U.S. FTC notifies Facebook/WhatsApp of privacy obligations in light of acquisition of WhatsApp

By Gabriele Accardo

On 10 April 2014 the Federal Trade Commission’s (“FTC”) Bureau of Consumer Protection sent a letter to Facebook and WhatsApp to warn them about their obligations to protect the privacy of their users in light of Facebook’s acquisition of WhatsApp.

In fact, following Facebook’s announced intent to acquire WhatsApp, both companies made public statements indicating that the promises in WhatsApp privacy policies would be honored.

Nonetheless, while the transaction has been approved by the FTC’s Bureau of Competition without raising any major competition concerns, the FTC’s Bureau of Consumer Protection was concerned that, after the merger, WhatsApp would continue its current privacy practices. In fact, in 2011, Facebook settled FTC charges that it deceived consumers by failing to keep its privacy promises. Under the terms of the FTC’s order against the company, Facebook must get consumers’ affirmative consent before making changes that override their privacy settings, among other requirements.

In the circumstances, the Bureau of Consumer Protection Director noted that while both Facebook and WhatsApp collect data from consumers, they make different promises and statements with respect to their consumers’ privacy. WhatsApp’s privacy policy clearly states, among other things, that users’ information will not be used for advertising purposes or sold to a third party for commercial or marketing use without the users’ consent, and such promises exceed the protections currently offered to Facebook users.

According to the Bureau of Consumer Protection, the statements in WhatsApp’s privacy policy, combined with the recent public statements by both Facebook and WhatsApp, constitute clear promises to consumers about the collection and use of their data by WhatsApp and, following WhatsApp’s purchase, by Facebook.

In particular, before changing WhatsApp’s privacy practices, Facebook must:

  • obtain consumers’ affirmative consent before using data collected by WhatsApp in a manner that is materially inconsistent with the promises WhatsApp made at the time of collection;
  • not misrepresent in any manner the extent to which Facebook maintains, or plans to maintain, the privacy or security of WhatsApp user data;
  • offer consumers an opportunity to opt out, if Facebook chooses to change the way it collects, uses, and shares newly-collected WhatsApp data, or, at least, make clear to consumers that they have an opportunity to stop using the WhatsApp service.

On those grounds, the Bureau of Consumer Protection Director concluded that “…regardless of the acquisition, WhatsApp must continue to honor these promises to consumers. Further, if the acquisition is completed and WhatsApp fails to honor these promises, both companies could be in violation of Section 5 of the Federal Trade Commission Act [against deceptive practices] and, potentially, the FTC’s order against Facebook”.