Facebook Slapped With FTC Complaint Over WhatsApp Data Grab

Consumer groups urge the feds to crack down on Facebook’s latest privacy breach.

|
Aug 29 2016, 7:46pm

WhatsApp for iPhone pictured next to Messenger, Facebook's other messaging app. Image: Microsiervos/Flickr

Consumer privacy watchdogs filed a federal complaint Monday against Facebook over the tech titan's decision to begin harvesting phone numbers from its popular WhatsApp messaging service.

The complaint, which was expected, was filed with the Federal Trade Commission, and accuses Facebook of violating Section 5 of the Federal Trade Commission Act, which prohibits "unfair or deceptive acts or practices."

"When Facebook acquired WhatsApp, WhatsApp made a commitment to its users, to the Federal Trade Commission, and to privacy authorities around the world not to disclose user data to Facebook," Marc Rotenberg, President of the Electronic Privacy Information Center, said in a statement. "Now they have broken that commitment."

Indeed, when Facebook acquired WhatsApp in 2014 for a whopping $19 billion, the two companies insisted that the social networking giant would keep the messaging service at arms-length. At the time, WhatsApp founder Jan Koum assured users that "privacy is coded into our DNA."

But last Thursday, WhatsApp announced that it would begin sharing user phone numbers with its parent company Facebook in an effort to improve "ads and products experiences."

Read more: How to prevent WhatsApp from giving Facebook your phone number for improved "ads and products experiences."

To many WhatsApp users, not to mention consumer privacy advocates, the move amounted to a brazen betrayal of users who had been assured by the two companies that "nothing would change" about the messaging service's privacy practices.

In a statement, Claire Gartland, Consumer Protection Counsel at EPIC, said that user phone numbers "may also be the single most valuable piece of personal data obtained by WhatsApp. WhatsApp users are required to provide a verified phone number to use the service. And the phone number provides a link to a vast amount of personal information."

In an interview last week, Jeff Chester, Executive Director of the DC-based Center for Digital Democracy, which joined EPIC in filing Monday's complaint, blasted Facebook's reversal as a "bait-and-switch" routine designed to lure millions of people to use the service under false pretenses.

"The FTC has an obligation to protect WhatsApp users," Katharina Kopp, director of policy at CDD, said in a statement. "Data that was collected under clear rules should not be used in violation of the privacy promises that WhatsApp made."

"If WhatsApp wants to transfer user data to Facebook, it has to obtain the user's affirmative consent," Kopp added. "It's not complicated."

In 2011, EPIC led a coalition of consumer privacy groups that secured a 20-year consent order against Facebook, after the tech titan made user data, including "Friend lists" and application data, more widely available to the public and to Facebook's advertising partners.

That incident wasn't the first time that Facebook had pushed the limits of consumer privacy. Now, after Facebook's latest affront to user privacy, it's time for the feds to step in and drop the boom on the company, according to privacy advocates.

"Clearly, the Federal Trade Commission must act," Rotenberg said. "The edifice of internet privacy is built on the FTC's authority to go after companies that break their privacy promises."

In its complaint, EPIC urged the FTC to investigate Facebook's "proposed plan to transfer WhatsApp user data to Facebook and to use WhatsApp user data for marketing purposes, and to enjoin its unfair and deceptive data practices."

A FTC spokesperson confirmed that the agency had received EPIC's complaint, but said that "since FTC investigations are non public, we can't confirm or deny the existence of any particular investigation, so we can't comment further."

In its updated terms-of-service agreement, WhatsApp informed its users that they have 30 days to opt-out of sharing their data with Facebook. My colleague Nicholas Deleon described precisely how users can do just that.

Reached by Motherboard on Monday, Facebook spokesperson Matt Steinfeld reiterated the company's previous statement: "We're obtaining consent from our users. People are required to agree to the new terms and privacy policy. WhatsApp complies with applicable laws. As always, we consider our obligations when designing updates like this."