Groups urge FTC to Ensure Facebook Lives Up to WhatsApp Privacy Promise
Fourteen organizations urge FTC Chairwoman Ramirez to put a stop to WhatsApp’s plan to transfer user data to Facebook. This letter coincides with recent complaint filed, concerning the violation of commitments WhatsApp previously made to its subscribers.
—-
September 22, 2016
Dear Chairwoman Ramirez and FTC Commissioners: The undersigned consumer privacy organizations write in support of the complaint the Electronic Privacy Information Center (“EPIC”) and the Center for Digital Democracy (“CDD”) recently filed concerning WhatsApp’s plan to transfer user data to Facebook in violation of commitments the company previously made to subscribers. We are deeply concerned about the impact this proposed change in data practices will have on the privacy and security of WhatsApp users in the U.S. and across the world. We urge the FTC to investigate this matter and to fulfill its obligation to prevent WhatsApp and Facebook from engaging in unfair and deceptive trade practices.
WhatsApp has over one billion users worldwide, and its popularity has been due in large part to its strong public commitment to privacy. The company has long made its pro-privacy commitment a key part of its brand, underscored by numerous public statements and official blog posts on the importance of confidential communications.
When Facebook acquired WhatsApp in 2014, both companies made numerous promises to the public and to the FTC that WhatsApp’s data privacy practices would not change. Consumer privacy organizations raised concerns about the acquisition, and the Commission responded with a clear warning that the companies must continue to honor their privacy promises to WhatsApp users or risk violating Section 5 of the FTC Act.
The Commission stated the companies must obtain “affirmative consent” from WhatsApp users before materially changing its practices for information it collected before the merger. The FTC stated at the time that “WhatsApp must continue to honor these promises to consumers. Further, if the acquisition is completed and WhatsApp fails to honor these promises, both companies could be in violation of Section 5 of the Federal Trade Commission (FTC) Act and, potentially, the FTC’s order against Facebook.” The FTC has previously interpreted affirmative consent to require opt-in consent, particularly in the context of material retroactive changes to privacy promises.
On August 25, 2016, WhatsApp announced plans to use and transfer customer data, including users’ verified telephone numbers, to Facebook for user profiling and targeted advertising. WhatsApp previously collected phone numbers and other personal information from over one billion users with the promise that this information would not be used or disclosed for marketing purposes. WhatsApp’s reversal on this promise is a material, retroactive change that will apply to previously collected data. Contrary to FTC policy, WhatsApp does not intend to provide clear notice or obtain customers’ affirmative express consent – i.e., opt-in consent – before implementing these changes for previously collected information. Rather, these material, retroactive changes are buried in WhatsApp’s lengthy revised privacy policy and consumers have 30 days to opt-out.
European authorities have already begun investigating WhatsApp’s reversal on the privacy promises it made when seeking regulatory approval of Facebook’s acquisition of the messaging service. European Union Competition Commissioner Margrethe Vestager has indicated the EU is reconsidering its approval of WhatsApp’s 2014 merger with Facebook. Vestager stated that the companies’ promises not to merge user data was “a part of the decision [to approve the merger] so therefore we’re asking some follow-ups to find out what’s going on.”
WhatsApp plans to make material, retroactive changes to its numerous privacy promises regarding the use and disclosure of user data without first obtaining users’ affirmative express consent. This is exactly what the FTC said WhatsApp and Facebook cannot do. It is a clear violation of the prohibition on unfair and deceptive trade practices the FTC is obligated to enforce under Section 5 of the FTC Act.
We urge the Commission to fulfill its duty to protect consumer privacy, and to investigate and enjoin WhatsApp and Facebook’s proposed change in business practices.
We appreciate your attention to this important matter.
Sincerely,
Bill of Rights Defense Committee & Defending Dissent Foundation
Center for Digital Democracy Center for Financial Privacy and Human Rights Common Sense Kids Action
Constitutional Alliance Consumer Action
Consumer Federation of America Consumer Watchdog
Cyber Privacy Project Demand Progress Electronic Privacy Information Center
The FoolProof Foundation
Patient Privacy Rights Privacy Rights Clearinghouse Privacy Rights Now Coalition Privacy Times U.S. PIRG
—-
