It shouldn't be possible for Meta to hand over the data. There should be a wall of privacy between Meta and its users private messages. The company I work for doesn't even have access to customer accounts without the customer's permission.
Technically, unless that data is encrypted with only the end user having access to the key or is being held/mediated by a third party, they do have access. It's only company policy that's preventing access, and a court can shred that policy with a court order on a case by case basis. Same goes for the third party. The end user has to be the only one with the key.
It's late, they should've implemented it back when they took WhatsApp, but it's something. Meta definitely does not want to work with local law enforcement, bad for business.