"Agree or Not now" - users of WhatsApp were confronted with this in-app notification on their mobile screens last week. The notification alerted users that they will have to accept the new privacy policy by February 8, 2021, in order to keep using the services of WhatsApp or would lose access to their accounts once the deadline is over.
WhatsApp in its updated privacy policy stated in detail how it would share more user data with Facebook and Instagram. The data will also be shared with third-party businesses, thus revealing Facebook's plans to integrate the popular chat service it acquired in 2014 for $ 19 bn. The latest notification led to widespread outrage from several users over how the widely popular messaging app intends on using their data as they had no option to opt-out of it.
The pop-up specifically states, "After this date, you'll need to accept these updates to continue using WhatsApp." During its previous update to its privacy policy in July 2020, the messaging service had offered its users 30 days to opt out on sharing some of the data, which is missing this time.
WhatsApp Privacy Policy update pop up
The new policy dated January 04, 2021, states how it will process user data, how businesses can use Facebook services to store and manage their WhatsApp chats, more integration of Facebook's other products like Instagram with WhatsApp, and what data the platform would share with Facebook and third party users (Read here).
This data sharing policy with Facebook however doesn't apply to countries in the European Union that are governed by the General Data Protection Regulation (GDPR) data protection regulations as with the previous data policy.
BOOM spoke to experts to understand the impact this might have on users and the key questions that arise from this mandatory policy change.
Would WhatsApp messages still be encrypted?
Yes, the privacy policy does not change the end-to-end encryption for personal messages - so no third party can read them.
What data does WhatsApp collect on messages?
WhatsApp states that it doesn't store any user messages (including your chats, photos, videos, voice messages, files) once they have been delivered and that messages are stored on the user's device and not on its servers. Once the messages are delivered it states that it is deleted from its servers.
According to the policy, WhatsApp stores messages in encrypted form in two cases - Undelivered Messages and Media Forwarding. "If a message cannot be delivered immediately (for example, if you are offline), we may keep it on our servers for up to 30 days as we try to deliver it. If a message is still undelivered after 30 days, we delete it," it reads. On Media forwarding, it states that when a user forwards media within a message, WhatsApp stores the media temporarily in encrypted form on their servers to aid efficient delivery of additional forwards.
What user data does WhatsApp collect?
WhatsApp under the section, "Information that we collect" mentions the data that it collects like, "Battery level, signal strength, app version, browser information, mobile network, connection information (including phone number, mobile operator or ISP), language and time zone, IP address, device operations information, and identifiers (including identifiers unique to Facebook Company Products associated with the same device or account)." and range of other information.
What data will WhatsApp share with Facebook?
The privacy policy states that a user's phone number, IP address, mobile device information will be shared with Facebook. Data exchange with Facebook has been already taking place, however this would increase after the new policy as it is collecting more information at a device hardware level now.
"The information we share with the other Facebook Companies. includes your account registration information (such as your phone number), transaction data, service-related information, information on how you interact with others (including businesses) when using our Services, mobile device information, your IP address, and may include other information identified in the Privacy Policy section entitled 'Information We Collect' or obtained upon notice to you or based on your consent," states WhatsApp.
BOOM spoke to Aditya Chunduru, Journalist, Medianama who has covered the policy change and what it means going ahead. "The most important addition is if we see the policy, a lot of it is about how WhatsApp business accounts are going to get data and how this data will be disseminated to third parties which includes Facebook itself, essentially it allows these third parties to access data or user data on their interaction with business accounts like transaction history which would likely help in advertising across Facebook products," said Chunduru.
"This would likely make it easier for Facebook to triangulate users between its various products, which they have done for a while, like what kind of businesses you interact with and so on. Also, WhatsApp Pay data can now be transferred to Facebook because of the changed privacy policy," added Chunduru.
What type of payment data does WhatsApp collect?
WhatsApp states that If one uses the payments services for purchases or other financial transactions, additional information is processed about the user which includes payment account and transaction information.
"Payment account and transaction information include information needed to complete the transaction (for example, information about your payment method, shipping details and transaction amount)," it states.
Will there be Ads on WhatsApp?
WhatsApp in its policy states that it would still not allow banner ads. However it cannot be ruled out in the future as it also adds that it would update its privacy policy if it does so. "We have no intention to introduce them, but if we ever do, we will update this Privacy Policy," it states.
This is a major departure from its previous policy statement where it had completely ruled out allowing banner ads.
BOOM spoke to Rahul Sasi, an Indian entrepreneur, security expert, and white-hat hacker who said, "When they say they will give data to third parties, the way it always works is that they have created a unique identifier created for users, whether WhatsApp, Facebook, Instagram, or Messenger and that is linked to your name in their database which they will give out. So everyone else would have the identifier but would not know who you are, which is how advertisement works usually."
"So if one is on Instagram, whatever privacy concerns will be there on that, that will be there on WhatsApp also, but the platform being a very chat focused application, not everyone would like it. So I think Facebook is sure they will lose users with this, at the same time there is no other option for them, as WhatsApp is creating a money burn for them without creating any revenue and they have to kill a number of users and focus on the users that are fine with the advertising policies and then and run with them, this is what I think they are doing," added Sasi
What option do users have?
At the moment, a user would have to accept this policy in order to continue using WhatsApp. One could delete their account, however not all data of the users would be deleted.
"Please remember that when you delete your account, it does not affect your information related to the groups you created or the information about other users related to you, such as their copy of the messages you sent them," the policy states.
Several users on social media platforms upset with the move have suggested that they would move to other apps including Telegram and Signal. Tesla Motors CEO Elon Musk even endorsed Signal over WhatsApp as an alternative. Signal is a messaging app which is run by a non-profit and like WhatsApp is free and end-to-end encrypted.
"Apple has this privacy label where a user can choose if a user wants to be tracked outside an application which is an option people have who are concerned about privacy, however Android does not have this feature. Apple's business is mostly from mobile devices or hardware and so their future is dependent upon what their users are concerned about like privacy and it would be focused on building those measures," said Sasi on the options available to mobile users.
"On the other hand if the mobile manufacturer is using Android which is owned by Google, whose most income comes from advertisements, and it would be tough for them to implement such pro-privacy changes. It will be tough for Android to make such changes and users might force them to make these changes in the near future, otherwise, Android does not have this functionally coming in their roadmap currently," added Sasi
BOOM reached out to WhatsApp for a response on the updated privacy policy and we were directed to the statement put out by Will Cathcart, Head of Whatsapp on Twitter. Responding to criticism, Cathcart stated that the company updated its policy to be transparent and to better describe optional people-to-business features.
On being asked by a user regarding the mandatory opt-in, Cathcart responded stating saying that, "all apps require acceptance of terms updates as far as I know," and claimed that the terms and policy help provide transparency on data practices.
Also Read: What Is WhatsApp Pay, How To Send Money: All You Need To Know