The removal of end-to-end encryption from Instagram direct messages by May 8, 2026, is an occasion to step back and assess a decade of digital rights progress — what was achieved, where the movement fell short, and what the current moment tells us about the state of the fight for digital privacy.
The decade saw genuine achievements. The European Union’s General Data Protection Regulation, which came into force in 2018, established the most comprehensive data protection framework in the world and has influenced privacy law globally. Public awareness of surveillance capitalism and corporate data practices increased dramatically, driven by major scandals and the work of advocates, journalists, and researchers. A generation of digital rights organizations developed the expertise and policy capacity to engage meaningfully with regulatory processes.
The decade also saw persistent failures. Despite GDPR and its equivalents, major platforms continued to expand their data collection capabilities, often through design choices that technically complied with legal requirements while undermining their spirit. Voluntary corporate privacy commitments — including Meta’s 2019 encryption promise — were made and broken without the regulatory accountability that would have made them durable. User awareness of digital privacy issues, while higher than before, has not consistently translated into the kind of political engagement that drives structural change.
The Instagram encryption removal sits at the intersection of these achievements and failures. It is partly a failure of regulatory frameworks that should have prevented this kind of quiet rollback. It is partly a consequence of the commercial structures that digital rights advocates have long identified as incompatible with genuine privacy protection. And it is, potentially, an achievement waiting to happen — if it generates the regulatory and public response that its significance warrants.
A decade of digital rights progress has created the conditions for a more effective response to decisions like Instagram’s encryption removal than would have been possible ten years ago. Whether those conditions are used effectively will determine the shape of the next decade.