WhatsApp Users to Lose Access to Accounts Unless They Agree to Share Data With Facebook

I will put it as bluntly as it is ‘Facebook wants your WhatsApp data’ and if you don’t agree, they will delete your account as a condition of using the app. This is really surprising and a complete a U-turn which began when Facebook first acquired the app back in 2014. I am certain most of you today have already seen the pop-up message containing WhatsApp’s new terms of service and in as much I’ve temporarily clicked on not now, I am certain that the notification will soon reemerge once more prompting me to click on agree, unless I’d now want to do away with WhatsApp for good.

WhatsApp will shortly start to share your data with Facebook as a condition of use of the app and in the first paragraph I hinted that this completes a U-turn which began when Facebook first acquired the app back in 2014. At the time, WhatsApp assured users that their data would remain private, and not be shared with Facebook and for those who have forgotten let me take this opportunity to give you the background which I will highlight below;

Background

Let’s take you back memory lane, shortly after WhatsApp was sold to Facebook for $19B, the messaging app gave the reassurance in a blog post.

“There has also been a lot of inaccurate and careless information circulating about what our future partnership would mean for WhatsApp users’ data and privacy. I’d like to set the record straight […]

Respect for your privacy is coded into our DNA, and we built WhatsApp around the goal of knowing as little about you as possible […] If partnering with Facebook meant that we had to change our values, we wouldn’t have done it. Instead, we are forming a partnership that would allow us to continue operating independently and autonomously. Our fundamental values and beliefs will not change. Our principles will not change.“

The first part of the U-turn came in 2016, when WhatsApp began sharing data with Facebook by default.

“By coordinating more with Facebook, we’ll be able to do things like track basic metrics about how often people use our services and better fight spam on WhatsApp. And by connecting your phone number with Facebook’s systems, Facebook can offer better friend suggestions and show you more relevant ads if you have an account with them.”

At the time, however, existing users could opt out of the data sharing.

“If you are an existing user, you can choose not to have your WhatsApp account information shared with Facebook to improve your Facebook ads and products experiences. Existing users who accept our updated Terms and Privacy Policy will have an additional 30 days to make this choice by going to Settings > Account.”

WhatsApp to share your data with Facebook as condition of use

“Respect for your privacy is coded into our DNA,” opens WhatsApp’s privacy policy. “Since we started WhatsApp, we’ve aspired to build our Services with a set of strong privacy principles in mind.” But come February 8, 2021, this opening statement will no longer find a place in the policy. The “key updates” concern how it processes user data, “how businesses can use Facebook hosted services to store and manage their WhatsApp chats,” and “how we partner with Facebook to offer integrations across the Facebook Company Products.”

The mandatory changes allow WhatsApp to share more user data with other Facebook companies, including account registration information, phone numbers, transaction data, service-related information, interactions on the platform, mobile device information, IP address, and other data collected based on users’ consent. Unsurprisingly, this data sharing policy with Facebook and its other services doesn’t apply to EU states that are part of the European Economic Area (EEA), which are governed by the GDPR data protection regulations.

The updates to WhatsApp terms and privacy policy come on the heels of Facebook’s “privacy-focused vision“ to integrate WhatsApp, Instagram, and Messenger together and provide a more coherent experience to users across its services. Users failing to agree to the revised terms by the cut-off date will have their accounts rendered inaccessible, the company said in the notification. WhatsApp’s Terms of Service was last updated on January 28, 2020, while its current Privacy Policy was enforced on July 20, 2020.

Facebook Company Products refers to the social media giant’s family of services, including its flagship Facebook app, Messenger, Instagram, Boomerang, Threads, Portal-branded devices, Oculus VR headsets (when using a Facebook account), Facebook Shops, Spark AR Studio, Audience Network, and NPE Team apps. It, however, doesn’t include Workplace, Free Basics, Messenger Kids, and Oculus Products that are tied to Oculus accounts.

What’s Changed in its Privacy Policy?

In its updated policy, the company expands on the “Information You Provide” section with specifics about payment account and transaction information collected during purchases made via the app and has replaced the “Affiliated Companies” section with a new “How We Work With Other Facebook Companies” that goes into detail about how it uses and shares the information gathered from WhatsApp with other Facebook products or third-parties.

This encompasses promoting safety, security, and integrity, providing Portal and Facebook Pay integrations, and last but not least, “improving their services and your experiences using them, such as making suggestions for you (for example, of friends or group connections, or of interesting content), personalizing features and content, helping you complete purchases and transactions, and showing relevant offers and ads across the Facebook Company Products.”

One section that’s received a major rewrite is “Automatically Collected Information,” which covers “Usage and log Information,” “Device And Connection Information,” and “Location Information.”

“We collect information about your activity on our Services, like service-related, diagnostic, and performance information. This includes information about your activity (including how you use our Services, your Services settings, how you interact with others using our Services (including when you interact with a business), and the time, frequency, and duration of your activities and interactions), log files, and diagnostic, crash, website, and performance logs and reports. This also includes information about when you registered to use our Services; the features you use like our messaging, calling, Status, groups (including group name, group picture, group description), payments or business features; profile photo, “about” information; whether you are online, when you last used our Services (your “last seen”); and when you last updated your “about” information.”

WhatsApp’s revised policy also spells out the kind of information it gathers from users’ devices: hardware model, operating system information, battery level, signal strength, app version, browser information, mobile network, connection information (including phone number, mobile operator or ISP), language and time zone, IP address, device operations information, and identifiers (including identifiers unique to Facebook Company Products associated with the same device or account).

“Even if you do not use our location-related features, we use IP addresses and other information like phone number area codes to estimate your general location (e.g., city and country),” WhatsApp updated policy reads.

Concerns About Metadata Collection

While WhatsApp is end-to-end encrypted, its privacy policy offers an insight into the scale and wealth of metadata that’s amassed in the name of improving and supporting the service. Even worse, all of this data is linked to a user’s identity.

Apple’s response to this unchecked metadata collection is privacy labels, now live for first- and third-party apps distributed via the App Store, that aim to help users better understand an app’s privacy practices and “learn about some of the data types an app may collect, and whether that data is linked to them or used to track them.”

The rollout forced WhatsApp to issue a statement last month. “We must collect some information to provide a reliable global communications service,” it said, adding “we minimize the categories of data that we collect” and “we take measures to restrict access to that information.”

In stark contrast, Signal collects no metadata, whereas Apple’s iMessage makes use of only email address (or phone number), search history, and a device ID to attribute a user uniquely.

There’s no denying that privacy policies and terms of service agreements are often long, boring, and mired in obtuse legalese as if deliberately designed with an intention to confuse users. But updates like this are the reason it’s essential to read them instead of blindly consenting without really knowing what you are signing up for. After all, it is your data.