FTC May Investigate WhatsApp For Giving Facebook Your Data

"We will not ever sell your personal information to anyone," WhatsApp claimed before Facebook sale.

Illustration: Diana Quach
Aug 30, 2016 at 3:52 PM ET

WhatsApp’s recent decision to start sharing user data with Facebook didn’t just upset privacy advocates. It may prompt the Federal Trade Commission to intervene.

The Electronic Privacy Information Center, a nonprofit advocacy group, submitted a legal complaint Sunday asking the FTC to investigate WhatsApp after the chat program controversially announced Thursday that it would begin sharing data with Facebook for marketing purposes, unless users explicitly opted out.

Even if users opt out of sharing data for marketing, a WhatsApp spokesperson told Vocativ at the time, Facebook will still use “mobile identifiers” to recognize a WhatsApp user’s cell phone number if they also have the Facebook app installed on that phone.

While the decision may have been unsurprising — Facebook is known for collecting vast quantities of user data, and it purchased WhatsApp in 2014 — it still was widely seen as a betrayal, since WhatsApp has long presented itself as a privacy-focused company. In 2009, its official blog promised that “We have not, we do not and we will not ever sell your personal information to anyone. Period [emphasis theirs].” And just in April, it became the world’s largest provider of end-to-end encrypted messaging, rolling out the service to all of its more than one billion users.

WhatsApp collected data, specifically phone numbers, with the promise that those numbers would never be used or disclosed for marketing purposes,” Claire Gartland, Consumer Protection Counsel at EPIC, told Vocativ. “Based on those promises, over a billion WhatsApp users provided that information. Now they’re going back on their promise and using and disclosing that data for marketing and other purposes without first getting users opt-in affirmative, express consent.”

There’s no doubt that the FTC is keeping a watchful eye on WhatsApp. Though the agency didn’t respond to Vocativ’s request for comment about EPIC’s complaint, right after Faceook first acquired WhatsApp, Jessica Rich, the FTC’s Director of Consumer Protection, formally reminded the companies that “WhatsApp has made a number of promises about the limited nature of the data it collects, maintains, and shares with third parties — promises that exceed the protections currently promised to Facebook users. We want to make clear that, regardless of the acquisition, WhatsApp must continue to honor these promises to consumers.”

Later, in 2015, Jamie Hine, a Senior Attorney at the FTC’s Division of Privacy and Identity Protection, wrote that when a larger company acquires one with stricter privacy policies, “To change the privacy promises already made to consumers, you’ll need to inform consumers and get their express affirmative consent to opt in to your new practices.” Notably, WhatsApp’s new policy is opt-out, meaning that to not share their information, users must uncheck a pre-checked box agreeing to the new terms.

“When a company goes back on a promise about information that it had already collected — that people turned over with that understanding that it would be kept private — the FTC has previously said that companies have to get opt-in consent,” Gartland said. “This is such a clear case. I really don’t see any ambiguity here.”

In a formal statement, a WhatsApp spokesperson defended the company’s actions against EPIC’s complaint:

“WhatsApp complies with applicable laws. As always, we consider our obligations when designing updates like this. We’ve made our terms and privacy policy easily accessible, provided an overview of the key updates, and empowered people to make decisions that are right for them, including offering a control for existing users over how their data can be used.”