Focusing public attention on emerging privacy and civil liberties issues

In re: WhatsApp

Top News

Background on WhatsApp

WhatsApp is a text messaging application for smartphones that uses the internet, rather than an SMS plan, to send messages. The WhatsApp website describes the service: "WhatsApp Messenger is available for iPhone, BlackBerry, Android, Windows Phone and Nokia and yes, those phones can all message each other! Because WhatsApp Messenger uses the same internet data plan that you use for email and web browsing, there is no cost to message and stay in touch with your friends." WhatsApp was launched in 2009 by former Yahoo! engineers Jan Koum and Brian Acton.

Aside from allowing users to send text messages outside of an SMS plan, WhatsApp's most salient feature is its rejection of in-app advertisements. Since in-app advertisements normally rely on data collected from the user's mobile device in order to propagate, WhatsApp has, as a corollary, established a policy of not collecting or storing users' data.

According to WhatsApp’s privacy policy, last updated in July 2012, WhatsApp “does not collect names, emails, addresses or other contact information from its users’ mobile address book or contact lists” other than mobile phone numbers. Instead, when the app receives a message from another user, the association of the phone number with the user’s name “occurs dynamically on the mobile device itself and not on WhatsApp’s servers and is not transmitted to WhatsApp.”

Relying on these representations, users signed up for WhatsApp by the millions. On August 23, 2012, WhatsApp processed ten billion user messages. On June 13, 2013, processed 27 billion user messages. As of December 2013, WhatsApp claimed that 400 million active users use the service each month. And as of the end of February 2014, WhatsApp boasted 450 million users worldwide.

The Proposed Facebook Acquisition

On February 19, 2014, Facebook announced that it had agreed to purchase WhatsApp for $19 billion. Facebook also operates a messaging service, although Facebook messaging is notorious for its extensive data collection practices. When Facebook revamped its messaging system in November 2010, it automatically opted in all Facebook users and initially disabled users’ ability to delete individual messages. Without user consent, the new messaging system also pulled data from Facebook’s social graph to prioritize messages from certain users. Currently, even when users delete a message, it continues to be stored on Facebook’s servers. At the end of 2013, Slate reported that even when a user chooses not to send a message, Facebook still tracks what the user wrote.

The Proposed WhatsApp Acquisition Implicates the Privacy of Users' Data

Facebook has regularly collected user data from companies it acquires. For example, when Facebook purchased Instagram in 2012, Instagram users were not subjected to advertisements based on the content they uploaded to the site. Like WhatsApp, Instagram’s Terms of Service included a provision that in the event of acquisition, users’ “information such as name and email address, User Content and any other information collected through the Service may be among the items sold or transferred.” After the acquisition, Facebook did in fact access Instagram users’ data and changed the Instagram Terms of Service to reflect this change. Now, users, industry experts, and foreign governments are already objecting to the privacy risks posed by Facebook's agreement with WhatsApp.

WhatsApp Users Object to the Facebook Acquisition

  • Aliya Abbas, a Delhi-based mediaperson, said, “I started using WhatsApp five months ago. If it gets integrated with Facebook, I will uninstall [WhatsApp]. And I think others will do the same if this happens. WhatsApp is popular because of its privacy, and I don't think users will like the idea of advertisements popping up in the middle of a conversation.”
  • Columnist Carly Page wrote, “I'm a user of Whatsapp, and of course Facebook’s ridiculously expensive acquisition of the firm has got me concerned about my privacy, especially the fact that the social network likely now has access to my mobile phone number.”
  • Journalist Tali Arbel wrote:
    “WhatsApp is my respite from Facebook. For me, the world's largest social network has become a junkyard of updates from people I don't really know and ads for products I don't care about. It's all about people jostling for publicity and craving approval, seeking likes and comments from near-strangers. But WhatsApp is the best stand-in for a conversation you have over dinner with people you love. It's intimate. It's personal. I rely on it. […] Facebook says it won’t run ads on WhatsApp. But I'm afraid they won't be able to help themselves. With all those food pictures, won't Facebook figure I want to see ads for restaurants and cookware? And will Facebook urge my ‘friends’ to connect with me on WhatsApp? Facebook has done something similar with Instagram, the photo-sharing app it has owned since 2012.”
  • Corley Paige, a product developer from Austin, Texas, wrote, “I suddenly want to delete my Whatsapp. Hello Viber.”
  • Twitter user Tara Aghdashloo wrote, “Facebook is like an evil parent that keeps finding the new hiding place for your diary.”
  • User @tabandchord posted to Twitter, “Facebook + WhatsApp = The Ultimate Spying Machine #facebook #WhatsApp.”
  • Some users of both WhatsApp and Facebook created a Facebook Page titled “Please Don’t Ruin WhatsApp.” Under the designation “Community description,” the page creators posted, “Hey Facebook: Please don't ruin WhatsApp and make all of our message go through Facebook Messenger.”

Industry Experts Are Warning that the Merger Will Diminish User Privacy

Industry experts object to the Facebook acquisition because it allows Facebook access to the repository of mobile phone numbers that WhatsApp has collected.

Wim Nauwelaerts, a lawyer specializing in EU data protection law at Hunton & Williams, LLP in Brussels, told Bloomberg, “Facebook is not only buying a popular messaging app, it is also acquiring the addresses and telephone numbers of 450 million users worldwide. […] Many of these users are already signed up to Facebook, so through this deal Facebook will be able to build complete profiles on users.”

St. John Deakins, the head of the online identity monitoring application Citizenme, said, “Facebook already has a very broad copyright license on people's content and already shares your data with many other services. Now with Facebook buying Whatsapp, this could see more and more private information becoming part of Facebook's database. From a personal data standpoint, this is extremely worrying.”

Tim Grossman, a senior branding consultant at Brand Union, wrote in The Guardian:

“One of the reasons why so many millions have flocked to WhatsApp is the added level of privacy the brand provides. In a world where your every word echoes endlessly across the internet it was a communication channel where sharing could take place on a more contained level. However, much like Google's acquisition of Nest and Facebook's of Instagram, with this purchase consumers are suddenly associated with, and have their information accessible by a brand that they didn't buy into. It's this intrusion that can make it feel uncomfortable, as both you and your data are seized without your say-so.”

European Data Protection Authorities Have Already Begun Investigations

Jacob Kohnstamm, the Dutch data protection Commissioner, has begun an investigation into data protection issues related to Facebook’s purchase of WhatsApp. His investigation is focusing on the collection of data from WhatsApp users’ address books and the potential for misuse of that information.

Thilo Weichert, the data protection commissioner for the German state of Schleswig-Holstein, has also begun an investigation into the acquisition. He told Bloomberg, “The mixing of data is strictly regulated by German law, especially through the Telemedia Act and the Federal Data Protection Act. Both acts rely on the principle of purpose binding, that data stored for one purpose cannot be processed for any other purposes - there are no such restrictions in the U.S.”

Commissioner Kohnstamm, who served as the head of the European Union’s Article 29 Data Protection Working Party until February 27, 2014, said that any of the European Union’s “28 data protection regulators could open an investigation” into the acquisition as well.

The FTC's Interest

The Commission has previously issued an Order and Settlement Agreement with Facebook, following an investigation into whether “Facebook deceived consumers by telling them they could keep their information on Facebook private, and then repeatedly allowing it to be shared and made public.” In addition to requiring Facebook to give users “clear and prominent notice” and obtain “their express consent before sharing their information beyond their privacy settings,” and to maintain “a comprehensive privacy program to protect consumers’ information,” the Order also prohibited Facebook from misrepresenting the extent to which it participates in the US-EU Safe Harbor program.

The Safe Harbor Framework

The Safe Harbor Framework is an industry-developed self-regulatory approach to privacy compliance. Coordinated by the Department of Commerce, the Safe Harbor program allows firms to self-certify privacy policies in lieu of establishing adequate privacy protections in the United States that regulate business practice. The Safe Harbor arrangements developed in response to the European Union Data Directive, a comprehensive legal framework that established essential privacy safeguards for consumers across the European Union.

The Federal Trade Commission has been tasked with penalizing US firms that incorrectly claim current Safe Harbor certification. Currently, Facebook represents that it complies with the requirements of Safe Harbor program.

The FTC's Section 5 Authority

The FTC Act prohibits unfair and deceptive acts and practices, and empowers the Commission to enforce the Act’s prohibitions. These powers are described in FTC Policy Statements on Deception and Unfairness. A trade practice is unfair if it “causes or is likely to cause substantial injury to consumers which is not reasonably avoidable by consumers themselves and not outweighed by countervailing benefits to consumers or to competition.” An act or practice is deceptive if it involves a representation, omission, or practice that is likely to mislead the consumer acting reasonably under the circumstances, to the consumer’s detriment.”

The Commission has previously found that a company may not alter the privacy settings of its users and that a company may not repurpose user data for a use other than the one for which the user’s data was collected without first obtaining the user’s “express affirmative consent.” For example, in the FTC’s consideration of the Google acquisition of Doubleclick, where similar issues were raised about the impact on user privacy, the Commission allowed the merger to go forward, but only because the Commission found that the scope of its antitrust review did not encompass issues related to consumer privacy. However, Commissioner Harbor dissented and warned, “The truth is, we really do not know what Google/DoubleClick can or will do with its trove of information about consumers’ Internet habits. The merger creates a firm with vast knowledge of consumer preferences, subject to very little accountability.”

EPIC and the FTC

EPIC is the group responsible for several of the Federal Trade Commission's major privacy decisions, including:

Responses

WhatsApp's Response

On February 19, 2014, immediately following the announcement of the Facebook deal, founder Jan Koum posted to the WhatsApp Blog:

Here’s what will change for you, our users: nothing. WhatsApp will remain autonomous and operate independently. You can continue to enjoy the service for a nominal fee. You can continue to use WhatsApp no matter where in the world you are, or what smartphone you’re using. And you can still count on absolutely no ads interrupting your communication. There would have been no partnership between our two companies if we had to compromise on the core principles that will always define our company, our vision and our product.

On March 10, 2014, WhatsApp released a new set of privacy features for its Android operating system. The changes include allowing users to hide certain features, such as information about when they were last seen, their profile photo, and their status updates.

Facebook's Response

Following the filing of the complaint, Facebook told the Washington Post, "As we have said repeatedly, WhatsApp will operate as a separate company and will honor its commitments to privacy and security."

WhatsApp "Sets the Record Straight"

Less than two weeks following the filing of the complaint, WhatsApp founder Jan Koum addressed the privacy issues associated with Facebook's proposed acquisition in a blog post titled, "Setting the Record Straight":

Since announcing our upcoming partnership with Facebook, we’ve been truly humbled by how much attention our story has received. As a company, we’re excited to continue focusing on offering as many people as possible the chance to stay connected with friends and loved ones, no matter who they are or where they live.

Unfortunately, there has also been a lot of inaccurate and careless information circulating about what our future partnership would mean for WhatsApp users’ data and privacy.

I’d like to set the record straight.

Above all else, I want to make sure you understand how deeply I value the principle of private communication. For me, this is very personal. I was born in Ukraine, and grew up in the USSR during the 1980s. One of my strongest memories from that time is a phrase I’d frequently hear when my mother was talking on the phone: “This is not a phone conversation; I’ll tell you in person.” The fact that we couldn’t speak freely without the fear that our communications would be monitored by KGB is in part why we moved to the United States when I was a teenager.

Respect for your privacy is coded into our DNA, and we built WhatsApp around the goal of knowing as little about you as possible: You don’t have to give us your name and we don’t ask for your email address. We don’t know your birthday. We don’t know your home address. We don’t know where you work. We don’t know your likes, what you search for on the internet or collect your GPS location. None of that data has ever been collected and stored by WhatsApp, and we really have no plans to change that.

If partnering with Facebook meant that we had to change our values, we wouldn’t have done it. Instead, we are forming a partnership that would allow us to continue operating independently and autonomously. Our fundamental values and beliefs will not change. Our principles will not change. Everything that has made WhatsApp the leader in personal messaging will still be in place. Speculation to the contrary isn’t just baseless and unfounded, it’s irresponsible. It has the effect of scaring people into thinking we’re suddenly collecting all kinds of new data. That’s just not true, and it’s important to us that you know that.

Make no mistake: our future partnership with Facebook will not compromise the vision that brought us to this point. Our focus remains on delivering the promise of WhatsApp far and wide, so that people around the world have the freedom to speak their mind without fear.

The FTC's Response

On April 10, 2014, the Commission responded to EPIC's complaint. The FTC notified Facebook and WhatsApp that they must honor their privacy commitments to users. According to the letter from the Director of the FTC Bureau of Consumer Protection, "if the acquisition is completed and WhatsApp fails to honor these promises, both companies could be in violation of Section 5 of the FTC Act and potentially the FTC's order against Facebook." The FTC letter concludes, "hundreds of millions of users have entrusted their personal information to WhatsApp. The FTC staff continue to monitor the companies' practices to ensure that Facebook and WhatsApp honor the promises they have made to those users."

Resources

News Reports on the EPIC Complaint