WhatsApp Web is no longer just an extension of the phone's chat window. Since late July 2026, Meta has begun rolling out voice and video calls, one-on-one and group, directly from the browser. The update also adds call history, cross-device handoff, screen sharing and end-to-end encryption. The rollout is gradual, so the feature may not yet be available to every user.
The change looks harmless enough: open a tab, make a call, keep working. But when WhatsApp Web is left open on someone else's computer, a shared corporate machine or a session nobody closes, an everyday tool can become the setting for unauthorized access to conversations, interception of communications, theft of files, disclosure of personal data or tampering with digital evidence.
The criminal-law risk does not come from using WhatsApp. It arises when someone accesses, intercepts, obtains, retains, alters or discloses information without authorization or beyond the limits they were actually given.
An open session is not unlimited permission
WhatsApp Web often stays open on an office computer, a shared family machine or a borrowed device. The fact that the session is visible on the screen does not mean anyone is free to read the conversations, download documents, copy photographs or use the account.
The Colombian Criminal Code punishes accessing a computer system without authorization or beyond what was agreed. It also covers someone who remains inside a system against the will of whoever has the right to exclude them. The analysis therefore does not turn solely on whether a password was breached — it also matters whether the person exceeded the access they were actually granted.
An employee may be authorized to use a computer without being authorized to log into a coworker's personal WhatsApp account. A partner may know a device's passcode without being authorized to extract private conversations. A technician may be given access to fix a fault without being entitled to review files, chats or calls unrelated to that task.
In each case, the criminal-law line runs through the specific authorization granted, its scope, and what the person did once inside.
Intercepting a call is not the same as taking part in one
WhatsApp Web's new calling features also require distinguishing between listening to one's own conversation and capturing someone else's communication.
The Criminal Code punishes intercepting computer data without prior judicial authorization, whether at the origin or destination of the information or within the system carrying it. It also punishes anyone who unlawfully intercepts, monitors or learns the content of a private communication addressed to another person. If that content is later disclosed or used for personal gain or to harm someone, the criminal exposure can increase.
Not every recording made by a private individual is automatically unlawful or inadmissible. Courts have recognized narrow exceptions allowing a victim to record a conversation they are part of in order to preserve evidence of an offense. But that narrow allowance does not authorize outside third parties to plant listening devices, slip into someone else's session or record private conversations they are not part of. Lawfulness depends on who is recording, how the information was obtained, what expectation of privacy existed, and what it will be used for.
The distinction is decisive: taking part in a call is not the same as intercepting someone else's conversation.
Downloading and disclosing data can also carry criminal weight
WhatsApp Web can hold phone numbers, photographs, identity documents, financial information, medical data, case files, family conversations and company records. Law 1581 of 2012 requires that personal data be handled in line with principles such as purpose, freedom, security, restricted access and confidentiality.
Some conduct, however, can go beyond a regulatory breach and reach criminal law. Article 269F of the Criminal Code punishes anyone who, without authorization and for their own benefit or a third party's, obtains, compiles, removes, offers, sells, exchanges, sends, intercepts, discloses, alters or uses personal data held in files, databases or similar records.
It is not enough to say the information "was already open" or was found by accident. What matters is what the person did after seeing it — whether they copied it, shared it, used it to pressure someone, gained an advantage, or caused harm.
The conduct can be especially serious when it exploits the trust of whoever handed over the device, when a contractual relationship is involved, or when the information is disclosed to someone's detriment — circumstances treated as aggravating factors under the cybercrime provisions.
Call history proves a call happened, not what was said
WhatsApp Web includes a call-history tab. That record can help show that a communication took place, identify linked accounts and fix a timeline. It does not automatically prove what was said during the call.
In a criminal investigation, whether a call happened and what was said on it are two different questions. The content can be reconstructed through a lawful recording, later messages, shared documents, witness testimony, metadata or conduct consistent with what was discussed.
Law 527 of 1999 recognizes the admissibility of data messages and bars denying them legal effect merely for being electronic. Even so, their evidentiary weight depends on conditions such as integrity, preservation, origin, destination, date, time and the reliability of the method used to generate them.
A single screenshot can be useful, but it can also be challenged for lack of context, attribution or integrity. When a WhatsApp conversation may matter to a complaint or a defense, it is prudent to preserve the device, avoid unnecessary changes, document how the information was obtained, and keep the original files.
The worst move is usually editing the conversation, forwarding it repeatedly, or reconstructing it solely from cropped screenshots.
Digital evidence can make a case or break it
In matters involving threats, extortion, fraud, harassment, corruption, impersonation or disclosure of private information, WhatsApp can hold a decisive share of the evidence. But the existence of messages or calls does not substitute for legal analysis.
A serious criminal-law strategy must establish who controlled the account, who had access to the device, how the content was obtained, whether there was authorization, whether the information was altered, and how it relates to the facts under investigation.
The lawfulness of the evidence must also be examined. Evidence that looks conclusive can still be excluded if it was obtained through an intrusion incompatible with privacy or due-process guarantees — a debate that, in the most complex cases, can end up being argued all the way to criminal cassation and other extraordinary remedies. Constitutional case law has repeatedly held that recordings made in private settings without consent or a judicial order can violate privacy, without prejudice to the narrow exceptions developed for victims seeking to preserve evidence of an offense.
The point is not to distrust all digital evidence. It is to understand that its usefulness depends as much on what it shows as on how it was obtained and preserved.
A tech update with familiar criminal-law consequences
WhatsApp Web's calls and video calls do not create new offenses. What they do is move familiar risks into a browser tab: unauthorized access, interception of data, unlawful violation of communications, disclosure of personal information, and irregular collection of evidence.
Ease of use can create a false sense that no limits apply. But an open session is still private; an accessible account is not available to just anyone; and an important conversation does not automatically become valid evidence simply because it happened over WhatsApp.
When an account, a call or a conversation may be connected to a criminal investigation, acting quickly on the evidence matters. So does avoiding further access, impulsive posts or edits that later make it harder to prove where the evidence came from and that it has not been altered.