U.S. FTC notifies Facebook/WhatsApp of privacy obligations in light of acquisition of WhatsApp
By Gabriele Accardo
On 10 April 2014 the Federal Trade Commission’s (“FTC”) Bureau of Consumer Protection sent a letter to Facebook and WhatsApp to warn them about their obligations to protect the privacy of their users in light of Facebook’s acquisition of WhatsApp.
In fact, following Facebook’s announced intent to acquire WhatsApp, both companies made public statements indicating that the promises in WhatsApp privacy policies would be honored.
Nonetheless, while the transaction has been approved by the FTC’s Bureau of Competition without raising any major competition concerns, the FTC’s Bureau of Consumer Protection was concerned that, after the merger, WhatsApp would continue its current privacy practices. In fact, in 2011, Facebook settled FTC charges that it deceived consumers by failing to keep its privacy promises. Under the terms of the FTC’s order against the company, Facebook must get consumers’ affirmative consent before making changes that override their privacy settings, among other requirements.
In particular, before changing WhatsApp’s privacy practices, Facebook must:
- obtain consumers’ affirmative consent before using data collected by WhatsApp in a manner that is materially inconsistent with the promises WhatsApp made at the time of collection;
- not misrepresent in any manner the extent to which Facebook maintains, or plans to maintain, the privacy or security of WhatsApp user data;
- offer consumers an opportunity to opt out, if Facebook chooses to change the way it collects, uses, and shares newly-collected WhatsApp data, or, at least, make clear to consumers that they have an opportunity to stop using the WhatsApp service.
On those grounds, the Bureau of Consumer Protection Director concluded that “…regardless of the acquisition, WhatsApp must continue to honor these promises to consumers. Further, if the acquisition is completed and WhatsApp fails to honor these promises, both companies could be in violation of Section 5 of the Federal Trade Commission Act [against deceptive practices] and, potentially, the FTC’s order against Facebook”.