American messaging app WhatsApp has spent the last two weeks putting out the fire that it didn’t think would start with a simple notification.
In the first week of January, around two billion users from all over the world got an in-app alert from WhatsApp. The world’s largest online messaging company was trying to tell its users that its updated privacy policy would kick in from February 8. And for the users to keep using the messaging app, they would have to accept the new terms.
For the California-headquartered company, it was business-as-usual as it had already made its stance clear a good few times already.
What WhatsApp did not foresee was that it would once again stoke the privacy debate over WhatsApp sharing user data with Facebook. A vast number of users considered the notification as WhatsApp breaching the trust by sharing their chats and other data with the Mark Zuckerberg-owned social media giant.
The said update entailed how WhatsApp shares chat details between users and businesses with its parent, Facebook, for targeted advertisements across Facebook products. The only change this time was that WhatsApp explained how data would be shared with Facebook when users interact with businesses that use social media giant’s hosting services.
Late last year, Facebook said it would soon roll out its web hosting service, a cloud-based server for big businesses who would like to manage their chats and payment receipts they share with customers.
From now on, it said, businesses that choose to use its hosting services would be clearly labeled so users can decide whether they want to communicate with that business account or not.
A day after the notification, Elon Musk, Tesla Inc. and SpaceX’s chief executive officer, tweeted to his 42 million-plus followers–“use Signal,” a rival messaging app. And that was just the start of the massive global backlash that WhatsApp would face over the next few weeks.
Back in India–WhatsApp’s largest market with 450 million users and where WhatsApp has been eyeing a huge B2B opportunity with millions of small enterprises shifting operations online due to the pandemic, the angst against the company rose like mercury.
The WhatsApp saga in India
Last week, many Indian companies advised their employees not to use WhatsApp to share sensitive information. A few prominent entrepreneurs including India’s most valuable startup Paytm’s Vijay Shekhar Sharma publicly suggested a switch to Signal or Telegram, alternate messaging platforms to WhatsApp, as they don’t collect any user data.
Sridhar Vembu, the billionaire founder of SaaS giant Zoho, announced the company will soon launch a messaging app called Arattai for Indians. Consequently, downloads of Signal and Telegram, in India have spiraled up.
The mistake Facebook-WhatsApp duo made was they didn’t make it clear from the beginning that the change in privacy policy would only affect users’ conversations with businesses. It was too late by the time it tried to rectify its mistake by issuing a clarification on January 14, a week after it sent the notification. WhatsApp said its new policy only pertains to business chats and not private chats with family and friends.
However, there is no opt-out option in the new update, unlike previous times, except for users in European Union (EU) owing to its strict data sharing laws under General Data Protection Regulation.
On January 15, WhatsApp postponed the rollout of the updated privacy norms to mid-May as it said it would like to first clear all the miscommunication.
Earlier this week, Delhi High Court took WhatsApp’s side and flatly told a petitioner, who had challenged WhatsApp’s new privacy policy, “It is a private app. Don’t join it. It is a voluntary thing, don’t accept it. Use some other app.” The same day, the Indian government wrote to WhatsApp global CEO Will Cathcart demanding the withdrawal of the new updates over the grave privacy concerns. The government said it is discriminatory that users in the EU have an option to not agree to new changes, but Indian users are not given that choice.
In its previous policy updates, the company had already made it clear that the information it shares with other Facebook companies includes users’ phone number, transaction data, mobile device information, IP address, and how they interact with others including businesses, among other things. What it doesn’t share with anybody is messages, logs of everyone’s text or call history, and users’ contact list.
Whether WhatsApp rolls back the new updates or not, the fact that it shares business chat details with Facebook is undisputed.
For businesses using WhatsApp, the company has already stated it shares users’ information with Facebook to make better product suggestions and show relevant offers and ads.
“The recent update does not expand our ability to share data with Facebook but instead provides further transparency about how we collect and use data,” the company said last week.
“These are not new regulations. These were first announced in August 2016. What WhatsApp announced two weeks back was that it has been sharing the data of business account conversations with Facebook,” said Jayanth Kolla, founder and partner at Bengaluru-based business consultancy firm Convergence Catalyst.
Facebook is currently pitching its own hosting services to businesses for managing WhatsApp chats with their customers which generally use third-party servers. And hence the update in the privacy policy.
“Facebook is getting into hosting services and for that, the clarification has come,” Kolla added.
Taking a step back
Founded by Brian Acton and Jan Koum, former employees of Yahoo!, WhatsApp started as a one-to-one chat service in February 2009. It was later that year when WhatsApp first clarified that it does not share or sell user data with anyone.
“We have not, we do not, and we will not ever sell your personal information to anyone. Period. End of story,” wrote the then nine-month-old WhatsApp in response to a developer spreading rumors on iTunes about the company selling user data. “To the developer of the competing app, who shall remain nameless, we have four words for you: ‘karma is a bitch’. And if you don’t like those four words, here’s four more: ‘We have retained counsel.’
Even after WhatsApp was acquired by Facebook in 2014 for an eye-popping sum of USD 19 billion, Koum maintained that the company’s initial stance on privacy would not change.
“Here’s what will change for you, our users: nothing. WhatsApp will remain autonomous and operate independently,” he wrote in a blog.
However, things started to change two years later. In August 2016, for the first time, the company said it would start sharing user data with Facebook. This data won’t entail private chats and users’ contact information, but everything else in and around it, which is technically called metadata–data about the data.
WhatsApp said it would share “basic metrics about how often people use our services” and link users’ phone numbers with Facebook’s systems so as to offer better friend suggestions and show relevant ads on Facebook. This was based on the premise that WhatsApp wanted to explore ways for users to communicate with businesses that matter to them, while still giving them an experience without third-party banner ads and spam.
At the time, the company gave a 30 day-window to its billion-plus users to opt-out if they didn’t want their data to be shared. Over the next 1.5 years, WhatsApp founders left the company over the disagreement with Facebook on how to monetize WhatsApp. With that, the company that was once witty and committed to protecting user privacy lost its individuality and become just another Facebook product.
The recent privacy policy updates, thus build onto what WhatsApp has been saying and doing over these last few years.
The impact on businesses
While there are about 15 million Indian businesses that use WhatsApp for communicating with users, no other business has closer integration with the messaging app than oil-to-telecom conglomerate Reliance’s e-commerce venture JioMart.
In April 2020, as part of its USD 5.7 billion investment in Jio Platforms, Facebook agreed to let JioMart use WhatsApp to roll out its services across India. Essentially, it meant users would be able to buy products from JioMart using WhatsApp.
Thus it is likely that JioMart’s conversation with users on WhatsApp will be shared with Facebook. However, it remains to be seen if this tie-up will turn out to be a disadvantage for Reliance due to privacy concerns.
According to Kolla, it won’t hugely impact JioMart’s strategy to sell via WhatsApp. “It would be an irritant for a few weeks for these companies due to negative sentiment around privacy, but that would eventually die down.”
“We have seen movements to remove Facebook products over and over again, but it never lasts because of the network effect even though product-wise, there are other alternatives,” said Kolla. “Privacy is a key and integral concern, but not an adequate concern for people to move. And people purely on empirical data knew that this was happening.”
“As for the other smaller companies that use WhatsApp business accounts, what other options do they have? How will they convince their users to move from WhatsApp and to what else they can move on to?” he said.
Kolla believes Facebook products including WhatsApp and Instagram have created “an intricately connected ecosystem” with billions of users.
“These small businesses are a part of this ecosystem because they also advertise and garner customers from Facebook and Instagram,” he said. “How can they stay away from the same ecosystem when it comes to sharing data with Facebook.”
Besides, this might be a win-win situation for businesses. “Facebook can always incentivize them for data sharing by saying their ads will be much more targeted and cheaper if they share their data with Facebook,” Kolla added.
As such, Facebook is pitching its hosting services to businesses by stating it would cut the cost of using WhatsApp business API (application programming interface) that lets them chat with users.
According to Apar Gupta, a lawyer and executive director at Internet Freedom Foundation, one of the biggest concerns over WhatsApp’s recent privacy policy, is that business accounts can back up their conversations with users on Facebook’s servers if they are using its hosting services.
“Hence Facebook will have the actual content of the conversation, which would compromise the secrecy of the conversation between businesses and its customers. Thus the end-to-end encryption becomes immaterial here,” he said. “Facebook then will be able to use this data to further micro-target its ads on its various platforms.”
This is something Facebook has also acknowledged.
“Whether you communicate with a business by phone, email, or WhatsApp, it can see what you’re saying and may use that information for its own marketing purposes, which may include advertising on Facebook,” the company said in its blog. “To make sure you’re informed, we clearly label conversations with businesses that are choosing to use hosting services from Facebook.”
However, Gupta said, “what is also important to consider is that we are just going by WhatsApp’s own statements, and there is no audit of its data-sharing practices with Facebook and what Facebook is doing with the data.”