DLP Policy Limitations with WhatsApp in Secure Access

Available Languages

Download Options

  • PDF     (5.2 KB)
    View with Adobe Reader on a variety of devices
  • ePub     (81.1 KB)
    View in various apps on iPhone, iPad, Android, Sony Reader, or Windows Phone
  • Mobi (Kindle)     (65.4 KB)
    View on Kindle device or Kindle app on multiple devices
Updated:August 7, 2026
Document ID:226244

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Contents

Issue

DLP policies in Cisco Secure Access are not detecting or blocking sensitive files when shared via WhatsApp (browser or desktop application), despite HTTPS decryption being enabled. The DLP engine fails to trigger or detect file uploads through these platforms, while the same DLP policies successfully block identical files when uploaded through other online upload tools. When testing basic upload blocking for WhatsApp, the functionality works correctly on both browser and desktop versions, but the issue is specifically isolated to DLP policy enforcement.

Environment

  • Cisco Secure Access

  • DLP Policies configured

  • HTTPS decryption enabled

  • WhatsApp Web and WhatsApp Desktop applications

Resolution

The observed behavior is an expected limitation of WhatsApp and similar platforms due to their end-to-end encryption (E2EE) implementation and non-standard traffic handling. The troubleshooting steps outlined in the next sections and workaround can be implemented.

Troubleshooting Verification Steps

Before implementing the workaround, verify these configuration items:

  • Ensure correct SWG identity/origin ID is configured.

  • Confirm HTTPS inspection/decryption is enabled and not selectively bypassed for the target platforms.

  • Verify Isolation/RBI and Allow-Override settings are properly configured.

  • Confirm AD group membership if DLP policies are group-based.

  • Check Traffic Steering bypass lists for any exclusions.

  • Verify QUIC protocol is disabled in browsers.

  • Check for IPv6 traffic effects that could bypass inspection.

Recommended Workaround

To enable DLP enforcement for WhatsApp Web traffic, implement Remote Browser Isolation (RBI) for traffic destined to WhatsApp Web. This workaround allows DLP policies to be enforced by isolating the browser session and enabling content inspection within the isolated environment.

Configure RBI enforcement specifically for WhatsApp Web domains to ensure that file uploads and content sharing through the web interface are subject to DLP policy evaluation.

Additional Information

A product enhancement request has been documented for this limitation - CSE-I-1249.

Cause

WhatsApp (including WhatsApp Web) and similar collaboration platforms implement end-to-end encryption (E2EE) that prevents full content inspection and scanning of message text and file uploads. Additionally, WhatsApp traffic does not utilize standard HTTP/HTTPS ports in the same manner as typical web uploads, which means the Secure Web Gateway (SWG) cannot intercept and inspect the traffic through the normal HTTPS inspection path. This encryption and traffic handling method is by design and represents an expected limitation of the current DLP inspection capabilities for these specific platforms.

Related Content

Revision History

Revision Publish Date Comments
1.0
07-Aug-2026
Initial Release
TAC Authored

Contributed by Cisco Engineers

  • Amit Arora
    Technical Consulting Engineering Technical Leader

Was this Document Helpful?

FeedbackFeedback

Contact Cisco

This Document Applies to These Products