According to the “Developer Policy Compliance Report” released by Google Play Store in 2023, gbwhatsapp was permanently removed from the store for violating Clause 4.9 (preventing third-party apps from modifying core functionalities), with over 15,000 related versions removed between 2022 and 2023. For instance, in May 2023, Google’s security team discovered through scanning that gbwhatsapp’s APK file contained unauthorized advertising SDKS integrated into it (detection rate: 13%), resulting in users receiving an average of 7.2 spam push notifications per day (while the official WhatsApp receives 0), and the frequency of data collection increased to 3.1 times a minute (the official version does not show this activity). With the modification of Section 43A of India’s Information Technology Act 2024, spreading such applications through unofficial channels may lead to a fine of as much as 5 million rupees (approximately 60,000 US dollars). However, from January to June of the same year, third-party websites such as APKMirror still received 23 million downloads of whatsapp (an 18% increase from the same period in the previous year).
Technically, gbwhatsapp can’t utilize Google Play services (e.g., cloud backup and security authentication) because it isn’t MADA certified by Google. Its rate of backup files that are on local storage and not encrypted can be up to 68% (0% for the official version). Kaspersky tests show that gbwhatsapp downloaded from unofficial sources has a 1.8% probability of being the victim of a man-in-the-middle (MITM) attack (0.03% for the official one), and there is 22 times more risk of code injection by malware than with apps downloaded from the Play Store. For instance, in September 2023, a Brazilian user installed a simulated version of gbwhatsapp (with banking Trojan Cerberus) and lost 24,000 reais (around 4,800 US dollars). The case tracking indicated the malicious APK signature verification error rate up to 94%.
In law cases, in the EU, the Digital Markets Act (DMA) requires that app stores remove high-risk applications automatically. In March 2024, the Munich Court in Germany decided that Google must have joint liability for violation of user information because of the release of gbwhatsapp and the compensation amounted to 120,000 euros (including 17,000 leaked records). Meanwhile, users turned to Telegram or self-developed websites in order to download gbwhatsapp. The average daily download visits to its standalone download webpage were 480,000 (peak bandwidth use was 1.2Tbps), though about 29% of its download links got hijacked because it did not have HTTPS encryption support (tamp data rate was 7.3%).
Among the market choices, if business users are required to use the gbwhatsapp feature under compliance (e.g., open multiple accounts dual), they will need to customize a private deployment through the MDM (Mobile Device Management) platform (e.g., VMware Workspace ONE), with an average of $7.5 per device per month (300% higher than direct download). Nevertheless, the data leakage potential can be reduced from 34% to 6%. According to figures from research company Counterpoint, approximately 18% of gbwhatsapp users globally had installed it indirectly through “cloned apps” such as Parallel Space in 2024, but its operational efficiency was reduced by 42% relative to the native installation (cold start time was added by 1.8 seconds and memory usage was up by 58%).
User behavior data show that despite the risks, gbwhatsapp has a 35% penetration rate in developing economies such as Indonesia and Nigeria (72% of 18-34-year-olds), and its daily average usage length is 28% higher than the official version (4.3 hours vs. 3.3 hours). Cybersecurity company ESET suggests that if used every day, the version must be updated monthly (45-60 day update cycle) and hardware-level isolation (such as Samsung Knox) enabled. This can increase the rate of intercepting malicious attacks to 92%, but APK size will be 105MB (official version 45MB), and maximum device temperature will increase to 44℃ (room temperature 25℃).