Meta’s March 2026 decision to remove end-to-end encryption from Instagram direct messages has reopened fundamental questions about privacy of social media communication under California law. This program examines what the CCPA requires of businesses handling user communications, where the definition of “personal information” draws the line, and how platform terms of service interact with statutory protections. The program brings current case law and regulatory guidance to the discussion, which extends to connected devices and the unresolved question of third-party exposure when recordings capture more than the consenting user. The program also takes on broader questions the law has yet to answer, including whether federal frameworks built for telephone communication are adequate for an era of direct messaging and ambient recording.
