By: Yasmin Hayre
On January 15, 2021, WhatsApp alerted users via a pop-up notification that they would have to accept new terms by February 8 or risk losing access to their accounts. Under the new terms and conditions, WhatsApp would share large amounts of intel with Facebook, including user’s “account information like your phone number, logs of how long and how often you use WhatsApp, information about how you interact with other users, device identifiers, and other device details like IP address, operating system, browser details, battery health information, app version, mobile network, language and time zone, transaction and payment data, cookies, and location information.”
The notification, however, was incredibly confusing to users, as it appeared to be a mandatory update that required them to agree to the terms and share their data, or, the only alternative, lose their account. WhatsApp’s lack of transparency in communicating what the new terms actually entailed resulted in “unwelcome attention and concern over the privacy implications”, which contributed to millions of users migrating to alternative chat platforms, and WhatsApp’s competitors, Signal and Telegram.
WhatsApp Messenger, commonly known as WhatsApp, is a mobile application owned by Facebook that was one of the first apps to provide free, internet-based messaging. “Instead of sending texts using cellular-data networks, where fees may apply, WhatsApp primarily relies on a Wi-Fi connection to send and receive messages and calls for free.” Used by over two billion people, WhatsApp has steadily gained popularity since it was released in 2009. Their latest privacy policy, however, has resulted in user backlash and WhatsApp is facing its first legal challenge in India, its biggest market with roughly four hundred fifty million users.
The petition argues that “WhatsApp mocks our basic privacy rights” by violating user’s fundamental rights stipulated in the Indian Constitution, and the new changes “endanger national security by sharing, transmitting and storing user data and information subject to foreign laws in another country.” The backlash in India has trickled into the United States, and what was intended to be a small change has triggered a large outrage, as discussions are now rampant among users concerning online privacy, digital safety, and users’ fundamental rights to privacy.
The misinformation and consequent backlash against the scale of its data collection led WhatsApp to announce that it was delaying enforcement of the new terms by three months. The backlash also prompted the head of WhatsApp, Will Cathcart, to set the record straight – WhatsApp has shared data with Facebook since 2016. User’s assumptions that the messaging app will now force those using it to hand over their personal data to Facebook, or that the company can now read conversations and other personal data are not exactly correct. “The confusion was the result of Facebook’s bungled communications, mistrust of the company, and America’s broken data-protection laws.” “Much of the public doesn’t understand how their data is being handled.
They hear those key things — data sharing, Facebook, privacy, and that’s enough for them to say, I got to get off this.” Consequently, the debate over encryption, “which helps protect the privacy of people’s digital communications but can stymie the authorities in criminal investigations because conversations are hidden”, has heightened. WhatsApp’s encryption prevents cyber-criminals, hackers, and governments from accessing the messages, but many misinterpreted the new terms and conditions assuming this feature would be lost. On one side, privacy advocates and human rights activists believe that people should be able to have online communications that are free of any snooping from law enforcement or the government. On the other side, lawmakers and law enforcement believe that tough encryption makes it impossible to track criminals, and furthermore, can pose a national security risk.
WhatsApp has numerous redeeming qualities; it is easy to use, communications in the app are secure, and it brings end-to-end encryption to people across the world. While there was no meaningful change to how WhatsApp handles users’ data, peoples’ concerns over Facebook’s data collection are fair, as many have acknowledged that Facebook’s “business model is surveillance.” The reality is, however, that Facebook already knew how often the messaging app was opened, users’ locations, the phone numbers being used, and much more. WhatsApp’s privacy policy changes only “reflect the possibility of commercial transactions involving the mingling of activity among Facebook apps — a handbag you browse in WhatsApp could pop up later in your Instagram app, for example.”
Regardless, what has not changed is that WhatsApp is Facebook, a company many don’t trust. Because of the distrust, WhatsApp’s users are siding with and listening to privacy experts and cybersecurity advocates, who are warning against data pooling and emphasizing that WhatsApp’s controversial privacy policy update is “monetiz[ing] the private data of users without giving them a choice.” Ultimately, users feel that their fundamental right to privacy is being violated, and if anything has been made evident from this ruckus, it is that this is a “wakeup call for the government to come up with a framework to regulate intermediaries and have a dedicated data privacy law.”
What WhatsApp really needs to decide is whether its priority is commercializing or securing its user base. It remains the “largest end-to-end encrypted platform available” and is “materially better” than any alternative. Nonetheless, users understandably want their data to be protected, and therefore are considering and joining alternative applications as the new privacy updates made their data “fair game.” WhatsApp may be free, but the price to pay for the free service has become clear.
Greater attention needs to be given to the constitutional protections of fundamental rights relating to privacy, and that right to privacy must be balanced against both law enforcement’s and the state’s compelling interests, including encryption of data, which has polarized security advocates and lawmakers. Consumers ultimately have the right to determine what sort of information about them is collected and how that information is used, and when the privacy of everything that you do besides the content of your messages seems up for grabs, WhatsApp is debatably “endangering the privacy and security of all their users . . .potentially facing liability in a wave of lawsuits.”
Student Bio: Yasmin Hayre is currently a second-year law student at Suffolk University Law School and a Staff Member on the Journal of High Technology Law. Prior to law school, Yasmin received a Bachelor of Arts Degree in Biology and Education from Bowdoin College.
Disclaimer: The views expressed in this blog are the views of the author alone and do not represent the views of JHTL or Suffolk University Law School.
