WhatsApp may be in trouble over data sharing

WhatsApp and Facebook May Be in Trouble Over Data Sharing PoliciesIn late August, WhatsApp announced that it would begin sharing data with its parent company, Facebook.  Since the announcement, a number of WhatsApp customers, as well as certain privacy groups, have cried foul.  Privacy group EPIC responded to the data sharing announcement by filing a complaint against the two companies with the FTC.  The FTC responded to EPIC’s complaint by issuing a stern warning to the companies, as well as informing EPIC that it will investigate the complaint, which contains allegations over the proposed data sharing between the two companies.

WhatsApp and Facebook Made Promises to Users Over Data Sharing and Privacy

In 2014, when Facebook announced its plan to purchase WhatsApp for $16 billion, both companies promised consumers that WhatsApp’s stringent privacy practices would remain unchanged.  In a blog post, WhatsApp said, “Respect for your privacy is coded into our DNA, and we built WhatsApp around the goal of knowing as little about you as possible.  If partnering with Facebook meant that we had to change our values, we wouldn’t have done it.”  Additionally, WhatsApp said:

By coordinating more with Facebook, we’ll be able to do things like track basic metrics about how often people use our services and better fight spam on WhatsApp. And by connecting your phone number with Facebook’s systems, Facebook can offer better friend suggestions and show you more relevant ads if you have an account with them.

Did the FTC See This One Coming?

Even though privacy advocates were skeptical of the deal, the FTC cleared the deal, but warned Facebook against loosening WhatsApp’s privacy policies.  In a letter, the FTC noted that WhatsApp had made certain privacy promises to its customers, and that both companies had told consumers that after any acquisition, WhatsApp will continue its current privacy practices.

“We want to make clear that, regardless of the acquisition, WhatsApp must continue to honor these promises to consumers. Further, if the acquisition is completed and WhatsApp fails to honor these promises, both companies could be in violation of Section 5 of the Federal Trade Commission (FTC) Act and, potentially, the FTC’s order against Facebook,” the FTC’s letter said.

FTC Reminds Facebook About Prior Consent Decree

The letter also told Facebook not to retroactively change WhatsApp’s data policies without first obtaining users’ express consent.  Additionally, the letter instructed Facebook not to draw on data it had collected about users for ad purposes, without obtaining the users’ opt-in permission.  Finally, the letter reminded Facebook that it was still subject to a consent decree, which requires Facebook to obtain users’ express consent before sharing their information beyond what its privacy policy allowed for when users uploaded the data.  Violations of the consent decree could result in fines of $16,000 per instance.

WhatsApp Announces Changes to Privacy and Data Sharing Policies

Even though both companies made promises to their users over data use and privacy, WhatsApp announced late last month that it will begin sharing information about its users, including phone numbers, with Facebook.  Facebook intends to draw on those phone numbers to make friend suggestions to WhatsApp users, as well as send those users ads based on Facebook data.  Facebook will also purportedly use the users’ phone numbers for other purposes, including analytics and fighting spam.

As part of its data sharing announcement, WhatsApp said it will allow users to opt-out of receiving targeted ads and from receiving friend suggestions based on phone numbers.  However, WhatsApp will not allow users to opt-out of sharing their phone numbers with Facebook.

EPIC Files Complaint With the FTC

In light of the announcement by WhatsApp, certain privacy advocates accused company of reneging on its promises to its users, including EPIC, who filed a complaint against both companies with the FTC.  In its complaint, EPIC set forth:

WhatsApp built a user base based on its commitment not to collect user data for advertising revenue. Acting in reliance on WhatsApp representations, Internet users provided detailed personal information to the company including private text to close friends. Facebook routinely makes use of user information for advertising purposes and has made clear that it intends to incorporate the data of WhatsApp users into the user profiling business model. The proposed acquisition will therefore violate WhatsApp users’ understanding of their exposure to online advertising and constitutes an unfair and deceptive trade practice, subject to investigation by the Federal Trade Commission.

FTC to Investigate EPIC’s Complaint

The FTC responded by sending the aforementioned letter to the two companies, as well as sending a letter to EPIC regarding its intention to investigate EPIC’s complaint.  In the letter to EPIC, the FTC said that its “staff will carefully review [EPIC’s] complaint;” even though the FTC said it could “neither confirm nor deny that we are conducting an investigation of the issues raised by [EPIC’s] complaint.”  The FTC recounted the following regarding EPIC’s complaint:

Your complaint contains allegations regarding the data collection, use, combination, and sharing practices of WhatsApp user data, such as mobile phone number and other account information, with Facebook.  Your complaint also contains allegations regarding statements WhatsApp has made about how it limits the use of mobile phone number or other personally identifiable information as well as its sharing information with Facebook.

Facebook Responds to Question About FTC Rules

In response to a question about the FTC rules, Facebook provided the following statement:

WhatsApp complies with applicable laws. As always, we consider our obligations when designing updates like this … We’ve made our terms and privacy policy easily accessible, provided an overview of the key updates, and empowered people to make decisions that are right for them, including offering a control for existing users over how their data can be used.

Will WhatsApp Dodge a FTC Enforcement Action?

Now that WhatsApp’s privacy and data sharing policies are under the scrutiny of the FTC, one wonders whether WhatsApp’s opt-out allowances will help it avoid a FTC enforcement action, or will the fact that the company does not allow users to opt-out of sharing their phone number with Facebook will be too much for the FTC.  Furthermore, will Facebook’s decision to place the opt-out option on a different screen create issues with the FTC, which usually takes issue with companies that hide opt-out options on different screens or buried below the fold.  So, the question is, are WhatsApp and Facebook doing enough to obtain consent from users regarding their data sharing plans, and how does the inability to opt-out of phone number sharing impact the FTC’s view of the data sharing plan between the two companies.

* Photo Cred.: digitaltrends.com

Copyright 2016