WhatsApp's new privacy policy: What changes and why it's a worry

WhatsApp has announced changes to its terms of service (ToS) starting February 8. Users must agree to the changes, or they won’t be able to use WhatsApp. The last such change was as recently as January 4, 2021. WhatsApp has been a Facebook (FB) subsidiary since 2014. 

Why has WhatsApp done this? 

Facebook Inc has been working to integrate services across Facebook (the social platform), FB Messenger, Instagram (FB bought it in 2012) and WhatsApp. Mark Zuckerberg announced this in October 2020. Insta and FB Messenger are already integrated. The new ToS explain how businesses can use WhatsApp for B2B or B2C conversations. WhatsApp is also rolling out payment options, and FB would like to conjoin that data.  

This initiative may also be rolled out in a hurry to pre-empt developments in a landmark anti-trust case. The US Federal Trade Commission and multiple US states have sued Facebook for monopolist behaviour. One of the demands is that Instagram and WhatsApp be delinked from FB, and perhaps spun off. The company may be hoping to present integration as a done deal.  

What does it mean for you and me?

Your privacy is impacted. WhatsApp holds some data about you. So does Facebook. Those data are in different silos. If the silos talk to each other, the company knows more. For example, it may learn that a given phone number (used for WhatsApp) is associated with the FB account (which may have a different name and/or different number associated). From February 8, FB will also be able to tie accurate location data if you give WhatsApp permission to use this.

FB can compare your contacts on WhatsApp, the interactions, and the WhatsApp groups you belong to, and compare those to FB contacts and FB activity. Plus, if you use WhatsApp transaction services, FB may be able to associate bank account, or card details that WhatsApp would pick up.  

What data can WhatsApp share then?

The ToS say: “We collect information about your activity on our services, like service-related, diagnostic, and performance information. This includes WhatsApp service settings; user-interactions; time, frequency and duration of activity; log files and diagnostic logs etc.”

“This also includes information about when you registered to use our services; the features you use like our messaging, calling, status, groups, payments or business features; profile photo, ‘about’ information; whether you are online, when you last used our services; and when you last updated your ‘about’ information.”

The data also includes device and connection-specific information like model, operating system, browser, IP address, phone number and device identifier. In addition, the new policy also specifies battery level, signal strength, app version, and identifiers unique to Facebook products like Onavo and CrowdTangle.

Businesses on WhatsApp may also share user information. Additionally, content shared with business accounts could be made accessible to third-party service providers. If the Jio Platform pushes WhatsApp-based retail services (given the FB investment), this detail may become very important. 

Is that a worry? Why? 

That’s a lot of information. When it is tied together and not isolated in different silos, it could be very revealing. One further worrying aspect for Indians is that school coordination occurs via WhatsApp groups as does Resident Welfare Association interactions. So FB will know personal details about minors as well — like their location, schools, pictures, etc. They may also know about your garbage collection, and whose dog has bitten which neighbour.  

Does this mean our WhatsApp chats are no longer encrypted? 

While your chats technically remain end-to-end encrypted, this data-sharing expansion makes leakage more probable. If you’re used to sharing private information or having private conversations on WhatsApp, you need to stop, or be aware this may not stay private.   

What if I don’t agree with the new policy? 

Binary options: Either you exit WhatsApp or you agree. If you’re uncomfortable about this and exiting is hard, consider mitigation efforts. For example, keep a dedicated WhatsApp sim you use for nothing else. Also consider advising family groups, RWAs, school groups to switch.  

What are the alternative platforms I can explore?

Signal is perhaps the best of the alternatives. It’s the most secure and you can migrate groups easily. But Signal has less than aesthetic colour schemes and features and the interface is not easy to navigate. Telegram is similar in terms of features but it has Russian parentage.

The major problem with alternatives is network effects; you can move to Signal/ Telegram in 10 minutes, but can you persuade your contacts to migrate with you? What’s the point of moving to a platform which your network of contacts doesn’t use?