The removal of end-to-end encryption from Instagram direct messages by May 8, 2026, is ultimately a story about institutional power — about which institutions have the power to shape how people communicate, and how those institutions use that power.
Meta has the power to decide what technical architecture its platforms use. That power was exercised when the company decided to introduce opt-in encryption in 2023, and it is being exercised again in the decision to remove it in 2026. The exercise of this power is subject to limited external constraint — regulatory requirements in some jurisdictions, market pressure from users and competitors, and reputational risk from public criticism. In this specific case, none of those constraints were sufficient to prevent the removal.
Law enforcement agencies have the power to exert institutional pressure on technology companies through public advocacy, legislative lobbying, and direct engagement. That power was exercised over many years in opposition to Instagram’s encryption, and the resulting institutional pressure — while not the sole cause of the removal — was part of the environment that shaped Meta’s decision. The exercise of institutional power by agencies including the FBI and Interpol contributed to an outcome that served their investigative interests.
Users, as a collective, have the power of market choice and political voice. That power has not been effectively exercised in the case of Instagram’s encryption removal — because most users were unaware of the change, and because the individual incentive to switch platforms over a single privacy feature is weak even when users are aware. Collective user power on privacy issues depends on awareness and coordination that have been difficult to achieve.
Regulators have the power to establish and enforce standards that constrain corporate decision-making around user data. That power has not yet been adequately exercised in the Instagram case — the regulatory response has been limited relative to the significance of the change. The adequacy of regulatory power in protecting digital privacy is the central question that the Instagram case raises.