Users of instant messaging service WhatsApp will see their account information – including their phone numbers – shared with Facebook and used for ad targeting, unless they take action to opt out of the new information sharing standards included in its new terms of service, the company announced on Thursday.
Acquired by Facebook in 2014 for $21.8 billion, WhatsApp has promised its user base that their privacy would be respected as its organization was more integrated into the social networking giant. But as Facebook explores ways to monetize the 1 billion plus users on WhatsApp – a service that’s promised not to run third-party ads – it looks like using that information to better target its own ads will be at least one method it resorts to.
“While WhatsApp will continue to operate as a separate service from Facebook, we plan to share some information with Facebook… that will allow us to coordinate more and improve experience across our services and those of Facebook,” the company writes in an FAQ post. “If you are a Facebook user, you might see better friend suggestions and more relevant ads on Facebook.”
WhatsApp also lists accurately counting unique users, fighting spam, and preventing abuse as reasons for sharing the information. It makes it clear that while the information will be shared with Facebook, it won’t be visible to users of Facebook at all. This is the first update to WhatsApp’s policy since 2012.
WhatsApp users must provide a phone number in order to use the messaging service, but Facebook doesn’t require that information and as a result many users choose to leave it blank. In addition to sharing of phone numbers, WhatsApp will share user device information with Facebook, such as phone make and model, and the OS used. This is the first update to WhatsApp’s policy since 2012.
“If you are an existing user, you can choose not to have your WhatsApp account information shared with Facebook ads and products experiences. Existing users who accept our updated Terms and Privacy Policy will have an additional 30 days to make this choice,” the new privacy policy says.
In Canada, Facebook has previously been in hot water with the federal Privacy Commissioner’s office for requiring its users to opt out, rather than opt in, to a new terms of service update. But that doesn’t mean that this particular update would also be outside the bounds of compliance with privacy law for the private sector, the Personal Information Protection and Electronic Documents Act (PIPEDA). While the law in general requires an individual’s knowledge and consent for the collection, use, or disclosure of personal data, whether that requires express or implied consent is a bit more hazy – it depends on the type of the information being collected and what use it will serve.
In the first quarter of 2015, for example, the commissioner asked Bell to cease its relevant advertising program after receiving 170 complaints under PIPEDA. Bell had argued it could collect information about how its customers used its services and use it to sell targeted advertisements from third parties. In a June 2015 study of online advertising, the commissioner’s office found that more than one in 10 online ads that should ask for opt-in consent didn’t do so.
WhatsApp has also been the subject of an investigation by Canada’s Privacy Commissioner, a 2013 collaboration between the office and its Dutch counterpart. Key issues included the way WhatsApp stored phone numbers of non-users, unencrypted messages (at the time), and utilized an easily-exposed method for creating passwords.
ITBusiness.ca sought comment from the Privacy Commissioner of Canada’s office, which declined because it hasn’t examined the issue in detail or investigated the matter.