Consumer Cases

In re: WhatsApp

Overview

WhatsApp is a text messaging application for smartphones that uses the internet, rather than an SMS plan, to send messages. The WhatsApp website describes the service: “WhatsApp Messenger is a cross-platform mobile messaging app which allows you to exchange messages without having to pay for SMS. WhatsApp Messenger is available for iPhone, BlackBerry, Windows Phone, Android and Nokia.”

WhatsApp was launched in 2009 by former Yahoo! engineers Jan Koum and Brian Acton. As of February 1, 2016, the service has one billion users worldwide. WhatsApp’s popularity has been due in large part to the company’s commitment to privacy and rejection of in-app advertising. Since in-app advertisements normally rely on data collected from the user’s mobile device, WhatsApp adopted a policy of not collecting or storing users’ data. In 2009, founder Jan Koum posted to the WhatsApp official blog, “So first of all, let’s set the record straight. We have not, we do not and we will not ever sell your personal information to anyone. Period. End of story.” In a 2012 blog post titled “Why we don’t sell ads,” Koum explained the company’s anti-advertising stance and warned users that “when advertising is involved you the user are the product.” In April 2016, WhatsApp introduced end-to-end encryption for the messaging service.

Until August 25, 2016, WhatsApp’s privacy policy promised users that the company “does not collect names, emails, addresses or other contact information from its users’ mobile address book or contact lists” other than mobile phone numbers. The company also promised users, “We do not use your mobile phone number or other Personally Identifiable Information to send commercial or marketing messages without your consent.” Relying on these promises, over one billion individuals provided their phone number and other personal information to WhatsApp as of February 2016.

On February 19, 2014, Facebook announced that it was purchasing WhatsApp for $19 billion. In response to significant backlash over the privacy concerns raised by the deal, both WhatsApp and Facebook promised users that nothing would change for WhatsApp users’ privacy. On March 6, 2014, EPIC and the Center for Digital Democracy filed a complaint with the Federal Trade Commission over the deal, urging the Commission to block the sale unless adequate privacy safeguard for WhatsApp user data were established. In response to EPIC’s complaint, the FTC sent a letter to Facebook and WhatsApp notifying the companies of their obligation to honor their privacy promises to WhatsApp users. The letter explained that failure to obtain users’ opt-in consent before changing WhatsApp privacy practices would be an unfair and deceptive trade practice and may also violate the FTC’s 2012 Consent Order with Facebook.

On August 25, 2016, WhatsApp announcedplans to use and transfer user information to Facebook, including phone numbers and other user data, that will be connected with Facebook profiles for targeted advertising and other purposes. According to the announcement, WhatsApp will not obtain users’ opt-in consent before altering its privacy practices. Instead, users will be required to opt out within 30 days. This reversal contradicts WhatsApp’s previous promises to users that their personal information would not be used or disclosed for marketing purposes without their consent. On August 29, 2016, EPIC and CDD filed a complaint with the FTC over the proposed data transfer, charging that WhatsApp’s policy change violates Section 5 of the FTC Act and urging the FTC to investigate and enjoin the proposed practices. The FTC responded to EPIC’s complaint on August 31, 2016, stating in a letter that Commission staff will “carefully review” the filing.

Facebook’s Acquisition of WhatsApp

On February 19, 2014, Facebook announced that it was purchasing WhatsApp for $19 billion. As of August 2016, Facebook and WhatsApp are currently the two largest social networks worldwide, with an estimated two-and-a-half billion active users combined. WhatsApp’s popularity stems in large part from the company’s strong commitment to user privacy, which stands in stark contrast to Facebook’s ubiquitous tracking and profiling practices.

Following the announcement of the 2014 acquisition, WhatsApp users, industry experts, and foreign governments objected to the privacy risks posed by the deal.

For example, Aliya Abbas, a Delhi-based mediaperson and WhatsApp user, said, “I started using WhatsApp five months ago. If it gets integrated with Facebook, I will uninstall [WhatsApp]. And I think others will do the same if this happens. WhatsApp is popular because of its privacy, and I don’t think users will like the idea of advertisements popping up in the middle of a conversation.”

Tim Grossman, a senior branding consultant at Brand Union, wrote in The Guardian:

One of the reasons why so many millions have flocked to WhatsApp is the added level of privacy the brand provides. In a world where your every word echoes endlessly across the internet it was a communication channel where sharing could take place on a more contained level. However, much like Google’s acquisition of Nest and Facebook’s of Instagram, with this purchase consumers are suddenly associated with, and have their information accessible by a brand that they didn’t buy into. It’s this intrusion that can make it feel uncomfortable, as both you and your data are seized without your say-so.

EPIC’s 2014 FTC Complaint on Facebook’s Acquisition of WhatsApp

On Marc 6, 2014, EPIC and CDD filed a complaint with the FTC concerning Facebook’s proposed purchase of WhatsApp. EPIC urged the FTC to block the sale unless adequate privacy safeguards were established for WhatsApp user data. EPIC’s complaint stated:

“WhatsApp built a user base based on its commitment not to collect user data for advertising revenue. Acting in reliance on WhatsApp representations, Internetusers provided detailed personal information to the company including privatetext to close friends. Facebook routinely makes use of user information foradvertising purposes and has made clear that it intends to incorporate the data ofWhats App users into the user profiling business model. The proposed acquisitionwill therefore violate WhatsApp users’ understanding of their exposure to onlineadvertising and constitutes an unfair and deceptive trade practice, subject toinvestigation by the Federal Trade Commission.””

On March 21, 2014, EPIC and CDD filed a supplemental complaint to provide more evidence of WhatsApp users’ objections to the acquisition and to highlight the importance of the FTC’s pre-merger review process.

Responses from WhatsApp and Facebook

On February 19, 2014, immediately following the announcement of the Facebook deal, founder Jan Koum posted to the WhatsApp Blog:

Here’s what will change for you, our users: nothing. WhatsApp will remain autonomous and operate independently. You can continue to enjoy the service for a nominal fee. You can continue to use WhatsApp no matter where in the world you are, or what smartphone you’re using. And you can still count on absolutely no ads interrupting your communication. There would have been no partnership between our two companies if we had to compromise on the core principles that will always define our company, our vision and our product.

On February 24, 2014, Facebook chief executive Mark Zuckerberg was quoted as saying “We are absolutely not going to change plans around WhatsApp and the way it uses user data. WhatsApp is going to operate completely autonomously.”

Following the filing of EPIC and CDD’s complaint with the FTC over the acquisition, Facebook told the Washington Post, “As we have said repeatedly, WhatsApp will operate as a separate company and will honor its commitments to privacy and security.”

Less than two weeks after the FTC complaint was filed, WhatsApp’s Koum addressed the privacy issues associated with Facebook’s proposed acquisition in a blog post titled, “Setting the Record Straight“:

Since announcing our upcoming partnership with Facebook, we’ve been truly humbled by how much attention our story has received. As a company, we’re excited to continue focusing on offering as many people as possible the chance to stay connected with friends and loved ones, no matter who they are or where they live.
Unfortunately, there has also been a lot of inaccurate and careless information circulating about what our future partnership would mean for WhatsApp users’ data and privacy.
I’d like to set the record straight.
Above all else, I want to make sure you understand how deeply I value the principle of private communication. For me, this is very personal. I was born in Ukraine, and grew up in the USSR during the 1980s. One of my strongest memories from that time is a phrase I’d frequently hear when my mother was talking on the phone: “This is not a phone conversation; I’ll tell you in person.” The fact that we couldn’t speak freely without the fear that our communications would be monitored by KGB is in part why we moved to the United States when I was a teenager.
Respect for your privacy is coded into our DNA, and we built WhatsApp around the goal of knowing as little about you as possible: You don’t have to give us your name and we don’t ask for your email address. We don’t know your birthday. We don’t know your home address. We don’t know where you work. We don’t know your likes, what you search for on the internet or collect your GPS location. None of that data has ever been collected and stored by WhatsApp, and we really have no plans to change that.
If partnering with Facebook meant that we had to change our values, we wouldn’t have done it. Instead, we are forming a partnership that would allow us to continue operating independently and autonomously. Our fundamental values and beliefs will not change. Our principles will not change. Everything that has made WhatsApp the leader in personal messaging will still be in place. Speculation to the contrary isn’t just baseless and unfounded, it’s irresponsible. It has the effect of scaring people into thinking we’re suddenly collecting all kinds of new data. That’s just not true, and it’s important to us that you know that.
Make no mistake: our future partnership with Facebook will not compromise the vision that brought us to this point. Our focus remains on delivering the promise of WhatsApp far and wide, so that people around the world have the freedom to speak their mind without fear.

The FTC on WhatsApp, Mergers, and Privacy Promises

The FTC’s Response to Facebook’s Acquisition of WhatsApp

On April 10, 2014, the Commission responded to EPIC’s complaint. The FTC notified Facebook and WhatsApp that they must honor their privacy commitments to users. According to the letter from the Director of the FTC Bureau of Consumer Protection, “WhatsApp’s privacy policy clearly states, among other things, that users’ information will not be used for advertising purposes or sold to a third party for commercial or marketing use without the users’ consent.” The letter also noted, “Facebook has recently promised consumers that it would not change the way WhatsApp uses customer information.”

The Commission’s letter explained, “the FTC has made clear that, absent affirmativeexpress consent by a consumer, a company cannot use data in a manner that ismaterially inconsistent with promises made at the time the data was collected, andthat such use of data could be an unfair practice under Section 5.” Accordingly, the FTC directed the companies that “if you choose to use data collected by WhatsApp in a manner that is materially inconsistent with the promises WhatsApp made at the time of collection, you must obtain consumers’ affirmative consent before doing so.”

In a press release on the April 10, 2014 letter, the FTC clarified that “before making any material changes to how they use data already collected from WhatsApp subscribers, the companies must get affirmative consent.”

On March 25, 2015, the FTC posted a blog entry on “Mergers and Privacy Promises” that discussed the implications of the April 10, 2014 letter to WhatsApp and Facebook and provided the following guidance:

What if you want to materially change your practices for information you collected before the merger – for example, by sharing with third parties information you originally promised would not be shared? To change the privacy promises already made to consumers, you’ll need to inform consumers and get their express affirmative consent to opt in to your new practices.

The FTC’s 2012 Consent Order with Facebook

The Commission has previously issued an Order and Settlement Agreement with Facebook, following an investigation into whether “Facebook deceived consumers by telling them they could keep their information on Facebook private, and then repeatedly allowing it to be shared and made public.” The Order requires Facebook to give users “clear and prominent notice” and obtain “their express consent before sharing their information beyond their privacy settings,” and to maintain “a comprehensive privacy program to protect consumers’ information.”

WhatsApp’s Proposed User Data Transfer

On August 25, 2016, WhatsApp posted an entry to the company’s official blog announcing the first update to its Terms of Service and Privacy Policy in more than four years “as part of our plans to test ways for people to communicate with businesses in the months ahead.” WhatsApp further explains it will share user account information “with Facebook and the Facebook family of companies, like the phone number you verified when you registered with WhatsApp, as well as the last time you used our service.” The companies intend to use WhatsApp account information to show users “more relevant ads on Facebook” and to send users marketing messages via WhatsApp.

Existing WhatsApp users have 30 days to prevent their personal information from being used and transferred to Facebook for advertising purposes. According to WhatsApp’s instructions on this process, users’ privacy settings will be modified to allow the transfer by default unless the user take additional steps to opt out of the changed data practices.

According to a Wired report on the changes to WhatApp’s privacy practices, “Another aspect of the privacy rollback likely to rankle users is that not only will the phone number and analytics sharing be activated by default, WhatsApp users will only have a month in which to opt out.” A reporter for Gizmodo said of the change, “This very obviously betrays WhatsApp’scommitment to privacy that it has long held.”

EPIC’s 2016 Complaint

On August 29, 2016, EPIC and CDD filed a complaint with the FTC over the proposed data transfer, charging that WhatsApp’s policy change violates Section 5 of the FTC Act and urging the FTC to investigate and enjoin the proposed practices.

According to the complaint, “WhatsApp plans to transfer user data that was previously collected under the promise this data would not be used or disclosed for marketing purposes” without first obtaining users’ opt-in consent. EPIC explained that, “As of February 1, 2016, over one billion individuals provided their phone numbers and other personal information to WhatsApp with the understanding that their information would not be used or disclosed for marketing purposes.” The FTC’s numerous statements concerning Facebook’s acquisition of WhatsApp indicate that failure to obtain opt-in consent before changing the privacy practices for previously collected data constituted an unfair and deceptive trade practice in violation of Section 5 of the FTC Act.

The FTC’s Response

On August 31, 2016,the FTC sent a letter to EPIC and CDD in response to the EPIC complaint. The letter, sent from the FTC’s Division on Privacy and Identity Protection, acknowledges the Commission’s duty to prohibit unfair and deceptive practices and to enforce its 2012 Consent Order with Facebook. The letter also acknowledged that EPIC’s complaint “contains allegations regarding statements WhatsApp has made about how it limits the use of mobile phone numbers or other personally identifiable information.” FTC staff will “carefully review” EPIC’s complaint, the letter states.

News

EPIC Joins Public Knowledge in Supporting FCC Rule that Prohibits Digital Discrimination in Broadband Accessibility

July 12, 2024

EPIC Joins Public Knowledge,Benton Institute in Supporting FCC Authority to Combat Digital Discrimination and Establish Civil Rights Office

April 2, 2024

EPIC Commends CFPB’s Personal Financial Data Rights Rulemaking

December 1, 2023

See All News

EPIC Joins Public Knowledge in Supporting FCC Rule that Prohibits Digital Discrimination in Broadband Accessibility

July 12, 2024

See All News

Resources

Support Our Work

EPIC's work is funded by the support of individuals like you, who help us to continue to protect privacy, open government, and democratic values in the information age.

Donate