WhatsApp announced new terms of use in the first week of January as of Feb. 8. What followed was much commotion and questions about user privacy. The biggest fuss arose over the possible sharing of data between WhatsApp and parent company Facebook.
Coauthor: Menno Weij
Facebook has not been very positive in the news lately. In December 2020, the US FTC (Federal Trade Commission) and 46 US states sued Facebook for maintaining an illegal monopoly position. They want to enforce through the courts that Facebook stops hindering competition by other platforms. The company is now so large that the entry of new competitors is almost impossible (with an exception such as TikTok). The FTC and states want to get this done by, for example, forcibly divesting WhatsApp and/or Instagram. This reduces the monopoly position and makes it easier for other (starting) platforms to get bigger. The commotion about data sharing between the two companies also seems to fit into the discussion about Facebook's monopoly position.
In response to the outcry, which WhatsApp initially tried to reduce via an FAQ and posts on Twitter, it has decided to make the terms effective not on Feb. 8, but on May 15.
The question is whether this decision didn't come too late: the number of users of apps such as Signal and Telegram was rising rapidly, and according to several media outlets, Whatsapp had to fear an exodus of users.
This begs the question: what exactly is going on here, and is switching to another app like Signal or Telegram really a better option if you are concerned about your privacy?
First, the changed terms of use. What has changed from before? According to Whatsapp, it is only about clarifying what is already happening and transparency about data processing. The proposed changes seem to be going to affect webshop owners the most, for users who send private messages among themselves little will change.
The reason for the change is the demand from consumers to send a message to a business via WhatsApp. In October 2020, the company revealed that more than 175 million people send a message to a WhatsApp Business account every day.(1) Its own research found that people prefer to send a message to a business when they have a question and are more likely to make a purchase if they have this capability. It also plans to offer more options for customers to order products (for example, through Facebook Pay) and make a purchase directly through chat. It should be easier for companies to integrate these features into their existing commerce and customer solutions. This would help many small businesses that are suffering from the corona period.
In addition, among other things, they want to give companies the ability to manage their WhatsApp messages through hosting services that Facebook will begin offering. This would help small and medium-sized businesses in particular. WhatsApp is taking into account the possibility that businesses will have to pay for some of these services.
To make these (proposed) changes possible, WhatsApp had to change its terms and conditions.
Following the change, WhatsApp clarified what they share with Facebook through an FAQ in Europe. In order to receive services from Facebook companies, WhatsApp shares data as described in its privacy policy. As an example, Facebook provides analytics services to WhatsApp. In doing so, Facebook uses the phone number, some device data and usage data that WhatsApp collects from you. In addition, data is also used to promote safety, security and integrity between Facebook companies. One example is to delete a spam account as soon as possible.
Specifically, WhatsApp states that it shares data with Facebook and how it is used. First, this is so that Facebook companies can offer services to Whatsapp, such as providing infrastructure, technologies, systems, tools, information and expertise. In addition, these are also used to understand how the services are used and to compare WhatsApp's usage with Facebook as a whole. Finally, WhatsApp indicates in this context that sharing information helps make Whatsapp a sustainable business. Data is then used how people and companies can communicate through WhatsApp and can help people so find companies they are interested in. How the latter helps to build a sustainable business, however, is questionable.
Data is also shared to secure the services of WhatsApp and other Facebook companies, for example by quickly identifying when someone impersonates another, or identifying a user who violates the terms of service of one of the Facebook companies.
Data will not be shared to improve Facebook products on Facebook or to show more relevant ads. WhatsApp says this is a result of previous discussions with the Irish regulator.
However, the company does indicate that there is only one option to influence Facebook companies' use of WhatsApp data, and that is to delete your WhatsApp account.
Incidentally, what WhatsApp has been under fire for some time is the fact that (temporarily) the contact's own phone numbers are shared with Whatsapp. This is necessary to see if there are already contacts in the phone book who use WhatsApp. Under the General Data Protection Regulation (AVG), this requires permission from users who do not use WhatsApp themselves.
Incidentally, a number of regulators have also spoken out. The Italian regulator finds the updated general terms and conditions insufficiently clear for users. This is a requirement of the AVG and therefore it is acting in violation of it. It has submitted questions to the European Data Protection Board, the general European advisory body on the AVG. In addition, the Turkish regulator has raised questions from a communications law perspective. There would be differences in how much data would be shared with Facebook inside and outside Europe. Interestingly, by the way, the Irish regulator, which includes Facebook Ireland, has not yet spoken up.
So is a reason for the fuss to be found in the fact that what WhatsApp is doing or intends to do violates the AVG?
Personal data (which may include names, phone numbers and the like) can only be used if there is a reason for doing so, called a basis. Generally, this basis for WhatsApp is consent. They indicate in their terms and conditions to use other bases as well, such as that the use of data is necessary for the performance of the agreement or the performance of a legal duty.
Not every form of consent is valid under the AVG. Consent must be freely given, for specific purposes, the person must be properly informed and must be given unambiguously. For example, giving consent by means of an already checked box is not sufficient. Whether there is free consent in this case, in having to accept in this way, is questionable. In addition, it is also required that the statement be designed in understandable and an easily accessible form and in clear and simple language. After all, as a user you need to know exactly what you are consenting to and this should not be too much of a hassle for you as a user. Giving consent is often included in general terms and conditions. Thus, according to the Italian regulator, WhatsApp's new terms and conditions do not meet the requirement of being clear enough for the average user.
Sharing data is also only allowed when there is a basis for doing so. Again, this will likely be consent; you are agreeing to WhatsApp's terms and conditions which state that they will "share" your data with Facebook. However, sharing is subject to conditions: for example, the purpose of the processing must be in line with what you are giving the data to Whatsapp for.
In addition, WhatsApp says it also takes many security measures. For example, messages are and remain end-to-end encrypted so they (or Facebook) cannot see the content of calls and messages and neither company can see your shared location.
So what it turns out: for European users, this is mostly a storm in a teacup. So the consequences (partly due to the AVG) are small. This may be different for users outside of Europe, as the AVG does not apply to them.
As previously indicated, the non-sharing of data with Facebook is a result of consultations with the Irish privacy regulator. The company says it is constantly developing new ways to improve the user experience of WhatsApp and other Facebook products. However, the company does indicate that data sharing is an option in the future, provided agreement is reached with this regulator:
"Should we choose in the future to share such data for this purpose with the Facebook companies , we will only do so if we reach agreement with the Irish Data Protection Commission on a future mechanism to allow such use."
Incidentally, it also remains to be seen how the lawsuits filed in the US will develop. If Whatsapp is forced to be split off, it remains to be seen how easily data can be shared between the two companies.
In the midst of the commotion, many users decided to switch to two other services: Signal and Telegram. These are also two communication services, but a lot smaller than WhatsApp.
Elon Musk called for Signal on Twitter. The Consumers Union is also a fan and has labeled Signal the best free telecommunications app.(2) It is open source, uses strong encryption for messages and backup and does not store the contact list. However, like WhatsApp, Signal does use the contact list to see if they also use Signal (the difference is that they hash the phone numbers).
As possible further disadvantages, it mentions that the app is not completely anonymous because the phone number is used as the username and it is a U.S. service that states in its terms and conditions that it is subject to U.S. laws. This is less strict than in Europe.
On Jan. 12, Telegram reported via Twitter that they now have more than 500 million active users, in which 25 million had joined them in the last three days. Telegram is also open source. Conversations go through an encrypted connection, but are not themselves automatic. However, it is possible to set that up yourself. Finally, Telegram is also not anonymous.
Small detail when switching apps is though: your friends and family must also have this app. If they do not switch, then of course it becomes difficult to communicate with each other.
For now, the commotion is a storm in a teacup. Not much will change for European users partly because of the impact of the AVG. For now, WhatsApp does not intend to share much data with parent company Facebook. There are other apps on the market similar to Whatsapp that sometimes do better and sometimes worse in terms of privacy. The question then becomes whether switching is a better alternative than continuing to use WhatsApp.
More articles from BDO
