Privacy Groups File FTC Complaint over WhatsApp's Privacy Changes

WhatsAppIn August, WhatsApp announced its first privacy policy change in four years — and it was a big one. WhatsApp will now be sharing data with Facebook.

Facebook bought WhatsApp in 2014 for $19 billion. WhatsApp has about one billion users worldwide, and Facebook has about 1.13 billion daily active users.

The stated purpose of the data sharing is for Facebook to improve the "products experience." According to The Guardian, WhatsApp phone numbers and other data will be used by Facebook to show users ads — presumably ones relevant to their geographical areas -- and make friend suggestions.

Opting Out

There are two ways to opt out of the new terms, as reported by The Independent:

  • If you haven't already accepted the new terms when prompted to do so by a pop-up, when you are offered the new terms look for the "read more" option, then un-check the box that says "Share my WhatsApp account information with Facebook."
  • If you HAVE already accepted the new terms, you can still opt out — but only within 30 days. To do that, go to the settings menu in the app, click the account tab, and find the "share my account info" button. Then turn that off.

Of course, you can also simply delete WhatsApp from your smartphone. But since many school, family, and other groups use it, that could be a major inconvenience.

Not Good Enough

The opting-out options aren't good enough for two privacy watchdog groups:  the Electronic Privacy Information Center (“EPIC”) and the Center for Digital Democracy (“CDD”). Shortly after the announcement of the new privacy policy, they filed a complaint with the Federal Trade Commission (FTC).

According to the complaint,

WhatsApp plans to transfer user data that was previously collected under the promise this data would not be used or disclosed for marketing purposes.

Before the latest update to the privacy policy, WhatsApp's policy stated:

We do not use your mobile phone number or other Personally Identifiable Information to send commercial or marketing messages without your consent . . .

In 2009, WhatsApp founder Jan Koum posted on the WhatsApp blog:

We have not, we do not and we will not ever sell your personal information to anyone. Period. End of story.

At the time of Facebook's acquisition of WhatsApp, Jessica Rich, Director of the FTC’s Consumer Protection Bureau, sent a letter to the Chief Privacy officer of Facebook and the General Counsel of WhatsApp that warned the companies:

the FTC has made clear that, absent affirmative express consent by a consumer, a company cannot use data in a manner that is materially inconsistent with promises made at the time the data was collected, and that such use of data could be an unfair practice ...

(Emphasis added.)

The FTC told the companies that

if [they] choose to use data collected by WhatsApp in a manner that is materially inconsistent with the promises WhatsApp made at the time of collection, [they] must obtain consumers’ affirmative consent before doing so.

"Affirmative consent," according to the FTC, means opting IN to the new terms, rather than failing to opt OUT.

Takeaway

Many small businesses have their own websites, and many of those websites have privacy policies. Most consumers ignore those policies, and small businesses aren't as high-profile as WhatsApp and Facebook. However, even a small business that promises "never" to do something with a consumer's personal information could face FTC action if it changes how it uses personal information without first getting affirmative consent.


Photo Credit: iOS7 Homescreen blurred, Jan Persiel. (CC BY-SA 2.0)

comments powered by Disqus

Find the Right Lawyer for Your Legal Issue!

Fast, Free, and Confidential