WhatsApp's new privacy policy is unfair, but legal

By Asheeta RegidiWhatsApp has always made huge promises of safeguarding privacy, whether through the introduction of end-to-end encryption or through its promise of no compromise with privacy following its acquisition by Facebook. The sweeping changes to its privacy policy announced yesterday naturally came as a huge shock to its users. The chief changes being made are that WhatsApp will now share customer information with Facebook, in order to provide targeted ads and better friend suggestions, and with other third parties to allow businesses to communicate with users. WhatsApp has given its users a time limit of 30 days to opt-out of the new privacy policy. While the sudden announcement seems like a U-turn on every promise ever made by WhatsApp, the change is unfortunately legal.WhatsApp can now share all information collected with anyoneTwo years ago when WhatsApp was acquired by Facebook, WhatsApp put up a blogpost which assured its users that the acquisition will leave its privacy practices unchanged. WhatsApp’s previous privacy practices were extremely user friendly. Basically the only information that WhatsApp collected was its customers’ contact number, their device information, and the contact numbers on their friends list. The old Privacy Policy made express promises that no information would be shared with anyone else, there would be no third-party ads, and no information shared for commercial or marketing purposes. WhatsApp’s new Privacy Policy now gives a vast list of information which it collects:

• Your phone number, profile name and photo, online status and status message, last seen status.
• Your e-mail when you communicate with them for customer service, with no promise that this e-mail address will not be used for any purpose other than for customer service communication.
• Device data, such as hardware model, operating system information, browser information, IP address, mobile network information including phone number, and device identifiers. 
• Location data.
• Information on your online status such as when you were last seen online, when you updated your status message, etc.
• Information from third party services that are integrated with WhatsApp, for example, if you share any article from the web using WhatsApp.
• Information on who is messaging you, calling you or which groups you belong to.

Under the new Privacy Policy, there is no restriction being placed on what type of information is shared with whom. For example, it is not specified that only contact numbers will be shared with Facebook for the purpose of targeted ads. Any or all the information listed above can be shared not only with Facebook, but also with any other third party.Yet another change is while the new Privacy Policy keeps the promise of no third party banner ads, it now says that in future if WhatsApp changes its mind, it can have these ads through a change in the privacy policy.WhatsApp’s changes to privacy maybe unfair, but is legalWhile the sweeping changes made to WhatsApp’s privacy policy makes it appear that WhatsApp is deceiving its users, unfortunately, legally, WhatsApp can do this. All it needs to do is inform its customers of the change, and obtain their consent for the same. Had the changes been made without informing the customers or without offering an opt-out mechanism, then WhatsApp would have fallen afoul of privacy legislations. In fact, following Facebook’s acquisition of WhatsApp in 2014, the US Federal Trade Commission sent a letter to Facebook warning Facebook against making changes to its privacy practices without informing its customers.Is asking customers to opt-out adequate as consent to the changes?Obtaining adequate and legal consent of the customers is a very important part of a valid change to privacy practices. All online terms and conditions, as also WhatsApp’s old Privacy Policy, state that changes will be made from time to time to the terms, and your continued use of the app will amount to consent. Usually, users need not even be informed of the changes made. In the case of changes to privacy practices, particularly when your personal information is being transferred to third parties, like WhatsApp is here, the case is different. In such a case, the customer needs to be informed of the change, and must specifically consent to that change.Opt-out mechanisms, like the kind being offered by WhatsApp now, are highly criticised by privacy advocates as a sufficient form of consent. Most users will not take the trouble to read the terms and conditions or understand that unchecking that box can get them better privacy. But sadly, while the opt-out mechanism is only criticised, it is a perfectly legal and valid form of consent. That means that if you do not opt-out on time, you cannot later say that WhatsApp did not inform you adequately or that you did not know you had to opt-out of it.Why didn’t WhatsApp adequately inform users of the change?The only questionable part of WhatsApp’s changes is whether it adequately informed its customers about the changes. When WhatsApp introduced end-to-end encryption, every user was informed of this change on their chat screens. Surprisingly, now when a change of this scale has been made to its privacy practices, there is no similar notice on the chat screens. The only source of information is the blogpost, and it is questionable how many WhatsApp users actually take the trouble to check WhatsAp's blogs. The blogpost itself outlines only some of the changes being made.  It doesn’t inform customers of the extent of the changes being made. The new Privacy Policy, which WhatsApp claims has been written to make it easier for the people to understand, is actually even more confusing to understand, and leaves vast scope for misinterpretation and misuse.Resolving this flaw in WhatsApp’s approach, however, may not end the problem for customers. Legally, there is no set standard on when customers are considered to have been informed adequately. If legal bodies like the FTC find fault with this, it can easily be remedied by adequate notices, say on every customer’s chat screens, and a better drafted Privacy Policy. But apart from that, there is nothing much to stop WhatsApp from making these changes. The only thing that can actually stop WhatsApp and Facebook from doing this is a massive public protest. So if you don’t agree with the changes to WhatsApp, speak out against it. Public pressure had successfully forced Facebook to adopt better privacy practices in the past, and has the power to do so again.The author is a lawyer with a specialisation in cyber laws and has co-authored books on the subject.