This thesis conducts a comparative analysis of two widely used Instant Messaging (IM) applications—WhatsApp and Signal—focusing on three key areas of user privacy: metadata exposure, transport layer encryption, and backup storage security. Despite both platforms employing endto-end encryption (E2EE) to protect message content, our findings reveal significant differences in how each handles user metadata, cloud dependencies, and backup practices. Through empirical testing using tools such as PCAPdroid and Wireshark, we observe that WhatsApp exposes more metadata and communicates with a broader range of third-party domains, while Signal maintains a minimal infrastructure footprint and stronger cryptographic configurations. The study also uncovers varying levels of transport layer security, with Signal consistently favoring stronger cipher suites and local-only encrypted backups. By highlighting these architectural and behavioral differences, the thesis underscores the importance of holistic privacy protection beyond E2EE. These insights aim to support users, developers, and policymakers in understanding how privacy-bydesign principles are (or are not) implemented in mainstream messaging applications.