Short answer: Tracking the "last seen" or "online" status that WhatsApp already shows you is generally lawful when you observe your own contacts and your own account, because you are reading a signal the app voluntarily publishes. It crosses a legal line when you do it covertly to someone who has a reasonable expectation of privacy, install monitoring on a device you don't own or control, or try to defeat their privacy settings. Rules vary by jurisdiction, so treat this as general information, not legal advice.
The confusion comes from one word: "tracker." People hear it and picture spyware reading messages, pulling location, or unmasking someone who hid their activity. A presence tracker like Suna does none of that. It logs the same green "online" dot and "last seen at…" timestamp any contact can see in the chat window — nothing private, nothing decrypted, nothing hidden. The legal question, then, is less about the technology and more about who you watch and whether they could reasonably expect not to be watched.
The signal you're tracking was published by WhatsApp, not stolen
WhatsApp exposes two presence signals to your contacts by default: "online" while the person has the app open, and "last seen" with a timestamp when they leave. Per WhatsApp's own Help Center, every user controls who sees these under Settings > Privacy > Last Seen and Online, with options for Everyone, My Contacts, My Contacts Except…, and Nobody. There is also a reciprocity rule WhatsApp documents plainly: if you hide your own last seen, you cannot see anyone else's. Telegram works similarly — its FAQ describes "Last Seen & Online" privacy with Everybody / My Contacts / Nobody tiers, plus exception lists.
That reciprocity rule matters for the legal framing more than people realize. A presence tracker cannot reveal someone who has set their last seen to "Nobody." If the timestamp isn't visible to you inside WhatsApp, it isn't visible to any tool reading WhatsApp either. So the honest claim is narrow: a tracker organizes and timestamps a public-by-the-user's-choice signal. It does not pierce a private one.
Claim: A last-seen tracker can only record presence the target has chosen to make visible.
Evidence: WhatsApp Help Center documents that last-seen visibility is user-controlled and reciprocal — hiding yours removes your ability to see others'.
Limit: This does not mean tracking a contact who left their status public is automatically appropriate or legal everywhere; consent and local law still apply.
Action: Before tracking anyone, confirm you have a legitimate basis — your own account, or a person who knows and agrees.
A consent-tier framework: where the line actually sits
Most "is it legal?" arguments fail because they lump three very different activities into one word. Here is the framework we use to keep them separate, ordered from clearly fine to clearly unlawful in most places.
| Tier | What it accesses | Typical legal posture | Does Suna do this? |
|---|---|---|---|
| 1. Public presence data | The "online" / "last seen" signal a user already broadcasts to contacts | Generally lawful to observe, especially your own account or with consent | Yes — this is the only thing it does |
| 2. Message content | Texts, media, calls — protected by end-to-end encryption | Intercepting another person's content is illegal in many jurisdictions | No — refuses, and is technically incapable |
| 3. Covert device spyware | Hidden software reading anything on a phone you don't own | Often criminal; banned by app stores | No — refuses |
The first tier is what a presence tracker lives in, and it is the only defensible one. The contrarian point worth stating out loud: the more a "tracker" promises — read their messages, see who they chat with, track them secretly — the more it is describing illegal stalkerware, not a presence tool. Apple's App Store Review Guidelines and the Google Play Developer Policy both restrict covert monitoring apps; Google Play specifically calls out stalkerware that tracks a person without their knowledge. So a tool that openly promised tier-3 capabilities could not stay listed honestly. If a product brags about defeating privacy settings, that is the tell.
What Suna refuses to do — on purpose
Being explicit about limits is the trust signal, not a weakness. Suna observes WhatsApp and Telegram presence — when an account appears online, when it goes offline, and the patterns across a day. It does not, and cannot:
- Read messages, photos, or call content. WhatsApp content is end-to-end encrypted, and Suna sits entirely outside that.
- Reveal a contact who has set last seen to "Nobody." If WhatsApp hides it, Suna sees nothing.
- Install on or take over a device you don't control. There is no hidden agent on the target's phone.
- Bypass any WhatsApp or Telegram privacy setting. The reciprocity and visibility rules apply unchanged.
You can read the plain-language version of exactly what is and isn't logged on Suna's what-we-track page. The framing there is deliberately conservative: presence in, content never.
Consent is the variable that actually decides legality
Strip away the tech and the law tends to ask one thing: did the person have a reasonable expectation of privacy, and did you respect it? Watching your own account's activity is uncontroversial. Watching a partner's account in secret, or an employee's personal phone, is where privacy and anti-surveillance statutes get involved — and those rules differ sharply by country and even by state or province.
Two anchors, both general, both worth checking against your local law:
- In the EU, GDPR treats behavioral and presence data about an identifiable person as personal data, normally requiring a lawful basis such as consent. Monitoring someone covertly rarely has one.
- In the US, the FTC has acted against covert monitoring ("stalkerware") apps, and several states have specific electronic-surveillance and anti-stalking statutes. The legality of tracking another adult's device without consent is frequently a problem under these.
For families, the clean path is consent in the open. If you want to keep an eye on a younger child's online habits, do it with their knowledge as part of a household agreement, not in secret. The same principle carries to location: families who want consent-based location sharing alongside presence awareness often pair Suna with its sibling app for family location, Luna, where everyone in the circle knows they're part of it. Disclosure isn't just ethical here — in many jurisdictions it's what keeps the activity lawful.
FAQ
Is it legal to track someone's WhatsApp last seen without them knowing?
It depends on your jurisdiction and your relationship to the person. Observing a contact's publicly visible last seen is different from covert surveillance of someone with a reasonable expectation of privacy, which can breach privacy or anti-stalking laws. In the EU, GDPR generally requires a lawful basis; in the US, the FTC and various state laws restrict covert monitoring. Get consent, or limit tracking to your own account. This is general information, not legal advice.
Can a tracker see messages or who someone is chatting with?
No. WhatsApp messages and calls are end-to-end encrypted, so a presence tracker has no path to content — and Suna does not attempt it. A legitimate tracker logs only the online/last-seen signal WhatsApp already shows your contacts. Any product claiming to read messages is describing spyware, which is restricted by both Apple's and Google's app store policies.
What if the person hides their last seen?
Then there is nothing to track. WhatsApp's reciprocity rule, documented in its Help Center, means a hidden last seen is invisible to everyone — and to any tool reading WhatsApp. A tracker cannot defeat the "Nobody" privacy setting; it sees exactly what a normal contact would see, which in that case is nothing.
Are last-seen tracker apps allowed in the App Store and Google Play?
Presence-awareness tools can be listed when they stay within visible data and don't enable covert surveillance. Both Apple's App Store Review Guidelines and the Google Play Developer Policy restrict hidden monitoring and stalkerware. The dividing line is transparency: tools that observe public presence with the user's awareness differ from apps built to spy on a non-consenting person.
How to decide
Ask two questions before you track anything. First, whose presence is it — your own account or a person who knows and agrees? If neither, stop. Second, are you trying to see something the person chose to share, or something they tried to hide? If you're reaching for hidden content or trying to beat a privacy setting, no app should help you, and most laws won't either. Stay in tier one, keep it consensual, and a last-seen tracker is a simple awareness tool — not surveillance. If you need to verify how a specific rule applies to your situation, check your local privacy and electronic-communications law or ask a qualified lawyer.