instagram DMs as Take It Down Act Deadline Approaches
Meta will strip end-to-end encryption from Instagram direct messages on May 8, citing low adoption, just eleven days before the Take It Down Act compels platforms to police intimate content.
Overview
Meta will discontinue end-to-end encryption for Instagram direct messages on May 8, 2026, the company confirmed in March. A Meta spokesperson told Engadget that “very few people were opting in to end-to-end encrypted messaging in DMs, so we’re removing this option from Instagram in the coming months.” The decision reverses a feature introduced roughly two years ago and arrives eleven days before the Take It Down Act begins enforcement on May 19, raising questions about whether regulatory pressure rather than user adoption is driving the change.
What We Know
Instagram’s end-to-end encryption was never enabled by default. Users had to opt into the feature on a per-chat basis, and it was available only in select markets. Meta has not disclosed how many users activated the option, offering only the characterization that adoption was minimal. Users with active encrypted conversations will receive in-app notifications with instructions for downloading their messages and media before the cutoff, according to Newsweek.
After the feature is removed, Instagram messages will be protected only by transport-layer encryption, meaning Meta’s servers will be able to read, store, and analyze message content. The company directed privacy-conscious users to WhatsApp, where end-to-end encryption remains the default. “Anyone who wants to keep messaging with end-to-end encryption can easily do that on WhatsApp,” the spokesperson said.
Meta’s approach to encryption now varies sharply across its own platforms. Messenger began rolling out end-to-end encryption by default in December 2023 and continues to expand the feature. WhatsApp has offered default end-to-end encryption since 2016. Instagram, in contrast, is moving in the opposite direction.
The Regulatory Context
The timing has drawn scrutiny. The Take It Down Act, signed into law in 2025, requires platforms to remove non-consensual intimate imagery, including AI-generated deepfakes, within 48 hours of a valid request. Enforcement begins May 19, 2026. As Fortune reported, the eleven-day gap between Instagram’s encryption removal and the law’s enforcement date suggests Meta is positioning itself to comply with content policing obligations that are difficult to fulfill when messages are end-to-end encrypted.
TikTok has taken an even harder line. The platform confirmed it has never offered end-to-end encryption for direct messages, with a spokesperson telling Fortune that its messaging uses only “industry-standard encryption in transit and at rest” because the design “helps make our platform undesirable for those who would attempt to share illegal material.”
The UK’s Online Safety Act adds further pressure. While the government stated in 2023 that powers allowing Ofcom to compel platforms to break encryption would not be exercised immediately, the provisions remain in the statute. Platforms retaining end-to-end encryption face potential fines and service restrictions in the UK.
Privacy Advocates Push Back
The Global Encryption Coalition, whose steering committee includes the Center for Democracy and Technology, the Internet Society, and Mozilla, issued a statement on April 8 calling on Meta to reverse the decision. The coalition argued that low uptake of an opt-in feature that was not widely promoted does not justify its removal, and that “the correct policy response is to make E2EE the default.” The statement described encryption as “fundamental to safety and the exercise of human rights” and warned that removing it sets a dangerous precedent as governments worldwide push for access to encrypted communications.
The Electronic Frontier Foundation has taken a broader stance. Its “Encrypt It Already” campaign, launched in January 2026, targets six technology companies, including Meta, for failing to expand encryption protections. The campaign identifies multiple Meta products where encryption remains incomplete, including Facebook group messages and WhatsApp cloud backups, which are not encrypted by default.
What We Don’t Know
Meta has not released any data on actual encrypted DM usage on Instagram, making it impossible to independently verify the company’s claim that adoption was minimal. The company has also not addressed whether the removal was influenced by regulatory requirements under the Take It Down Act or the UK Online Safety Act, nor whether it evaluated making encryption the default rather than removing it entirely.
It remains unclear how the change will affect the approximately two billion Instagram users globally. Meta has not detailed what new content moderation capabilities it plans to deploy once it regains access to message content, or whether message data will be incorporated into its advertising targeting systems.
The broader trajectory is also uncertain. Meta continues to expand encryption on Messenger and maintain it on WhatsApp, but the Instagram reversal raises the question of whether regulatory and commercial pressures will eventually erode encryption protections across other Meta products as well.