WhatsApp’s Dual Role Means More Data Collection & Growing Concerns

Since its last policy update in 2016, WhatsApp has grown from a messaging service to a payments platform as well.

The challengers of WhatsApp may say that the privacy judgment has recognised the need for data protection.

(Photo: iStock)

WhatsApp’s updated terms of use and privacy policy has triggered widespread concerns in India – its largest user base of 350 million – about the data sharing with Facebook.

A dive into the current policy and comparison with the 2016 version reveals a growing data collection practice as a result of WhatsApp’s dual role as a messaging platform and a payments platform.

“We process additional information about you, including payment account and transaction information,” the latest update states in its terms of service as a reflection of its expanding roles.

In addition, the emergence of over 15 million business accounts on WhatsApp in India has affected new data sharing practices with these accounts.

While the encrypted nature of personal chats with friends and family remains unchanged, it is the expansive metadata collection as a messaging, business interaction platform as well as a payments platform that has raised concerns.

However, the granular metadata collection and sharing with Facebook is not new.

WhatsApp head Will Cathart, however, has clarified that the update “does not change WhatsApp’s data-sharing practices with Facebook.” He is right. WhatsApp’s data sharing with Facebook has been on for years, since it last updated its privacy policy in 2016.

Announced on 5 January, WhatsApp has given its 2 billion users across the world time till 8 February to accept its updated policy.

Importantly, there is no option to opt out of having one’s data shared with business accounts and with Facebook and one must accept the terms to be able to continue using WhatsApp beyond the deadline.

WhatsApp’s Dual Role

WhatsApp’s role and identity has evolved since its last major privacy update in 2016 when it started facilitating data sharing with Facebook.

A messaging only platform is today also a payments platform like GPay or Rupay. Therefore, additional data collection about transactions on its platform, which weren’t a part of the 2016 version.

“If you use our payments services, or use our services meant for purchases or other financial transactions, we process additional information about you, including payment account and transaction information,” the latest version says.

This includes “information needed to complete the transaction” like information about our payment method, shipping details and transaction amount, according to the updated policy.

Rise of Business Accounts

WhatsApp has already been sharing an array of metadata with Facebook since 2016. So, what exactly has changed in the latest update?

The biggest change is the fact that Facebook may now have access to messages that users share with businesses on WhatsApp. WhatsApp’s blog on 12 January specifies that ‘messaging with businesses is different than messaging with your family or friends’.

According to WhatsApp, what this means is whether a user communicates with a business’ WhatsApp account ‘by phone, email, or WhatsApp, it can see what you’re saying and may use that information for its own marketing purposes, which may include advertising on Facebook’.

Chats Encrypted But What About Metadata?

Metadata refers to data that describes and gives information about other data and includes information like IP address, transaction data, which users one chats with, which groups a user is a member of.

While WhatsApp reiterated that its “policy update does not affect the privacy of your messages with friends or family in any way,” lawyers and activists point towards the expansive metadata collection that has grown as a result of its expanding roles.

“In many cases, metadata by itself can reveal very sensitive information about a person’s life. For instance, consider conversations with sexual and reproductive health services which now provide abortion related counselling via WhatsApp,” IFF states in its blog.

Mishi Choudhary, technology lawyer in New York and New Delhi and online civil rights activist, describes WhatsApp’s assurances about user privacy by pointing towards encrypted chats as a “deflection”.

“While it is important that end-to-end encryption stays and content of the messages is protected, any discussion about that is a deflection,” Choudhary said. “In the name of platform integration and interoperability, Facebook ensures that metadata is collected about all users whether they use its other services or not,” she added.

“WhatsApp is great for protecting the privacy of your message content. But it feels like the privacy of everything else you do is up for grabs,” Johns Hopkins University cryptographer Matthew Green told WIRED in the context of WhatsApp’s latest update.

Speaking with The Quint, Choudhury also points out, “An opt-out choice was provided in 2016 and was regularly mentioned up until the recent update which has disappeared and there is no way to know whether users who had opted out, their choice will be honoured or not.”