Jessica Rich, director of the Federal Trade Commission's Bureau of Consumer Protection, has told WhatsApp and its proposed new owner, Facebook, that under that new ownership, it expects instant messaging WhatsApp to adhere to previous promises about consumer privacy, ones that "exceed the protections currently promised to Facebook users."
Rich said in particularly she was talking about promises about the limited nature of its data collection and sharing that with third parties.
"We want to make clear that, regardless of the acquisition, WhatsApp must continue to honor these promises to consumers. Further, if the acquisition is completed and WhatsApp fails to honor these promises, both companies could be in violation of Section 5 of the Federal Trade Commission (FTC) Act and, potentially, the FTC's order against Facebook," she wrote in a letter to Facebook and WhatsApp execs.
Rich said the FTC would hold WhatsApp to its July 7, 2012 privacy policy statement that "WhatsApp does not collect names, emails, addresses or other contact information from its users' mobile address book or contact lists other than mobile phone numbers" and that it [does] not collect location data" and that "The contents of messages that have been delivered by the WhatsApp Service are not copied, kept or archived by WhatsApp." The policy further represents that "We do not use your mobile phone number or other Personally Identifiable Information to send commercial or marketing messages without your consent . ... " Similarly, it states that "We do not sell or share your Personally Identifiable Information (such as mobile phone number) with other third-party companies for their commercial or marketing use without your consent."
Rich concedes that Facebook has already said it will not change those WhatsApp policies, but wants to make clear that the FTC treats those pledges and that policy as a promise that must be kept.
She also says that if Facebook ever changed gears, or those WhatsApp policies, it must "first obtain consumers' affirmative consent before doing so."
She also said that Facebook "must not misrepresent in any manner the extent to which you maintain, or plan to maintain, the privacy or security of WhatsApp user data." If so, it would be in violation of the FTC's existing order against Facebook. She also suggests that if Facebook does change "how you collect, use, and share newly-collected WhatsApp data," that it give users the chance to opt out.
In 2011, Facebook settled with the FTC over charges it "deceived" consumers by failing to keep privacy promises. Under that settlement, Facebook has to, among other things, get consumers’ consent before changing privacy settings.
"The FTC is to be commended for sending a very strong signal that they will hold Facebook and WhatsApp accountable for their promises," said the Center for Digital Democracy, which has been a leading voice for greater online privacy protections.
