As of May 2021, most of WhatsApp's information about its users (individuals and businesses alike) will be shared with the Facebook group of companies including Instagram, for targeted advertising purposes such that users will no longer be able to opt-out of such sharing. Amid the fiasco prompted by WhatsApp's new privacy policy (the "New Policy") and the drastic shift of users to competing instant messaging apps, WhatsApp announced on January 15, 2021, that it will postpone the entry into force of the New Policy from the originally planned February 8, 2021, to May 2021.
According to the New Policy and WhatsApp's recent announcement, all users of the instant messaging app will be compelled to agree to the New Policy's and the sharing of its personal information with the Facebook group of companies, as a pre-condition to using the app. Users who do not accept the New Policy will not be able to activate WhatsApp and their account will be blocked.
Past Promises
WhatsApp was acquired by Facebook in 2014. The acquisition prompted protests from privacy advocates due to the fear of sharing users' personal information between the companies. Back then, the companies quickly denied that this was their intention. Two years later, the companies had reversed their position and openly declared their intention to share personal information about WhatsApp users. It invited public outcry and led to investigations, administrative restraining orders in countries like France and Germany, class action lawsuits, and fines. Then, for a brief period
Inherent Ambiguity
Contrary to WhatsApp's existing privacy policy, the New Policy does not mention the option, briefly available to users in the past, to instruct WhatsApp not to share information with Facebook. In media reports, WhatsApp now stresses that the privacy update does not bring about a material change because it has been sharing information with Facebook for a long time about most of its users around the world. This includes users who did not take timely advantage of the briefly available opportunity to opt-out, as well as users who WhatsApp only after the option was no longer available. Regardless, WhatsApp's New Policy does not clarify whether users who timely took advantage of the briefly available opportunity and opt-outed will have their opt-out overridden in May 2021. It also does not clarify how WhatsApp will treat the information of a user who timely opted-out but communicates via WhatsApp with another user who did not opt-out.
Sharing Personal Information and the Implications to Businesses
The personal information shared with the Facebook group of companies includes, among others, the registration information for WhatsApp services (i.e., the user's phone number), the phone numbers of that user's contact persons, information about the user's interactions via WhatsApp with other users (including interactions with business users) and more. This means, for example, that Facebook will be aware of the names and phone numbers of the users who contact a company's business account. Facebook can thereby profile them as customers of that business.
WhatsApp's has consistently stated that the content of messages and files exchanged between users is encrypted "end to end". The content of the messages should therefore not be available for WhatsApp or Facebook to access. However, the wealth of information surrounding the messages, i.e., the so-called 'meta-data', is as revealing as it is valuable. It can tell not only about a person's social connections but potentially also about personal characteristics such as approximate residential location (membership in a WhatsApp group of a neighborhood or residential building, for example), the existence of health issues (communication with physicians with well-known expertise), the existence of legal affairs (exchange of messages with lawyers) and more. When this information is cross-referenced with the data already in the hands of the Facebook group of companies, an accurate and intimate profile of a person can be created. Similar characteristics are also amassed on companies and businesses that communicate with their customers or employees through WhatsApp.
Under the New Policy, Facebook may use the information for a variety of purposes, including improving its service and user experience (e.g., delivering content tailored to the user's profile); promoting safety and security in all Facebook group's products; improving the integration between WhatsApp and other products and services offered by the Facebook group of companies; providing relevant business offers to individuals and businesses (i.e., targeted ads) and assisting in the performance and completion of acquisitions and transactions related to such offers.
Recommendation
Today, many organizations use WhatsApp to provide services to customers and employees, communicate between the organization and its employees, and more. The revisions to WhatsApp's Privacy Policy as of May 2021, do not proclaim a significant change of WhatsApp's practices to date. Yet the privacy risks entailed WhatsApp's sharing practices have now been brought to the forefront and public discourse. Therefore, we strongly recommend that companies reexamine and reconsider their use of WhatsApp in light of the potential concern for the privacy of employees and consumers and the business confidentiality of organizations.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
