Alleging a trail of broken promises, two privacy-focused advocacy groups yesterday filed a complaint with the Federal Trade Commission against a recent WhatsApp privacy policy change that states it will begin sharing user data with parent company Facebook.
The Electronic Privacy Information Center (EPIC) and the Center for Digital Democracy (CDD) said in a joint complaint that the proposed change constitutes an unfair and deceptive trade practice, and called on the FTC to investigate.
EPIC Consumer Protection Counsel Claire T. Gartland told Threatpost that the FTC has yet to reply to the complaint; the commission does not publicize investigations and filing organizations may not be notified whether the FTC proceeds on a complaint, most of which are ultimately settled without formal hearings.
“EPIC will be keeping the pressure on the Commission to act, since this is such a clear violation of their numerous statements on the issue,” Gartland said. “If and when the FTC acts, they have the power to stop the proposed changes from going forward and/or enter into a settlement agreement with the companies – similar to the 2012 consent order with Facebook.”
In 2012, the FTC and Facebook settled over charges that Facebook repeatedly shared information that users intended to remain private. Facebook was ordered in the settlement to give consumers “clear and prominent notice and obtaining their express consent before sharing their information beyond their privacy settings, by maintaining a comprehensive privacy program to protect consumers’ information, and by obtaining biennial privacy audits from an independent third party,” the FTC said in a release.
WhatsApp, which was acquired by Facebook two years ago for $19 billion, said last Thursday in a blogpost that it would soon begin sharing users’ phone numbers with Facebook, a move that would improve targeted advertising and connections with the friends on Facebook.
“Our belief in the value of private communications is unshakeable, and we remain committed to giving you the fastest, simplest, and most reliable experience on WhatsApp,” WhatsApp said.
EPIC and CDD, however, said in their complaint to the FTC that the transfer of such data was collected by WhatsApp under promises made in the early days of the Facebook acquisition that private information would not be used or disclosed for marketing purposes.
WhatsApp says in its new policy that users will have the opportunity to choose not to share data with Facebook, rather than opt-in to the program.
In the FTC complaint, EPIC and CDD point out that WhatsApp founder Jan Koum and Facebook founder Mark Zuckerberg both promised that WhatsApp would operate autonomously and that nothing would change regarding the way WhatsApp uses user data. The complaint also references a 2014 complaint filed with the FTC by EPIC and CDD that called for an investigation and possible injunction blocking the acquisition.
Yesterday’s complaint cites a 2014 letter from FTC Consumer Protection Bureau director Jessica Rich to Facebook and WhatsApp officers reminding the companies of promises Facebook made to WhatsApp users, stating that any uses of WhatsApp user data for marketing and advertising purposes violates privacy promises made by the two companies, and that both must obtain consumers’ consent before doing so.
“WhatsApp has made a number of promises about the limited nature of the data it collects, maintains, and shares with third parties–promises that exceed the protections currently promised to Facebook users,” Rich wrote. “We want to make clear that, regardless of the acquisition, WhatsApp must continue to honor these promises to consumers.”
WhatsApp and Facebook combined have more than two billion users globally. WhatsApp’s messaging service in April introduced end-to-end encryption based on the Signal protocol, securing calls, messages, files, video and voice messages.
