The Electronic Privacy Information Center (EPIC) and the Center for Digital Democracy (CDD), two of the biggest digital privacy organizations in the U.S., filed a complaint with the FTC against WhatsApp’s new policy to share user data with Facebook.
If you were careful, you could opt-out of allowing Facebook to use the data for ads, but Facebook would still get it either way. To opt-out, you have to click at the bottom and go to a separate screen, where you can uncheck the box before hitting the “Agree” button.
WhatsApp’s Failed Privacy Promises
Before it was acquired by Facebook, WhatsApp promised its users that it would “never” sell their information.
“So first of all, let’s set the record straight. We have not, we do not and we will not ever sell your personal information to anyone. Period. End of story. Hopefully this clears things up,” said Jan Koum, WhatsApp’s founder in a 2009 blog post.
In 2012, Koul followed with:
“At WhatsApp, our engineers spend all their time fixing bugs, adding new features and ironing out all the little intricacies in our task of bringing rich, affordable, reliable messaging to every phone in the world. That’s our product and that’s our passion. Your data isn’t even in the picture. We are simply not interested in any of it,” said Koum.
When WhatsApp was acquired by Facebook in 2014, Jan Koum said that "nothing" will change for users. The message was reiterated by Facebook’s CEO, Mark Zuckerberg, a few days later:
“We are absolutely not going to change plans around WhatsApp and the way it uses user data. WhatsApp is going to operate completely autonomously,” said Zuckerberg in 2014.
EPIC And CDD Step In
Before it allowed the WhatsApp acquisition to complete, FTC also seems to have required Facebook to make any changes to WhatsApp’s data collection policy opt-in rather than opt-out:
“We want to make clear that, regardless of the acquisition, WhatsApp must continue to honor these promises to consumers. Further, if the acquisition is completed and WhatsApp fails to honor these promises, both companies could be in violation of Section 5 of the Federal Trade Commission (FTC) Act and, potentially, the FTC’s order against Facebook,” said the FTC in 2014.
In other words, WhatsApp can’t first collect everyone’s phone numbers as part of the app’s installation process under the promise that the data will not be shared with anyone else, only to then give that data away, without the users’ explicit permission. As it is right now, not only will all Whatsapp phone numbers (as well as other information) be shared automatically with Facebook, but users have only 30 days to opt out.
In 2011, the FTC settled with Facebook, after the company “deceived consumers by failing to keep privacy promises.” Because of that, the FTC gave itself permission to keep Facebook under constant watch for the next 20 years, in case the social media company decides to do something like that again.
According to EPIC and CDD, Facebook is deceiving consumers once again by taking data it was never supposed to get without explicit opt-in permission. That should prompt the FTC to take action, if it’s consistent with its own past enforcement policies.