WhatsApp Web has stopped being merely an extension of the phone's chat. Since late July 2026, Meta began enabling voice calls and video calls, both individual and group, directly from the browser, with no need to download an additional app. The new version also adds features such as screen sharing, a call history, and the ability to move an active call between devices. The rollout is gradual, so the feature may not yet be available to every user.
The update looks simple: a new camera icon, a call button, and the ability to meet from the computer. Inside a company, though, something deeper changes. A tool that already concentrated conversations, documents, instructions and everyday decisions can now also become a meeting room, a customer service channel and a negotiation space.
The issue is not that WhatsApp Web created new legal obligations. Rules on the right to disconnect, data protection, confidentiality and electronic evidence already existed. What changes is how easily an organization can start using the platform for relevant matters without first defining who can use it, during what hours, on which accounts, what information may circulate, and how evidence will be preserved if a dispute arises.
Ease of use can also expose the company
In many organizations, decisions are not always recorded in formal minutes or corporate emails. A manager gives an instruction over WhatsApp, a supplier accepts a condition, a client approves a change, or an executive promises a payment. The tone may be informal, but that informality does not necessarily erase the legal effects of what was communicated.
Colombian Law 527 of 1999 recognizes that information does not lose validity or binding force merely because it takes the form of a data message. It also establishes that a manifestation of will cannot be disregarded solely because it was communicated through electronic means. A conversation held on WhatsApp can therefore acquire contractual, labor, disciplinary or judicial relevance, depending on its content, who took part, and what authority that person had to act.
The arrival of calls and video calls widens that risk zone. An important instruction that used to be written down can now be given verbally. An authorization can be granted during a call with no document created afterward. A meeting with a client can end with commitments that no one formalizes. When a dispute arises, each participant remembers something different, and the company discovers it has no complete record of what happened.
That is why adopting WhatsApp Web as a corporate channel should not depend simply on it being free and convenient. Before using it for negotiations, internal decisions or sensitive matters, an organization should determine what kinds of communications can take place there and which ones require confirmation later through an institutional channel.
A logged call does not necessarily prove what was said
WhatsApp Web now includes a call history section. That log can show that a communication took place, its approximate date, and who was involved. It does not, by itself, prove what the conversation's content was.
This distinction matters. In a judicial proceeding, an internal investigation or a disciplinary process, proving that two people spoke is not the same as proving what instructions were given, what information was shared, or what commitments were made.
Data messages are admissible as evidence, but their weight depends on factors such as the reliability of the method used to generate them, the preservation of their integrity, the ability to identify their author, and the other circumstances of the case. The law also recognizes the importance of retaining information that allows the origin, destination, date and time of a communication to be established.
A screenshot can be useful, but taken alone it usually leaves questions open. It may not show the full context, it may be disputed by the other party, or it may not clearly establish who actually controlled the account. Its value increases when it is supported by the full conversation, a device inspection, metadata, related documents, testimony or any other element that corroborates its authenticity.
A video call is harder still. If the conversation was not recorded, it will need to be reconstructed through testimony, later messages, shared documents or other actions that show what was agreed. The technology makes the meeting easy; it does not guarantee that its content is preserved.
Recording a video call takes more than pressing a button
A person's image, voice, name, phone number and any information shared during a video call can constitute personal data. When a company records, stores, analyzes or shares that communication, it is processing personal information, and that processing must serve a legitimate, disclosed purpose.
It is not enough to keep recordings indefinitely "for security." The organization must determine why it needs them, who can access them, how long they will be stored, how they will be protected, and when they must be deleted. It must also assess whether the person was informed and what legal basis authorizes that processing.
The risk does not end when the call ends. A recording can be copied, sent by mistake, left on a shared computer, or stored in a folder without adequate controls. In those scenarios, the problem is no longer purely technical: it can compromise confidentiality, the participants' privacy, and the company's obligations as a data controller.
In particularly sensitive activities — healthcare, legal advice, financial information, internal investigations or trade secrets — improvised use of WhatsApp Web can expose data the organization had a duty to protect.
Screen sharing can also reveal what no one meant to show
A business video call is not limited to the people on camera. The screen-sharing feature can expose emails, documents, client lists, financial statements, ongoing litigation, medical data or third-party information.
Sometimes the exposure is not a conscious choice. A notification popping up during the meeting, a tab left open by mistake, or the wrong document appearing on screen is enough.
This risk requires distinguishing between a platform available to everyone and a channel authorized to handle restricted information. A company can allow WhatsApp Web for routine coordination while, at the same time, requiring another tool or a stricter protocol whenever the conversation involves confidential documents, sensitive data or strategic decisions.
Convenience should not replace the classification of information.
WhatsApp Web does not eliminate the right to disconnect
Being able to call from any browser does not make an employee available around the clock. Colombian Law 2191 of 2022 defines the right to disconnect as the right not to be contacted about work matters outside working hours, during rest periods, vacations or leaves. The law also requires employers to refrain from issuing orders or requests during those periods and to maintain an internal policy that includes guidelines on the use of information and communication technologies.
A video call through WhatsApp Web outside working hours may feel less formal than a meeting scheduled on another platform, but its impact on the employee can be exactly the same. If a company uses that channel to call meetings, request reports or demand nighttime availability, it must still respect working-hours rules and their exceptions.
The problem grows more delicate when an employee's personal number is used. That mixes family conversations, private information and corporate communications within a single account. Beyond making disconnection harder, the company ends up depending on a device it does not control to preserve evidence or retrieve information once the employment relationship ends.
A personal account should not quietly become a corporate archive
A common practice lets each employee handle clients or suppliers from their personal number. While the relationship lasts, it seems efficient. When the employee changes roles, loses the phone, deletes the conversation or leaves the company, the questions no one asked before finally surface: who owns the contacts? who can access the messages? how is the information recovered? what happens to the documents that were sent? can the company demand a copy of a conversation stored in a personal account?
These tensions are not solved by adding more controls over an employee's private phone. They are reduced by defining upfront which communications must run through corporate accounts, what information must migrate to institutional systems, and which matters cannot remain solely on WhatsApp.
Not every conversation needs to be archived. But instructions, approvals and decisions with legal consequences should not depend exclusively on a personal account.
This is not about banning WhatsApp Web
Banning a tool that is already part of the daily life of employees, clients and suppliers may be unrealistic. The reasonable alternative is to acknowledge how it is used and set understandable limits.
An effective policy does not need to become an endless manual. It should clarify whether WhatsApp Web is an authorized channel, what matters can be handled there, during what hours it may be used, when a decision must be confirmed by email or a formal document, under what conditions a call may be recorded, and what measures should prevent a session from being left open on a shared computer.
There should also be a simple rule for sensitive matters: when a conversation involves personal data, restricted information, relevant instructions or contractual commitments, the convenience of the channel does not replace legal and security controls.
The new calling and video-calling feature makes WhatsApp Web more useful. For that very reason, it also makes it more urgent for companies to stop treating it as a private conversation without consequences.
The question is not whether WhatsApp Web can be used at work. The right question is whether the organization knows what it is authorizing when it decides to use it.
This article is for informational purposes only and does not replace individual legal advice. Bonett Locarno Pumarejo Abogados advises companies and individuals on digital evidence, data protection, employment relations, confidentiality and legal risk management.