Forgive Me Not: Privacy Advocates Challenge Facebook’s WhatsApp Deal

In their latest effort to curb potential consumer privacy abuses, the Electronic Privacy Information Center and the Center for Digital Democracy are challenging the potential misuse of data about WhatsApp users’ data as a result of WhatsApp’s acquisition by Facebook for $16 billion. WhatsApp is a popular App that allows users to send messages without the regular cost associated with SMS text messaging. According to the complaint, the company “processes over 10 billion messages per day from approximately 450 million users.”

The advocates have filed a complaint with the Federal Trade Commission over the potential Facebook acquisition. The crux of the action, under 15 U.S.C. §§ 45(a) and (n), is that WhatsApp is engaging in deceptive and unfair practices by its inconsistent positions. WhatsApp has always represented that it will not collect or use personal information. However, after the acquisition by Facebook, the company would implicitly reverse this policy and permit access to WhatsApp’s phone numbers. It’s better to ask for “forgiveness than permission” is the essence of the argument against Facebook’s method of using a target company’s client’s personal data following an acquisition.

The advocates cite to express representations relied on by consumers contained in WhatsApp’s privacy policy and blog (including its founder) about not using mobile numbers (and other personal information) without the user’s consent, while pointing to alleged examples, generally, where Facebook accesses and utilizes such personal data following an acquisition (e.g., Instagram). The advocates also cite to alleged statements by users and “[i]ndustry experts” who are concerned that Facebook will have access to telephone numbers and other data. Other countries have begun investigating the potential privacy issues raised by the acquisition.

In sum, the essence of the advocates’ challenge is that WhatsApp’s “failure to disclose that this commitment to privacy was subject to reversal constitutes a deceptive act” and “fail[ure] to make special provisions to protect user data in the event of an acquisition . . . unreasonably creates . . . an obstacle to the free exercise of consumer decision-making [and thus, constitute unfair acts].” As remedies, they seek to halt the acquisition and open an investigation into the matter. And if the acquisition proceeds, the privacy advocates request an order insulating “WhatsApp user’s information from access by Facebook’s data collection practices.”

As data breach and privacy concerns increase exponentially along with the proliferation of Apps across all industries, the risk of data misuse by commercial concerns like Facebook will continue to increase. Gibbons will continue to track the status of this matter, and will report any further developments as they arise.