WhatsApp told users last week that there was no need for alarm regarding an upcoming privacy policy deadline, as users who refuse to accept the privacy policy will not have their accounts deleted—they will just have their apps rendered useless, eventually incapable of receiving calls and messages.
The planned removal of core features represents a stunning reversal for a company that long ago prioritized data privacy, transforming WhatsApp’s offering into an unworkable contradiction: Private messaging only for those who surrender a separate piece of their privacy.
At issue is WhatsApp’s 2021 privacy policy, which users first learned about in January. According to notifications sent at that time, WhatsApp began asking users to agree to share some of their data with WhatsApp’s parent company—Facebook—by a February 8 deadline.
That data does not include the content of any WhatsApp user’s messages or calls, as the company’s end-to-end encryption remains intact, and WhatsApp has repeatedly promised that its message security will not be compromised. However, the data does include interactions that users have with certain businesses over WhatsApp. And, per the new privacy policy, the entities at Facebook that will have access to that data include Facebook itself, Facebook Payments, Facebook Technologies, Onavo, and CrowdTangle.
The January notifications released a user avalanche, with many people ditching the service to install a separate, private messaging app called Signal. According to a report from TechCrunch, in just five days in January, the rival private messenger was downloaded more than 7.5 million times—growing its overall userbase at the end of 2020 by more than one third. Similar, meteoric growth was enjoyed by another private messaging app, Telegram.
But to hear WhatsApp tell the story, users got the wrong impression about the 2021 privacy policy update. The company tried to explain to some news outlets that the changes were not as dramatic as many had interpreted because the changes were not even new.
They had been in place since 2016.
According to reporting from Wired, in August of 2016, WhatsApp quietly updated its data sharing practices with Facebook:
“Under the new user agreement, WhatsApp will share the phone numbers of people using the service with Facebook, along with analytics such as what devices and operating systems are being used,” Wired wrote at the time. “Previously, no information passed between the two, a stance more in line with WhatsApp’s original sales pitch as a privacy oasis.”
Those changes came with an opportunity for then-existing WhatsApp users to opt out of the impact of that data sharing, but every new WhatsApp user who installed the app after those 2016 changes received no such option. Some of their data, according to Wired, was automatically sent to Facebook per WhatsApp’s new rules.
Technically, then, WhatsApp was right: Users misunderstood the January 2021 privacy policy notifications. There were no dramatic shifts to how WhatsApp would share data with Facebook, just minor changes to how WhatsApp will handle and share businesses-related interactions.
But those explanations did not sit right with users, security researchers, or digital rights activists.
As Matthew Green, cryptographer and professor at Johns Hopkins University, told Wired:
“WhatsApp is great for protecting the privacy of your message content. But it feels like the privacy of everything else you do is up for grabs.”
Gennie Gebhart, the acting director of activism at Electronic Frontier Foundation, also criticized WhatsApp’s unclear messaging in January.
“WhatsApp’s obfuscation and misdirection around what its various policies allow has put its users in a losing battle to understand what, exactly, is happening to their data,” Gebhart wrote.
The public blowback caused WhatsApp to postpone its initial February 8 deadline to May 15, and in the weeks in between, many users feared that the company would simply delete their accounts if they refused to accept the updated privacy policy.
But last week, WhatsApp clarified that “no one will have their accounts deleted or lose functionality of WhatsApp” on May 15 because of their choices to refuse to accept the new privacy policy.
Unfortunately, the alternative is nearly as harsh.
For WhatsApp users who decline to have their data shared with Facebook, WhatsApp will steadily remove core features, beginning with the option to view chat lists, and ending with the inability to even receive calls or messages on WhatsApp.
(As a brief, international aside, these enforcement actions are questionable under the EU’s General Data Protection Regulation, and on May 11, Germany issued a “ban” affecting WhatsApp’s new privacy policy, explaining that, in the new privacy policy, “consent is not freely given, since WhatsApp demands acceptance of the new provisions as a condition for the continued use of the service’s functionalities.” WhatsApp already pushed back, arguing that the conclusions reached in Germany were “wrong.”)
WhatsApp said that it has warned users about its new data policy agreement for weeks now. For users who do not agree to the privacy policy changes by May 15, WhatsApp said that “after a period of several weeks” the notification they’ve received will become persistent. At that point, WhatsApp said it will dole out consequences.
“At that time, you’ll encounter limited functionality on WhatsApp until you accept the updates. This will not happen to all users at the same time.
You won’t be able to access your chat list, but you can still answer incoming phone and video calls. If you have notifications enabled, you can tap on them to read or respond to a message or call back a missed phone or video call.
After a few weeks of limited functionality, you won’t be able to receive incoming calls or notifications and WhatsApp will stop sending messages and calls to your phone.”
What message are users supposed to take from these limitations other than the fact that WhatsApp simply does not want users who refuse to share their data with Facebook? A private messaging app that cannot receive messages is useless, and it is ludicrous that the reason it is useless is because the company has chosen to make it that way.
This is an anti-privacy choice. It is also an anti-user choice, as users are being punished for their refusal to share data. And, finally, it is a sad but expected turn for WhatsApp, a former privacy darling launched by two co-founders—Jan Koum and Brian Acton—who both seemingly regret selling their company to Facebook for billions of dollars.
That sale in 2014 startled many users, as the two companies—one, a steadily-growing advertising giant, the other led by a man whose motto was reportedly “no ads, no games, no gimmicks”—were diametrically opposed. At the time, Koum tried to calm those fears, saying that “if partnering with Facebook meant that we had to change our values, we wouldn’t have done it.”
Four years later, Koum left. His co-founder, Acton, had left the year prior.
In an exclusive interview with Forbes, Acton explained his departure. Much of it was due to conflicting ideas on privacy.
“At the end of the day, I sold my company. I sold my users’ privacy to a larger benefit. I made a choice and a compromise,” Acton said. “And I live with that every day.”
In 2018, Acton donated $50 million to a familiar cause with a different name: the development of Signal.
