WhatsApp and Facebook: what personal data is collected?

From February 8, 2021, Facebook will have access to WhatsApp data. Which data? And for what purpose ? Let’s analyze.

WhatsApp is getting closer to its parent company Facebook and breaks with the data protection policy of its users, which was not to share data with Facebook. The instant messaging tool would go as far as depriving the application of any user who refuses to communicate their personal data to Facebook, as of February 8, 2021. Over two billion users are affected by the change in terms of service.

The messaging application bought for 19 billion dollars in 2014 by the social network Facebook indicates, in the last publication of its general conditions of use, dated January 4, 2021: “Your phone number, profile name, and photo, “about” information, last seen information, and message receipts are available to anyone who uses our Services, although you can configure your Services settings to manage certain information available to other users, including businesses, with whom you communicate.”

The privacy policy continues as such: “We work with third-party service providers and other Facebook Companies to help us operate, provide, improve, understand, customize, support, and market our Services.”

The “services” in question are mainly Facebook, Messenger (Facebook’s instant messaging system) and Instagram. The data are in particular those of account creation, namely:

• Contact details
• Connection and usage (for example the IP address)
• Identification (including profile photo)
• Content (including when they are of an economic and financial nature)
• Personal life
• Or even professional when it comes to companies communicating with their customers and employees.

WhatsApp is, in fact, becoming a communication tool and a trading platform for companies, offering them the opportunity to use the services of the Facebook group, in particular for order management, transactions including financial, appointment booking, delivery, and shipping notifications.

The terms of use also stipulate that the application would henceforth be the platform for updating products and services between customers and companies and for carrying out marketing operations (a term which often implies the sending of targeted advertising ).

WhatsApp is a popular application because of its end-to-end encrypted flows stored on users’ devices. From now on, the takeover by Facebook has resulted in this major development: the data passes through the other services of the company. Concretely, this means that all the data that we exchange in the billions every day, everywhere in the world, whether it is photographs, intimate messages or even phone calls, is within the grasp of the Facebook empire. The promise of respect for user privacy, once proclaimed by WhatsApp, is now totally misguided.

What is the purpose of this notable change in terms of use? It could that Facebook wants to make WhatsApp a profitable asset. Like Facebook itself and Instagram, whose profits are derived from targeted advertising, WhatsApp as an interface for businesses is likely to yield significant gains for its owner.

The terms of use specify that “WhatsApp shares information globally, both internally within the Facebook Companies and externally with our partners and service providers, and with those with whom you communicate around the world, in accordance with this Privacy Policy. Your information may, for example, be transferred or transmitted to, or stored and processed in, the United States; countries or territories where the Facebook Companies’ affiliates and partners, or our service providers are located; or any other country or territory globally where our Services are provided outside of where you live for the purposes as described in this Privacy Policy”[1].

This notion of “service providers,” must be clearly understood: these are subcontracting companies, also known as “affiliates.” These are likely to have access to a user’s personal data; in any case, any data they decide to share on the instant messaging application. A second hypothesis allows us to analyze the choice of Facebook differently. Some question the very survival of WhatsApp. Businesses and private users may not be won over by the stated objective of the new terms of use, which is to make it a commercial communication platform. The application could be subjected to the strategy of certain big enterprises, of which GAFAM [2] are not excluded, which consists of buying a competing solution to make it less attractive to its users, and ultimately to make it disappear. WhatsApp, by becoming a tool similar to Messenger, risks no longer appealing to its users who have the possibility of joining other instant chat channels such as the Signal solution, known worldwide for the attachment to respect for privacy on which it has built its strategy and development.

By becoming a twin tool of Messenger, the app could become a real headache when it comes to exercising rights [3]. This subject is already thorny for Messenger and Facebook: it is indeed almost impossible to obtain an unequivocal answer, or even a simple answer when a request for information, rectification, or opposition is made by a user. A more than problematic practice with respect to the GDPR [4] to which is added the fact that the choice offered to WhatsApp users is a non-choice: if they oppose the sharing of their personal data with Facebook, they would be banned from the platform. This new update, worrying in several respects, could provoke reactions from the European Data Protection Board (EDPB).

On January 13, 2021, Niamh Sweeney, Director of Public Policy at WhatsApp for the EMEA (Europe Middle East Area) market responded on her Twitter account. In particular, she explains:

“It has been incorrectly reported that WhatsApp’s latest Terms of Service and Privacy Policy update requires users in the European region to agree to the sharing of data with Facebook for ads purposes in order to continue using the service. This is false.” [5] This statement, which undoubtedly aims to reassure, raises certain questions. We have chosen to produce a new analysis, in the form of a separate article, available here.

[1] Privacy Policy Whatsapp
[2] Google, Amazon, Facebook, Apple, Microsoft
[3] Articles 13, 14 et 15 of the GDPR
[4] GDPR legislation
[5] The Twitter account of Niamh Sweeney : @NiamhSweeneyNYC