WhatsApp’s new privacy policy sparks outcry. Here’s what you need to know

 

The latest changes to messaging service WhatsApp’s privacy policy is drawing ire from its loyal users.

The company announced on Jan. 6 it will force users to share information with Facebook if they want to keep using the service.

Privacy advocates have questioned the move, citing Facebook’s track record in handling user data. It has also prompted some people online — including Tesla founder Elon Musk — to call for users to leave the app and use more privacy-focused messaging services like Signal and Telegram.

 “Every time a company combines data from multiple sources, multiple platforms, it raises privacy concerns because it increases the possibility that people can be identified, that a company knows more about you,” said Anatoliy Gruzd, an associate professor and Canada Research Chair in privacy-preserving digital technologies at Ryerson University. “WhatsApp users are concerned about the increased integration with Facebook.”

New policy

The updated privacy policy requires users to “agree” to share data it collects about you — such as your phone number and location — with Facebook by Feb. 8 or else lose access to their accounts.

This data will be shared with the broader Facebook network, such as Instagram and Messenger, and applies regardless of whether you have accounts or profiles there.

The option to share data with Facebook has existed on the app for years, but up until now, it was only an option.

The terms now clearly state that “WhatsApp receives information from, and shares information with, the other Facebook companies. We may use the information we receive from them, and they may use the information we share with them, to help operate” and market services.

So, what’s changed?

In terms of how the messaging service functions — nothing.

The key allure of the app — end-to-end encrypted conversations and calls — is still intact. Neither WhatsApp itself nor Facebook and its entities can access them, meaning no one, including WhatsApp, knows what users are saying to each other.

WhatsApp says it will not share contacts with Facebook, nor can it or Facebook see users shared location. Messages can still be set to disappear and groups still remain private, the company clarified on Twitter this week.

The type of information that is being shared with Facebook is the main difference. According to the policy, other information that will be shared with Facebook includes the user’s browser information, language, time zone, IP address and mobile network. Your phone’s battery level, signal strength and connection information — such as your internet service provider — will also be shared.

Concern

Experts say this change deepens the integration between Facebook and WhatsApp. It doesn’t come as a surprise to Gruzd.

“They always intended to integrate WhatsApp with other services,” he said. “They’re trying to monetize — make money out of WhatsApp. From a business perspective, it makes sense.”

But the privacy concerns from its users are legitimate, he said. WhatsApp might still encrypt text conversations, but “other, unencrypted data points” may be problematic — now or in the future.

“As with many products like these, sometimes companies collect data and they don’t know how they plan on using it,” he said. “Once they start, it’s then we discover ethical and privacy concerns.”

Part of the concern stems from Facebook’s not-so-responsible track record on privacy, he added.

“It’s part of this holistic perception of Facebook as a company and what they do to protect their user base,” he said.

“Facebook has long been in the spotlight for privacy breaches and security vulnerabilities, starting from the Cambridge Analytica scandal. Every issue since has added to a negative perception of the company overall.”

Mass exodus

On Jan. 6, the day WhatsApp warned about its updated privacy terms, users started to abandon ship. Many have opted to take their encrypted conversations to similar messaging apps Signal and Telegram.

About 810,000 users globally installed Signal on Sunday, nearly 18-fold compared with the download numbers on Jan. 6, according to data from research firm Apptopia.

To cope with the number of new users, Signal said it added more servers to handle the traffic. Up until recently, the non-profit app was largely used by journalists and human rights activists looking for a more secure and encrypted mode of communication.

Both Musk and Edward Snowden offered Signal as an alternative. “Here’s a reason: I use it every day and I’m not dead yet,” Snowden tweeted.

Global differences

The policy isn’t the same around the world.

Europe and U.K. users will not see the same data-sharing changes as the rest of the world, though they will need to accept new terms. In a statement, as reported by BBC, Facebook said there would be no changes in the “European region” — which covers the EU, EEA and post-Brexit U.K. It is being seen as a victory for European Union privacy regulators, who fought hard for strict privacy laws and fines for breaching the bloc’s rules.

The policy for Canada and the United States has a number of statements that don’t appear in the version for Europe. For example, WhatsApp clearly states it wants to be able to let users start connecting their Facebook Pay accounts “to pay for things on WhatsApp.”

The app’s Terms of Service contains also contains a “binding arbitration provision” for Canada and the U.S. specifically. By agreeing to the app’s new terms, users also agree to resolve any disputes they may have with the app, “including those relating to, arising out of, or in any way in connection with your rights of privacy and publicity,” without a judge or jury.

Gruzd said it’s not uncommon to have “all kinds of conditions” for terms of service “buried away,” but without ample protections in Canada, there’s always more reason to be wary and conscious of what you’re agreeing to.

“In Canada, we don’t have strong privacy protection or data regulation. Right now, we’re not well protected, relative to what the Europen Union has, for example,” Gruzd said.

“As a result, companies like Facebook can include all kinds of conditions because it’s not against what we have in place.”

He stopped short of advising users on whether they should stay or go.

It’s ultimately a “trade-off,” he said.

“I think everyone will have to reassess the benefits and perceived risks,” he said. “If the perceived risk outweighs the benefit, then get out of the platform.”