Newsroom

Washington, DC (August 29, 2016) – The Electronic Privacy Information Center (EPIC) and the Center for Digital Democracy (CDD) today filed a complaint with the Federal Trade Commission, stating that the WhatsApp plan to transfer user data to Facebook is unlawful and that the FTC is obligated to block the proposed change in business practices.The EPIC-CDD complaint responds to a recent announcement from WhatsApp that the company plans to disclose the verified telephone numbers of WhatsApp users to Facebook for user profiling and targeted advertising.“When Facebook acquired WhatsApp, WhatsApp made a commitment to its users, to the Federal Trade Commission, and to privacy authorities around the world not to disclose user data to Facebook. Now they have broken that commitment,” said Marc Rotenberg, President of EPIC. “Clearly, the Federal Trade Commission must act. The edifice of Internet privacy is built on the FTC’s authority to go after companies that break their privacy promises.” Facebook and WhatsApp are the two largest social network services in the world. According to Wikipedia, WhatsApp has over one billion users. Facebook purchased the company in February 2014 for 19.3 billion dollars.EPIC Consumer Protection Counsel Claire Gartland explained, “In 2014, the FTC said that WhatsApp had to obtain affirmative consent to transfer user data to Facebook. There was an opt-out provision but that only applied to new information. Since WhatsApp intends to transfer user telephone numbers, which is not new data, it must obtain opt-in consent.”Gartland continued, “The phone number may also be the single most valuable piece of personal data obtained by WhatsApp. WhatsApp users are required to provide a verified phone number to use the service. And the phone number provides a link to a vast amount of personal information.”“The proposed change – an opt-out for data previously obtained – is exactly what the FTC said WhatsApp could not do,” said Gartland. “The transfer is only allowed if the consent is opt-in.”“The FTC has an obligation to protect WhatsApp users. Their personal information should not be incorporated into Facebook’s sophisticated data driven marketing business,” said Katharina Kopp, Ph.D., and CDD’s Director of Policy. “Data that was collected under clear rules should not be used in violation of the privacy promises that WhatsApp made. That is a significant change that requires an opt-in, according to the terms the FTC set out. It’s not complicated. If WhatsApp wants to transfer user data to Facebook, it has to obtain the user’s affirmative consent.”In 2011, EPIC, CDD and more than a dozen consumer privacy organizations pursued a successful complaint at the FTC that led to a twenty-year consent order after Facebook changed user privacy settings in a way that made users' personal information, such as Friend lists and application usage data, more widely available to the public and to Facebook’s business partners.Former FTC Chair John Liebowitz said at the time, “Facebook is obligated to keep the promises about privacy that it makes to its hundreds of millions of users. Facebook's innovation does not have to come at the expense of consumer privacy. The FTC action will ensure it will not."When Facebook proposed to acquire WhatsApp in 2014, EPIC and CDD said the FTC must protect the privacy of WhatsApp users. The FTC said that WhatsApp must continue to honor its privacy promises to consumers.The FTC warned, “If the acquisition is completed and WhatsApp fails to honor these promises, both companies could be in violation of Section 5 of the Federal Trade Commission (FTC) Act and, potentially, the FTC's order against Facebook.”The Federal Trade Commission has previously undertaken investigations against many firms that have engaged in unfair or deceptive trade practices.The Electronic Privacy Information Center (EPIC) (link is external) is a public interest research center in Washington, DC. EPIC was established in 1994 to focus public attention on emerging privacy and civil liberties issues and to protect privacy, freedom of expression, and democratic values in the information age. EPIC maintains one of the most popular privacy web sites in the world - epic.org (link is external) - and pursues a wide range of program activities including policy research, public education, litigation, publications, and advocacy. The Center for Digital Democracy (CDD) is recognized as one of the leading consumer protection and privacy organizations in the United States. Since its founding in 2001 (and prior to that through its predecessor organization, the Center for Media Education), CDD has been at the forefront of research, public education, and advocacy protecting consumers in the digital age.REFERENCESEPIC/CDD, In the Matter of WhatsApp: Complaint, Request for Investigation, Injunction, and Other Relief (Aug. 29, 2016),https://epic.org/privacy/ftc/whatsapp/EPIC-CDD-FTC-WhatsApp-Complaint-20... (link is external)FTC, “Enforcing Privacy Promises” (2016),https://www.ftc.gov/news-events/media-resources/protecting-consumer-priv... (link is external)FTC Press Release, “FTC Notifies Facebook, WhatsApp of Privacy Obligations in Light of Proposed Acquisition” (Apr. 10, 2014),https://www.ftc.gov/news-events/press-releases/2014/04/ftc-notifies-face... (link is external)FTC Letter to FB and WhatsApp, "Letter From Jessica L. Rich, Director of the Federal Trade Commission Bureau of Consumer Protection, to Erin Egan, Chief Privacy Officer, Facebook, and to Anne Hoge, General Counsel, WhatsApp Inc.” (Apr. 10, 2014),https://www.ftc.gov/news-events/press-releases/2014/04/ftc-notifies-face... (link is external)FTC, "Facebook Settles FTC Charges That It Deceived Consumers By Failing To Keep Privacy Promises” (2011),https://www.ftc.gov/news-events/press-releases/2011/11/facebook-settles-... (link is external)FTC Consent Order with FB (2011),https://www.ftc.gov/news-events/press-releases/2012/08/ftc-approves-fina... (link is external)EPIC, In re WhatsApp,https://epic.org/privacy/internet/ftc/whatsapp/ (link is external)EPIC, In re Facebook,https://epic.org/privacy/inrefacebook/ (link is external)###

Americans face growing new threats to their personal privacy as phone and cable Internet service providers (ISPs), along with leading Internet companies, expand their ability to capture details about what we do online in order to target us with data-driven personalized advertising. This report examines AT&T, Comcast, Cablevision, Charter, Cox, Verizon, Dish, Time Warner Cable, Viacom, Google, News Corp. (Fox), Turner Broadcasting (Time Warner), and Disney, focusing on some of their recent data- and video-related advertising practices. ISPs have formed partnerships with powerful data brokers (including Acxiom, Krux, and Oracle Marketing Cloud), gaining new insights into our online and offline behaviors. They are incorporating state-of-the-art “Big Data” practices, such as “programmatic advertising” that instantaneously buys and sells individual consumers—to financial marketers, fast-food companies, and health advertisers, for example—all without the consumer’s knowledge. In the process, ISPs have transformed TV and digital video into a vast new source of personal information, analyzing set-top box and streaming-video data for our viewing habits, and combining that information with sensitive online and offline data (including financial, health, racial, ethnic, and location) to compile detailed “digital dossiers” on millions of Americans. The ability of an ISP and others to identify and target us regardless of what digital device we use, moreover, has effectively erased any privacy safeguards we may have enjoyed in the past when we switched between devices. The report provides more evidence of the “digital data arms race” that is further eroding consumer privacy: AT&T, through its AdWorks division, has developed a “cross-screen system to match users’ mobile, online and television devices together based on identifiers and systems” that the company has “access to.” It operates a “consumer insights platform” that uses “Big-Data” techniques to advance AT&T’s targeted-marketing objectives. Comcast is using Rubicon’s Advertising Automation Cloud, “one of the largest cloud and Big Data computing systems in the world, [which] leverages over 50,000 algorithms and analyzes billions of data points in real time” to buy and sell individuals to marketers. Verizon, by acquiring mobile-marketing-data company Millennial Media, gained access to customer data gathered by more than 60,000 apps, including “location, social, interest, and contextual” information. Millennial has “developed more than 700 million active server-side unique user profiles, over 60 million of which link multiple mobile devices and PCs to a single specific user ... ,” with some 175 million monthly unique users in the “United States alone.” The Federal Communications Commission’s pending proceeding on privacy should examine all the ways that broadband networks operated by Internet service providers gather and use consumer information today. The review and policy proposals need to address the data-targeting relationships that ISPs have with leading digital marketing companies, including ad exchanges, data brokers, and advertisers. The FCC should enact privacy and consumer protection rules that provide individuals with rights over their data—including a set of Fair Information Practices that address the current data practices of ISPs. These companies should not be allowed to share data with affiliates or to use information for marketing their services without the informed, prior consent of the customer. Policies for privacy are essential as well for a competitive digital video market. Otherwise powerful ISPs and other gatekeepers will control the key way programming is financially supported and distributed. --- Full report attached.

Statement of Jeff Chester, CDD executive director: Regulators, including the DOJ and FCC, must prevent Verizon from taking anticompetitive and unfair advantage of its broadband ISP bird’s nest view of what their subscribers and consumers do—online and off. The proposed takeover of Yahoo’s core digital data advertising business, when combined with the capability to gather information from its wireless devices, broadband networks, and set-top boxes, gives it control over the key screens that Americans use today. Verizon has already supercharged its use of “Big Data” tactics to monitor their customers and online users, including through its recent shopping spree that includes AOL and Millennial Media (and also enables it to manage part of Microsoft Advertising’s consumer data targeting operations). Verizon’s ability to track a single person across their devices, when they are in a store, at home, work or school, and connect the digital dots to know whether they are now on their mobile phone or home watching TV, is a threat to the privacy of Americans. Regulators should closely scrutinize the Yahoo dea to prevent anticompetitive practices related to Verizon’s ability to leverage its mobile and geo-location consumer data. The FCC should also impose strict safeguards that prevent Verizon from combining Yahoo data with what it already knows about its customers and consumers. The FCC should also quickly enact its proposed consumer privacy rules for broadband ISPs. As broadband network monopolies such as Verizon merge online ad giants, new threats to consumer privacy emerge. That’s why action of FCC Chairman Wheeler’s privacy proposal is required. The Obama Administration and the FCC must ensure that deals like Verizon/Yahoo don’t further erode the little privacy Americans enjoy today when they use digital media. **** For background on Verizon’s use of data, see the section in our recent report: https://www.democraticmedia.org/article/big-data-watching-growing-digita... also, to see Verizon’s recent growing capabilities to use our geo-location and app data, note from Millennial Media 10 k 2015 (that company now owned by Verizon) My bold: Our robust data management platform, or DMP, allows us to access, analyze and utilize the large volumes of data we possess. This data includes location, social, interest, and contextual data, as well as the insights we derive from measuring campaign effectiveness—providing a unique, multidimensional profile of individual consumers. To date, we have developed more than 700 million active server‑side unique user profiles, over 60 million of which link multiple mobile devices and PCs to a single specific user on an anonymous basis. These user profiles, combined with third party data from our data partners, enable us to deliver more relevant, engaging and effective advertising to our advertising clients. Our data asset also allows us to measure the impact of mobile advertising on consumer engagement, intent and action. We have developed a suite of solutions which measures several different areas of mobile advertising impact. As of December 31, 2014, our platform reached more than 650 million monthly unique users worldwide, including over 175 million monthly unique users in the United States alone. Approximately 60,000 apps and mobile sites are enabled by their developers to receive ads delivered through our platform, and we can deliver ads on over 9,000 different mobile device types and models. While averaging more than three billion ad requests daily throughout 2014, in the last two months of 2014, our platform typically handled over nine billion ad requests daily, including requests received through our supply side tool, and requests received through third party platforms and processed by our programmatic buying tool.

Researchers of the University of Amsterdam’s Institute for Information Law (IViR) have published an independent study today commissioned by BEUC (link is external), EDRi (link is external), CDD and TACD (link is external). The study shows that the European Union (EU) does not sufficiently safeguard citizens' personal data and privacy rights in its trade agreements. Modern digital markets rely on the processing of personal data, but regulations on how to protect these differ widely from country to country. A new generation of trade agreements increasingly allows unrestricted data transfers, including personal data, between countries. This ground-breaking studysheds light on how trade agreements – for example, the future EU-US trade deal (TTIP) –treat personal data and privacy. By looking at both EU and international law, the researchers conclude that the EU should protect its citizens’ personal data, and prevent their privacy from being weakened in trade agreements. To do so, the EU must take action to safeguard its rules on data protection from legal challenge by its trade partners. “It’s unacceptable that the EU’s privacy and data protection rules could be challenged through trade policy. Trade deals should not undermine consumers’ fundamental rights and their very trust in the online economy. We’re pleased to see this study clearly echoing the European Parliament’s call to keep rules on privacy and data protection out of trade agreements,” Monique Goyens, Director General of The European Consumer Organisation (BEUC), commented. "The EU has the responsibility to safeguard people's rights to privacy and data protection in trade agreements. The European Union has done a great job at setting high standards for these fundamental rights. This study shows how to ensure these high standards can be maintained when trade agreements are negotiated", said Joe McNamee, Executive Director of European Digital Rights (EDRi). "The United States is aggressively pushing for a trade deal with the EU that would permit the unprecedented expansion of commercial data collection, threatening both consumers and citizens. America’s data giants want the TTIP to serve as a digital `Trojan Horse’ that effectively sidesteps the EU’s human-rights-based data protection safeguards. This new study is a wake-up call for policy makers and the public: any trade deal must first protect our privacy and ensure consumer protection," added Jeffrey Chester, Executive Director of Center for Digital Democracy (CDD). "The EU’s opaque and inconsistent system of granting third countries so-called ‘adequacy’ status for transferring personal data of its citizens makes it vulnerable to legal challenge by trade partners. This is an important finding of this study, and particularly relevant in the week when the EU-US much-criticised Privacy Shield, is likely to be approved. The EU must not make some partners more equal than others when deciding on the adequacy of their data protection laws", said Anna Fielder, Senior Policy Advisor of the Transatlantic Consumer Dialogue (TACD). Note to editors: BEUC, the European Consumer Organisation, acts as the umbrella group in Brussels for its 42 national member organisations. Its main task is to represent these members at the European level and defend the interests of all Europe’s consumers. BEUC has a special focus on five areas identified as priorities by its members: Financial Services, Food, Digital Rights, Consumer Rights & Enforcement and Sustainability. European Digital Rights (EDRi), is an umbrella organisation of 31 civil and human rights organisations from across Europe. Our mission is to promote, protect and uphold civil and human rights in the digital environment. The Center for Digital Democracy (CDD), a U.S.-based NGO, works to protect the privacy and welfare of the public in the “Big Data” digitally driven marketplace. By combining advocacy, industry research, coalition- building, and media outreach, CDD helps hold accountable some of the most powerful forces shaping the destiny of the world—especially those companies that dominant the global Internet landscape. The Transatlantic Consumer Dialogue (TACD), is a forum of over 70 EU and US consumer organisations established in 1998 with the goal of promoting the consumer interest in the US and EU policy making.