WhatsApp to Automatically Share User Data With Facebook

Bloomberg Law: Privacy & Data Security brings you single-source access to the expertise of Bloomberg Law’s privacy and data security editorial team, contributing practitioners,...

By Daniel R. Stoller

Aug. 25 — Mobile messaging service WhatsApp Inc. announced Aug. 25 that under its updated privacy policy it will automatically share certain consumer data with its parent company Facebook Inc. unless a user specifically objects.

Jan Koum, CEO of WhatsApp, said in a statement obtained by Bloomberg BNA Aug. 25 that the company won't share consumer phone numbers with advertisers and other users on Facebook. If users agree to the updated privacy policy, they will have the option over 30 days “to opt out of having their WhatsApp information used for things like friend suggestions and other features on Facebook,” he said.

WhatsApp said in a blog post Aug. 25 that the information collected will only be used internally to improve “services and offerings, like fighting spam across apps, making product suggestions and showing relevant offers and ads on Facebook.” The mobile phone messaging company made it clear that nothing shared on WhatsApp “will be shared onto Facebook or any” other app “for others to see,” it said.

Edward J. McAndrew, privacy and data security partner at Ballard Spahr LLP in Philadelphia, told Bloomberg BNA Aug. 25 that the privacy policy change is the first step in how Facebook will monetize the WhatsApp subscriber database. The change will “enable Facebook and its corporate family, such as Instagram Inc., to improve services and make more money” off targeted advertising, he said.

The data and metadata that WhatsApp will send to Facebook “is the end all be all for the technology sector,” McAndrew said.

U.S. companies that collect data and share it with corporate parents or third parties may want to watch how consumers and regulators react to WhatsApp's updated privacy policy. If the profit from the monetization of data outweighs the litigation and regulatory risks look for more companies to adopt a similar model.

Facebook, which acquired WhatsApp in October 2014 for $21.8 billion, is the second largest internet media company in the world with a $354.6 billion market capitalization, Bloomberg data show.

Change of Business Model

More easily sharing customer data seems inconsistent with WhatsApp's privacy posture, McAndrew said.

Mountain View, Calif.-based WhatsApp offers end-to-end encryption, which only allows senders and recipients of the messages—via text, chat, voice or video—to view the content. Encryption is a strong privacy enabler, but one that many law enforcement officials decry as a means for criminals to evade detection.

WhatsApp has been locked in an encryption battle with Brazil over law enforcement agencies accessing content of conversations between persons under criminal investigation. The company has been shutdown three times by Brazilian judges for their refusal to turn over messages (15 PVLR 1536, 7/25/16). On each occasion, the Brazil Supreme Court overturned the lower court's decision.

Koum said that WhatsApp respects user privacy and that is the reason why they rolled out end-to-end encryption. “No one can read your messages other than the people you talk to,” he said.

McAndrew, who is also a former federal cybercrime prosecutor in the U.S. Attorney’s Offices for the Eastern District of Virginia and for the District of Delaware, said that even with the foreign encryption fight and potential consumer backlash it isn't surprising that WhatsApp would monetize its users. A company wouldn't sell for over $20 billion “if they never had plans to monetize their customer base,” he said.

Additionally, consumers who don't like the change in the privacy policy “are unlikely to have much success” in legal challenges, McAndrew said. Although the litigation risk may increase once it is more clear how Facebook uses the data, consumer will “most likely respond to the change by using a different encrypted messaging application,” he said.

May Consumers Opt-Out?

Users will have 30 days to opt out of having their information shared with Facebook, but the opt-out may not cover all data that may be shared with the social media giant.

Nate Cardozo, senior staff attorney at privacy advocacy group Electronic Frontier Foundation, told Bloomberg BNA Aug. 25 that it remains to be seen “how the opt-out is going to work in practice.” The WhatsApp opt-out allows the company to share data with the Facebook family of companies to help secure systems, fight spam and infringement activities, he said. “What exactly is an infringement activity and how Facebook will use the data is the most alarming,” he said.

It is also “unclear whether new users may opt out of Facebook sharing,” Cardozo said. If new users are forced to share their data with Facebook “it would be very disappointing,” he said.

Although engaging in blanket data sharing with Facebook may harm consumers by sharing sensitive information, allowing companies to send messages that users consent to is a good expansion of WhatsApp business model, Cardozo said.

Charging companies to send messages to consenting users is a great way to monetize the data without harming privacy interests, Cardozo said.

Facebook didn't immediately respond to Bloomberg BNA's e-mail requests for comment.

To contact the reporter on this story: Daniel R. Stoller in Washington at dstoller@bna.com

To contact the editor responsible for this story: Donald G. Aplin at daplin@bna.com

For More Information

The WhatsApp notice detailing changes to its privacy policy is available at https://www.whatsapp.com/legal/#privacy-policy.

A WhatsApp frequently asked questions page on the privacy policy change is available at https://www.whatsapp.com/faq/en/general/26000016.

The WhatsApp blog post is available at https://blog.whatsapp.com/10000627/Looking-ahead-for-WhatsApp.

Copyright © 2016 The Bureau of National Affairs, Inc. All Rights Reserved.