In re: WhatsApp
- WhatsApp Privacy Update: Spain Investigating Broken Privacy Promises: Spain is the latest country to investigate WhatsApp's transfer of user data, including the verified user phone number, to Facebook. The Spanish Data Protection Agency joins privacy regulators in Germany, India, Italy, and the U.K. that have taken action against WhatsApp's changes to privacy practices that contradict previous promises. EPIC filed a complaint with the Federal Trade Commission over the policy change in August, and more than a dozen consumer groups have backed these efforts. The Commission said it will "carefully review" EPIC's complaint. The FTC has previously stated, "When companies tell consumers they will safeguard their personal information, the FTC can and does take law enforcement action to make sure that companies live up these promises." (Oct. 14, 2016)
- India Joins International Opposition to WhatsApp Privacy Changes: India’s Deli High Court has ordered WhatsApp not to transfer to Facebook any user data that was collected prior to September 25, 2016, and to delete data of users who opted out of WhatsApp’s new data transfer policy prior to that date. Last month, WhatsApp announced it would begin transferring user data, including verified phone numbers, to Facebook in violation of previous privacy promises. Germany has also ordered Facebook to immediately stop collecting and storing user data from WhatsApp, and to delete all WhatsApp user data already transferred. EPIC filed a complaint with the FTC over the policy change, and more than a dozen consumer groups have backed these efforts. The FTC’s latest response to the consumer coalition emphasized “FTC staff’s position that companies must obtain affirmative express (opt-in) consent before making material, retroactive changes to privacy promises.” The FTC has previously stated, “When companies tell consumers they will safeguard their personal information, the FTC can and does take law enforcement action to make sure that companies live up these promises.” (Sep. 30, 2016)
- Germany Prohibits WhatsApp Data Transfer to Facebook + (Sep. 27, 2016)
- Consumer Groups Back Call for FTC to Investigate WhatsApp + (Sep. 22, 2016)
- European Commission Begins Investigation of WhatsApp Privacy About-Face + (Sep. 13, 2016)
- FTC Responds to EPIC's Complaint about WhatsApp + (Sep. 7, 2016)
- EPIC, CDD Charge WhatsApp Policy Change Unlawful, Urge FTC to Act + (Aug. 29, 2016)
- Facebook to Collect WhatsApp User Data, Violating FTC Order and Privacy Promises + (Aug. 25, 2016)
- Senate Examines FTC's Antitrust Enforcement + (Apr. 13, 2016)
- EPIC Files Comments with FTC on Merger Review and Consumer Privacy + (Mar. 18, 2015)
- WhatsApp Implements End-to-End Encryption + (Nov. 25, 2014)
- Senator Rockefeller Questions Whisper About Privacy Practices + (Oct. 24, 2014)
- EU Launches Investigation Into Facebook Acquisition of WhatsApp + (Sep. 2, 2014)
- Google Plans Advertising on Appliances, Including Nest Thermostat + (May. 22, 2014)
- FTC Responds to EPIC Complaint on WhatsApp and Privacy + (Apr. 10, 2014)
- EPIC Updates Facebook Complaint, Urges Careful Review of WhatsApp Acquisition + (Mar. 21, 2014)
- EPIC Urges FTC Investigation of WhatsApp Sale to Facebook + (Mar. 6, 2014)
More top news
WhatsApp is a text messaging application for smartphones that uses the internet, rather than an SMS plan, to send messages. The WhatsApp website describes the service: "WhatsApp Messenger is a cross-platform mobile messaging app which allows you to exchange messages without having to pay for SMS. WhatsApp Messenger is available for iPhone, BlackBerry, Windows Phone, Android and Nokia."
WhatsApp was launched in 2009 by former Yahoo! engineers Jan Koum and Brian Acton. As of February 1, 2016, the service has one billion users worldwide. WhatsApp's popularity has been due in large part to the company's commitment to privacy and rejection of in-app advertising. Since in-app advertisements normally rely on data collected from the user's mobile device, WhatsApp adopted a policy of not collecting or storing users' data. In 2009, founder Jan Koum posted to the WhatsApp official blog, "So first of all, let's set the record straight. We have not, we do not and we will not ever sell your personal information to anyone. Period. End of story." In a 2012 blog post titled "Why we don't sell ads," Koum explained the company's anti-advertising stance and warned users that "when advertising is involved you the user are the product." In April 2016, WhatsApp introduced end-to-end encryption for the messaging service.
On February 19, 2014, Facebook announced that it was purchasing WhatsApp for $19 billion. In response to significant backlash over the privacy concerns raised by the deal, both WhatsApp and Facebook promised users that nothing would change for WhatsApp users' privacy. On March 6, 2014, EPIC and the Center for Digital Democracy filed a complaint with the Federal Trade Commission over the deal, urging the Commission to block the sale unless adequate privacy safeguard for WhatsApp user data were established. In response to EPIC's complaint, the FTC sent a letter to Facebook and WhatsApp notifying the companies of their obligation to honor their privacy promises to WhatsApp users. The letter explained that failure to obtain users' opt-in consent before changing WhatsApp privacy practices would be an unfair and deceptive trade practice and may also violate the FTC's 2012 Consent Order with Facebook.
On August 25, 2016, WhatsApp announced plans to use and transfer user information to Facebook, including phone numbers and other user data, that will be connected with Facebook profiles for targeted advertising and other purposes. According to the announcement, WhatsApp will not obtain users' opt-in consent before altering its privacy practices. Instead, users will be required to opt out within 30 days. This reversal contradicts WhatsApp's previous promises to users that their personal information would not be used or disclosed for marketing purposes without their consent. On August 29, 2016, EPIC and CDD filed a complaint with the FTC over the proposed data transfer, charging that WhatsApp's policy change violates Section 5 of the FTC Act and urging the FTC to investigate and enjoin the proposed practices. The FTC responded to EPIC's complaint on August 31, 2016, stating in a letter that Commission staff will "carefully review" the filing.
On February 19, 2014, Facebook announced that it was purchasing WhatsApp for $19 billion. As of August 2016, Facebook and WhatsApp are currently the two largest social networks worldwide, with an estimated two-and-a-half billion active users combined. WhatsApp's popularity stems in large part from the company's strong commitment to user privacy, which stands in stark contrast to Facebook's ubiquitous tracking and profiling practices.
Following the announcement of the 2014 acquisition, WhatsApp users, industry experts, and foreign governments objected to the privacy risks posed by the deal.
For example, Aliya Abbas, a Delhi-based mediaperson and WhatsApp user, said, “I started using WhatsApp five months ago. If it gets integrated with Facebook, I will uninstall [WhatsApp]. And I think others will do the same if this happens. WhatsApp is popular because of its privacy, and I don't think users will like the idea of advertisements popping up in the middle of a conversation.”
Tim Grossman, a senior branding consultant at Brand Union, wrote in The Guardian:
“One of the reasons why so many millions have flocked to WhatsApp is the added level of privacy the brand provides. In a world where your every word echoes endlessly across the internet it was a communication channel where sharing could take place on a more contained level. However, much like Google's acquisition of Nest and Facebook's of Instagram, with this purchase consumers are suddenly associated with, and have their information accessible by a brand that they didn't buy into. It's this intrusion that can make it feel uncomfortable, as both you and your data are seized without your say-so.”
EPIC's 2014 FTC Complaint on Facebook's Acquisition of WhatsApp
On Marc 6, 2014, EPIC and CDD filed a complaint with the FTC concerning Facebook's proposed purchase of WhatsApp. EPIC urged the FTC to block the sale unless adequate privacy safeguards were established for WhatsApp user data. EPIC's complaint stated:
“WhatsApp built a user base based on its commitment not to collect user data for advertising revenue. Acting in reliance on WhatsApp representations, Internet users provided detailed personal information to the company including private text to close friends. Facebook routinely makes use of user information for advertising purposes and has made clear that it intends to incorporate the data of Whats App users into the user profiling business model. The proposed acquisition will therefore violate WhatsApp users’ understanding of their exposure to online advertising and constitutes an unfair and deceptive trade practice, subject to investigation by the Federal Trade Commission."”
On March 21, 2014, EPIC and CDD filed a supplemental complaint to provide more evidence of WhatsApp users' objections to the acquisition and to highlight the importance of the FTC's pre-merger review process.
Responses from WhatsApp and Facebook
On February 19, 2014, immediately following the announcement of the Facebook deal, founder Jan Koum posted to the WhatsApp Blog:
Here’s what will change for you, our users: nothing. WhatsApp will remain autonomous and operate independently. You can continue to enjoy the service for a nominal fee. You can continue to use WhatsApp no matter where in the world you are, or what smartphone you’re using. And you can still count on absolutely no ads interrupting your communication. There would have been no partnership between our two companies if we had to compromise on the core principles that will always define our company, our vision and our product.
On February 24, 2014, Facebook chief executive Mark Zuckerberg was quoted as saying “We are absolutely not going to change plans around WhatsApp and the way it uses user data. WhatsApp is going to operate completely autonomously.”
Following the filing of EPIC and CDD's complaint with the FTC over the acquisition, Facebook told the Washington Post, "As we have said repeatedly, WhatsApp will operate as a separate company and will honor its commitments to privacy and security."
Less than two weeks after the FTC complaint was filed, WhatsApp's Koum addressed the privacy issues associated with Facebook's proposed acquisition in a blog post titled, "Setting the Record Straight":
Since announcing our upcoming partnership with Facebook, we’ve been truly humbled by how much attention our story has received. As a company, we’re excited to continue focusing on offering as many people as possible the chance to stay connected with friends and loved ones, no matter who they are or where they live.
Unfortunately, there has also been a lot of inaccurate and careless information circulating about what our future partnership would mean for WhatsApp users’ data and privacy.
I’d like to set the record straight.
Above all else, I want to make sure you understand how deeply I value the principle of private communication. For me, this is very personal. I was born in Ukraine, and grew up in the USSR during the 1980s. One of my strongest memories from that time is a phrase I’d frequently hear when my mother was talking on the phone: “This is not a phone conversation; I’ll tell you in person.” The fact that we couldn’t speak freely without the fear that our communications would be monitored by KGB is in part why we moved to the United States when I was a teenager.
Respect for your privacy is coded into our DNA, and we built WhatsApp around the goal of knowing as little about you as possible: You don’t have to give us your name and we don’t ask for your email address. We don’t know your birthday. We don’t know your home address. We don’t know where you work. We don’t know your likes, what you search for on the internet or collect your GPS location. None of that data has ever been collected and stored by WhatsApp, and we really have no plans to change that.
If partnering with Facebook meant that we had to change our values, we wouldn’t have done it. Instead, we are forming a partnership that would allow us to continue operating independently and autonomously. Our fundamental values and beliefs will not change. Our principles will not change. Everything that has made WhatsApp the leader in personal messaging will still be in place. Speculation to the contrary isn’t just baseless and unfounded, it’s irresponsible. It has the effect of scaring people into thinking we’re suddenly collecting all kinds of new data. That’s just not true, and it’s important to us that you know that.
Make no mistake: our future partnership with Facebook will not compromise the vision that brought us to this point. Our focus remains on delivering the promise of WhatsApp far and wide, so that people around the world have the freedom to speak their mind without fear.
The FTC's Response to Facebook's Acquisition of WhatsApp
The Commission's letter explained, “the FTC has made clear that, absent affirmative express consent by a consumer, a company cannot use data in a manner that is materially inconsistent with promises made at the time the data was collected, and that such use of data could be an unfair practice under Section 5.” Accordingly, the FTC directed the companies that "if you choose to use data collected by WhatsApp in a manner that is materially inconsistent with the promises WhatsApp made at the time of collection, you must obtain consumers' affirmative consent before doing so."
In a press release on the April 10, 2014 letter, the FTC clarified that "before making any material changes to how they use data already collected from WhatsApp subscribers, the companies must get affirmative consent.”
On March 25, 2015, the FTC posted a blog entry on “Mergers and Privacy Promises” that discussed the implications of the April 10, 2014 letter to WhatsApp and Facebook and provided the following guidance:
What if you want to materially change your practices for information you collected before the merger - for example, by sharing with third parties information you originally promised would not be shared? To change the privacy promises already made to consumers, you’ll need to inform consumers and get their express affirmative consent to opt in to your new practices.
The FTC's 2012 Consent Order with Facebook
The Commission has previously issued an Order and Settlement Agreement with Facebook, following an investigation into whether “Facebook deceived consumers by telling them they could keep their information on Facebook private, and then repeatedly allowing it to be shared and made public.” The Order requires Facebook to give users “clear and prominent notice” and obtain “their express consent before sharing their information beyond their privacy settings,” and to maintain “a comprehensive privacy program to protect consumers’ information.”
Existing WhatsApp users have 30 days to prevent their personal information from being used and transferred to Facebook for advertising purposes. According to WhatsApp's instructions on this process, users' privacy settings will be modified to allow the transfer by default unless the user take additional steps to opt out of the changed data practices.
According to a Wired report on the changes to WhatApp's privacy practices, "Another aspect of the privacy rollback likely to rankle users is that not only will the phone number and analytics sharing be activated by default, WhatsApp users will only have a month in which to opt out.” A reporter for Gizmodo said of the change, "This very obviously betrays WhatsApp’s commitment to privacy that it has long held.”
On August 29, 2016, EPIC and CDD filed a complaint with the FTC over the proposed data transfer, charging that WhatsApp's policy change violates Section 5 of the FTC Act and urging the FTC to investigate and enjoin the proposed practices.
According to the complaint, "WhatsApp plans to transfer user data that was previously collected under the promise this data would not be used or disclosed for marketing purposes" without first obtaining users' opt-in consent. EPIC explained that, "As of February 1, 2016, over one billion individuals provided their phone numbers and other personal information to WhatsApp with the understanding that their information would not be used or disclosed for marketing purposes." The FTC's numerous statements concerning Facebook's acquisition of WhatsApp indicate that failure to obtain opt-in consent before changing the privacy practices for previously collected data constituted an unfair and deceptive trade practice in violation of Section 5 of the FTC Act.
The FTC's Response
On August 31, 2016,the FTC sent a letter to EPIC and CDD in response to the EPIC complaint. The letter, sent from the FTC's Division on Privacy and Identity Protection, acknowledges the Commission’s duty to prohibit unfair and deceptive practices and to enforce its 2012 Consent Order with Facebook. The letter also acknowledged that EPIC's complaint “contains allegations regarding statements WhatsApp has made about how it limits the use of mobile phone numbers or other personally identifiable information." FTC staff will “carefully review” EPIC’s complaint, the letter states.
- EPIC Complaint to FTC on WhatsApp Data Transfer to Facebook, August 29, 2016
- EPIC Initial Complaint to FTC on Facebook Acquisition of WhatsApp, March 6, 2014
- EPIC Supplemental Complaint to FTC on Facebook Acquisition of WhatsApp, March 21, 2014
- FTC Letter to Facebook and WhatsApp, April 10, 2014
- FTC Press Release on Letter to Facebook and WhatsApp, April 10, 2014
- FTC Blog Post, Mergers and Privacy Promises, March 25, 2015
News Reports on EPIC Complaint to FTC on WhatsApp Data Transfer to Facebook
- Facebook Can't Collect WhatsApp Data: German Regulator, Law360, September 28, 2016
- Germany Orders Facebook to Stop Collecting Data on WhatsApp Users, Threatpost, September 28, 2016
- Germany orders Facebook to stop sharing and delete WhatsApp user data, Ars Technica, September 27, 2016
- Germany orders Facebook to stop collecting WhatsApp data, Engadget, September 27, 2016
- Germany orders Facebook to delete records of 35 million WhatsApp users over privacy law violation, Washington Times, September 27, 2016
- Germany Orders Facebook To Stop Collecting WhatsApp User Data, Forbes, September 27, 2016
- Facebook Ordered To Stop Collecting WhatsApp Users' Data In Germany, Tech Times, September 27, 2016
- What’s Up With WhatsApp?, Dissent Newswire, September 23, 2016
- FTC chair pressed on Facebook-WhatsApp data practices, POLITICO Pro, September 22, 2016
- Here's how to turn it off, Cosumnes Connection, September 9, 2016
- FTC To Review Facebook-WhatsApp Privacy Concerns, Law360, September 8, 2016
- Facebook's Plan for WhatsApp to Get Close Look from FTC, Fortune, September 8, 2016
- Facebook's acquisition of WhatsApp user data questioned, Consumer Affairs, September 7, 2016
- Betraying Your Community’s Trust: A Lesson from the WhatsApp Controversy, Small Business Trends, September 1, 2016
- EPIC, CDD complain to FTC about WhatsApp policy changes, PCWorld, August 30, 2016
- WhatsApp-Facebook User Data Move Incites FTC Complaint, Law360, August 30, 2016
- Privacy Groups File FTC Complaint over WhatsApp Data Sharing with Facebook, Threatpost, August 30, 2016
- Companies wary of WhatsApp privacy issues, New York Post, August 30, 2016
- WhatsApp Sharing Data with Facebook Raises Alarm for Privacy Advocates, ABC News, August 29, 2016
- Facebook Slapped With FTC Complaint Over WhatsApp Data Grab, Motherboard, August 29, 2016
- Facebook’s WhatsApp Privacy Changes Raise EU, U.S. Concerns, Bloomberg BNA, August 29, 2016
- European Regulators Scrutinize WhatsApp Data-Sharing Plan With Facebook, Wall Street Journal, August 29, 2016
- EPIC, CDD file complaint over WhatsApp data sharing, TheHill, August 29, 2016
- EPIC Prepares To File Complaint Over WhatsApp Sharing Data To Facebook, Tech Times, August 28, 2016
- Whatsapp and Facebook data sharing: Privacy group threatens legal action over invasive new terms, The Independent, August 28, 2016
- EPIC, CDD threaten legal action over Facebook, WhatsApp data sharing, SlashGear, August 28, 2016
- WhatsApp's Facebook Data-Sharing Plan Rouses EPIC , Law 360, August 27, 2016
- WhatsApp’s Privacy Cred Just Took a Big Hit, WIRED, August 25, 2016
- Relaxing Privacy Vow, WhatsApp Will Share Some Data With Facebook, New York Times, August 25, 2016
- WhatsApp Will Start Sharing Data, Including Phone Numbers, With Facebook, NPR, August 25, 2016
- WhatsApp Shaves Off a Little More Privacy, E-Commerce Times, August 25, 2016
- WhatsApp privacy backlash: Facebook angers users by harvesting their data, The Guardian, August 25, 2016
- Whatsapp says it will start sharing user info with Facebook, UPI.com, August 25, 2016
News Reports on EPIC Complaint to FTC on Facebook Acquisition of WhatsApp
- Jason Abbruzzese, Facebook Gains FTC Approval for WhatsApp — Plus a Stern Privacy Warning, Mashable, April 10, 2014
- Brian Womack and Alan Katz, FTC Says Facebook, WhatsApp Must Honor Consumer Privacy, Bloomberg, April 10, 2014
- Rachel King, FTC calls out Facebook, Whatsapp over privacy ahead of merger, ZDNet, April 10, 2014
- Zach Miners, FTC clears Facebook's WhatsApp deal, but warns on data collection, PC World, April 10, 2014
- Chris Welch, FTC issues stern privacy warning to Facebook and WhatsApp ahead of acquisition, The Verge, April 10, 2014
- Alexei Oreskovic, Facebook says WhatsApp deal cleared by FTC, Reuters, April 10, 2014
- Hayley Tsukayama, FTC warns Facebook, WhatsApp: Keep your privacy promises, Washington Post, April 10, 2014
- Michael Krebs, On Mounting Privacy Concerns, WhatsApp CEO Defends Acquisition, Digital Journal, March 25, 2014
- Kate Tummarello, Privacy groups: WhatsApp users don't want Facebook deal, The Hill, March 21, 2014
- Casey Johnston, WhatsApp’s idealism and Facebook realism: A study in contrast, Ars Technica, March 18, 2014
- Stuart Dredge, WhatsApp boss on Facebook privacy fears: 'Our principles will not change', Digital Journal, March 18, 2014
- John P. Mello, Jr., Bad Ads Outstrip Porn as Mobile Phone Infection Vectors, Tech News World, March 11, 2014
- Michael McEnaney, Facebook's purchase of WhatsApp shines light on personal data privacy once again, Tech Times, March 10, 2014
- Dino Grandoni, WhatsApp's Biggest Promise May Get Broken With Facebook Deal, Huffington Post, March 10, 2014
- Tim Parker, Privacy Groups Ask FTC To Investigate Facebook's WhatsApp Acquisition, Benzinga, March 10, 2014
- Kristin Burnham, Facebook's WhatsApp Deal Under Fire, Information Week, March 8, 2014
- Tom Pritchard, WhatsApp Purchase Challenged Over Privacy Concerns, Gizmodo, March 8, 2014
- Randell Suba, Facebook-WhatsApp deal leaves angry privacy advocates knocking on FTC door, Tech Times, March 8, 2014
- M Rochan, P WhatsApp Users' Personal Data at Facebook's Behest as Privacy Groups Call Halt on $19bn Deal, International Business Times, March 7, 2014
- Vikas Shukla, Privacy Advocates Urge FTC To Halt Facebook Inc - WhatsApp Deal , Value Walk, March 7, 2014
- Info Security Magazine, Privacy Groups Ask FTC to Suspend Facebook's Acquisition of WhatsApp, March 7, 2014
- Kevin Rawlinson, Facebook's WhatsApp purchase challenged, BBC News, March 7, 2014
- Nate Swanner, Privacy groups demand Facebook Whatsapp acquisition be halted, Slashgear, March 7, 2014
- Adam Dickter, Privacy Groups Ask FTC To Block Facebook Deal for WhatsApp, Sci-Tech Today, March 7, 2014
- Privacy groups ask US Federal Trade Commission to halt Facebook-WhatsApp deal, Economic Times, March 7, 2014
- Ruby Kannan, Privacy groups want FTC to investigate Facebook-WhatsApp deal, Techie News, March 7, 2014
- Dean Arrindell, Economy adds 175,000 jobs in February; Privacy groups fight Facebook; Gap same store sales decline, Yahoo! Finance, March 7, 2014
- Ashlee Kieler, Facebook, WhatsApp Acquisition Face Privacy Hurdle After EPIC Files FTC Complaint, Consumerist, March 7, 2014
- Paul Ausick, Privacy Group Challenges Facebook’s Acquisition of WhatsApp, 24/7 Wall Street, March 7, 2014
- Lee Munson, Privacy groups lodge complaint over Facebook's acquisition of Whatsapp, Naked Security, March 7, 2014
- CBR Staff, Privacy group asks FTC to investigate Facebook's WhatsApp acquisition, Computer Business Review, March 7, 2014
- Cecilia Kang, Privacy advocates decry Facebook’s purchase of WhatsApp , Washington Post, March 6, 2014
- Jessica Guynn Privacy groups urge FTC to probe Facebook's deal to buy WhatsApp, Los Angeles Times, March 6, 2014
- Will Oremus, Privacy Group Calls for Federal Investigation of Facebook's $19 Billion WhatsApp Deal, Slate, March 6, 2014
- Casey Johnston, Facebook’s shot at WhatsApp data gets both companies an FTC complaint, Ars Technica, March 6, 2014
- Patricia Yollin, Privacy Groups Seek FTC Probe of WhatsApp Acquisition by Facebook, KQED News, March 6, 2014
- Alexei Oreskovic, Privacy groups ask regulators to halt Facebook's $19 billion WhatsApp deal, Reuters, March 6, 2014
- Seth Rosenblatt, Privacy groups ask FTC to block Facebook-WhatsApp deal, CNET, March 6, 2014
- Sarah Frier, FTC Should Investigate Facebook-WhatsApp Deal, Groups Say , Bloomberg, March 6, 2014
- Julian Hattern, Does Facebook, WhatsApp deal violate privacy law?, The Hill, March 6, 2014
- Dustin Volz, Privacy Groups Ask Feds to Investigate Facebook's WhatsApp Buy, National Journal, March 6, 2014
- Benny Evangelista, Consumer privacy groups seek FTC review of Facebook-WhatsApp deal, San Francisco Gate, March 6, 2014
- Mia Saini, Could Privacy Concerns Kill Facebook-WhatsApp Deal?, Businessweek, March 6, 2014
- Chloe Albanesius, Groups Want FTC to Probe Facebook, WhatsApp Deal, PC Magazine, March 6, 2014
Share this page:
EPIC relies on support from individual donors to pursue our work.
Subscribe to the EPIC Alert
The EPIC Alert is a biweekly newsletter highlighting emerging privacy issues.
Communications Law and Policy
Jerry Kang and Alan Butler