8/3/2023

Privacy on WhatsApp? Only If You Live in Europe

On Monday (6), Meta reached an agreement with the European Union (EU) about WhatsApp’s privacy policy.

The mess began in January 2021, when WhatsApp updated its privacy policy to open a loophole on its end-to-end encryption in conversations between individual and business users.

In Europe, Meta pledged to allow WhatsApp users to decline the new policy (and future updates) without being harassed “ad infinitum” by popups. (To this day, more than two years later, I have to dismiss the popup asking me to accept that privacy policy. Every. Single. Day.)

Meta has also assured the EU that it does not share personal data of European citizens who use WhatsApp with outside companies nor with its own (Facebook and Instagram) for advertising purposes.

All very nice, albeit overdue, but what about the rest of the world?

I sent two questions to WhatsApp in Brazil:

1. Will the terms of the agreement [with the EU], such as requiring WhatsApp after changing their privacy policy to show a “no” button to the user and stop showing the popup asking for acceptance, apply to other regions of the world, specifically Brazil?
2. Is the statement that “personal data [from WhatsApp] is not shared with third parties or other Meta companies, including Facebook, for advertising purposes” valid for Brazil?

To the first, WhatsApp’s spokesperson responded that they will not comment.

To the second, a binary question, the kind you answer with “yes” or “no”, they sent a link to the WhatsApp documentation. When I insisted for a direct answer, I got back two more links.

I have read the documentation contained in all three links — which together add up to ~5,800 words, which took half an hour to read — and based on them I can conclude that outside Europe Meta uses WhatsApp user data for Facebook advertising purposes, with one subtle exception.

In the longest link, an endless table that explains the different ways WhatsApp handles user data, the last line details the sharing of information “with the Meta Companies to operate, provide, improve, understand, customize, support, develop and market the Meta Companies products, features and services,” including:

Improving Meta Companies services and your experiences using them, such as personalizing features and content, helping you complete purchases and transactions, and showing relevant offers and ads across the Meta Company Products in accordance with their own specific terms and privacy policies (for example, for integrations like WhatsApp Shops), remembering that users have to opt-in to chat with businesses.

In the next column, WhatsApp explains what data is shared. Among them, “your account information”. This same item provides an exception: users who already had a WhatsApp account in 2016 and opted-out of sharing app data with Facebook and other Meta companies. This “opportunity” was given after another privacy policy update back then.

At the time, Meta (then called Facebook) broke a promise made at the time of WhatsApp purchase, that it would not cross data from the app with Facebook’s. The statement for the acceptance of the then new terms and privacy policy explicitly stated the intent of the change, as the image above shows. I only have it in Portuguese; the text next to the acceptance toggle reads:

Share my WhatsApp account data with Facebook to improve my experiences with ads and products on Facebook. Your conversations and phone number will not be shared with Facebook, regardless of this setting.

It follows, therefore, that Meta treats its users unequally, depending on where they live. In Europe, WhatsApp data is not used for advertising purposes by Facebook and Instagram. In the rest of the world, yes — unless you signaled otherwise in a narrow 30-day window in 2016.