WhatsApp Privacy Policy update is not that big of a deal

There has been a large fuss on how the new WhatsApp Privacy Policy updates affect the users. Users have to accept the terms and service of this new policy by February 8, 2021, or delete their accounts - sounds rather drastic right? It really is not but the lack of proper explanation and the fact that nobody reads the policy updates ever has lead to lots of confusion.

This can especially be seen in the developer community, just take a look at the trending repositories, all related to alternative messaging apps like Signal.

For most of the world the changes are fairly simple - WhatsApp will share more of the available data with Facebook in order to improve the overall experience. This does not mean that your privacy will be affected. The messages, content, images are encrypted and WhatsApp can not share those even if they wanted to. Your calls and recording will not be shared. The data they are referring to is statistics, connection and approximate location information (not really used for tracking you individually). Basically everything that Facebook already knows about you - the idea here is just to sync the platforms in order to create a better product.

The unclear part here is how this affects the EU Region. The EU Region currently consists of EU countries, UK (until Brexit is really behind them), you can see the full list here.

Additionally there have been a few quotes going around from a tweet from a WhatsApp representative. The first:

“There are no changes to WhatsApp’s data sharing practices in the European region (including UK) arising from the updated Terms of Service and Privacy Policy,"

This fact is definitively false, the archive shows the policies had not been updated for a while (one links to April 2018, the other to 2016). This gives reason to doubt the legitimacy of the tweets. The Privacy Policy for WhatsApp Eurepean Region countries have definitively also been updated. You can see the versions here. Perhaps what was actually meant here is that the updates do not include the same Facebook sharing policies as for other regions. The second quote:

"For the avoidance of any doubt, it is still the case that WhatsApp does not share European region WhatsApp user data with Facebook for the purpose of Facebook using this data to improve its products or advertisements.”

The second quote does give a reassuring statement indicating that EU region users should not worry about this update. While this does give a bit of reassurance the quotes are not official and do not make us trust it.

There are multiple mentions of sharing data with Facebook companies. One of those can be found under Information You and We Share -> Third-Party Service Providers.

We work with third-party service providers and the Facebook Companies to help us operate, provide, improve, understand, customize, support, and market our Services. When we share information with third-party service providers and the Facebook Companies in this capacity, we require them to use your information on our behalf in accordance with our instructions and terms.

This does imply that some data is shared with other Facebook Companies. However we are reassured couple paragraphs later with the following.

Nothing you share on WhatsApp, including your messages, photos, and account information, will be shared onto Facebook or any of our other family of apps for others to see, and nothing you post on those apps will be shared on WhatsApp for others to see, unless you choose to do so.

Today, Facebook does not use your WhatsApp account information to improve your Facebook product experiences or provide you more relevant Facebook ad experiences on Facebook. Learn more about how WhatsApp works with the Facebook Companies.

This sounds more assuring and does support the idea claimed by the spokesperson.

If we compare these sections with Privacy Policy for other regions we can see that the same policies contain additional information, for example

We work with third-party service providers and other Facebook Companies to help us operate, provide, improve, understand, customize, support, and market our Services.

So there you have it. After a short investigation we can see that EU region does indeed have different policies and the Facebook specific points have been omitted. However to fully grasp the policies we would need a lawyer.

In either case whatever region user you are you should not be too worried about this update. The data that is being shared does not really affect you more that any other app you already have. If you are using Facebook, Instagram or even use a smartphone for any app, chances are that the data we are talking about is already available via one of the above. So if you really care about the privacy you should focus on limiting the usage of those apps as whole and be conscious about the data you share like location, camera, etc...

This is certainly no reason to ditch WhatsApp for a new and likely less secure platform. As long as the messages, calls and media is encrypted we should trust the app to do its job better than a 1-day github community project.