What’s up with your data on WhatsApp? Explaining the app’s new privacy terms

Consumer data aggregator Statistica estimates that WhatsApp is the most popular mobile app in South Africa, and the most used mobile messenger app worldwide with an estimated 2 billion monthly active users in 2020.

Globally, in one internet minute, some 41.7 million messages are shared by the app’s users, according to Statistica.

So when WhatsApp in January 2021 required users to accept the terms of an updated privacy policy or lose access, users were worried how much of their personal data the app and its parent company Facebook would now access.

Following a backlash, WhatsApp has pushed back the opt-in date from February to May 2021, citing what it described as “much confusion”. But the privacy concerns had already taken flight.

For example one Facebook post claimed that WhatsApp will share users’ messages with third parties. Another said Facebook will “make copies of the stuff in your gallery for advertising”.

A third post (now unavailable) warned that the new data Whatsapp would glean included “your phone number, IP Addresses, personal contacts and more. You will have to accept this if you want to continue using the app!” 

Is this the case? How much of the claims made around the revised policy was true? (Note: Africa Check uses WhatsApp Business for projects such as our What’s Crap on WhatsApp podcast.)

What does the company say?

WhatsApp has been at pains to highlight that it cannot see what personal information users share with their friends and family. This it says is because it uses end-to-end encryption. This refers to a way of communicating where the only people who can read a message are the sender and the recipient.

“It’s why we don’t keep logs of who everyone’s messaging or calling. We also can’t see your shared location and we don’t share your contacts with Facebook,” WhatsApp said in January 2021.

The company says the now controversial change to its policy was geared at the use of its platform for business, and to provide “further transparency about how we collect and use data”.

The revision “does not expand our ability to share data with Facebook”, it added.

What’s changed?

One of the most debated changes was the deletion of this clause from its privacy policy: “If you are an existing user, you can choose not to have your WhatsApp account information shared with Facebook to improve your Facebook ads and products experiences."

The policy now simply says WhatsApp “receives information from, and shares information” with other Facebook companies. There is no choice to opt out.

(Note: Users in WhatsApp’s European region must agree to a different version of its privacy policy. This report deals only with the terms applicable to users outside that region.)

Tech reporters and experts have weighed in on the meaning of these changes. But first, a bit of history.

In 2014, Facebook bought WhatsApp, it’s largest acquisition yet, for a reported final price of nearly $22 billion. At the time, it said that the app would be a “standalone” product. In 2016 however, as US tech magazine Wired explains, it made significant changes to its privacy policy, by starting to share user information and other data with Facebook.

For a brief period of 30 days in 2016 you could opt out of this data sharing, even if WhatsApp would still collect the data. Since then, users have not had this option to refuse, meaning they have had their data shared with Facebook.

Here’s an example of a user who opted out of sharing data in 2016 (we have no idea why the data opt-out year is given as 1969):

And one who did not, or more accurately, could not:

 

The data collected does not include photos, messages or other content shared between users. But it does have other information it can collect. This includes account information such as your phone number, how long and often you use WhatsApp and how you interact with other users, including businesses.

It can also pick up what kind of device you are using, its operating system and its IP address, mobile network and language.

This information, WhatsApp says, is used "to operate, provide, improve, understand, customize, support, and market our services.” This, for example could take the form of showing you an ad on handbags or shoes in Instagram, if you contacted a similar business on WhatsApp or granted the app location permissions.

The company says if a user chooses not to share their precise location, it will try to infer this.

WhatsApp can also pick up transaction and payment data (if you have used WhatsApp Pay, currently available in Brazil and India).

If you did not opt out of this in 2016, then Facebook already has been collecting this data. Many people just did not know this, one privacy expert told the New York Times. If you did opt out, the company will reportedly continue to honour your decision.

The 2021 change that sparked uproar simply reflects better what already has been happening.

South African social media law expert Emma Sadleir in an 11 January 2021 video explaining this termed much of the reaction as “unfounded”.

Sadleir says while there are certainly privacy concerns around Facebook, those around WhatsApp are “pretty minimal” compared to others in the company’s stable, such as Facebook, Instagram and Facebook Messenger.

Other experts said the user backlash was a result of bungled communications by the company, the US election and lingering data privacy concerns that have stalked Facebook in recent years. 

So WhatsApp does collect information like your IP address, but this is not new to its updated privacy policy. What it does not collect or see is your personal messages or the photos in your gallery.