WhatsApp's Privacy Policy

–Kakali Das |

The popular messaging app, WhatsApp, has announced that it has updated its privacy policy. The users must, until the 8^th of February, decide whether or not they agree to the terms and conditions of the company. Basically, with the new policy in hand, WhatsApp will be sharing more information of the users with its parent company, Facebook. Facebook owns not only the Facebook app and its messenger, but Instagram and WhatsApp as well, along with WhatsApp payments, which is a payment gateway that’s opened on WhatsApp.

NEIPF : Interest of the indigenous people of NE must be protected

“Very clearly WhatsApp won’t be able to read our messages or our conversations, because it uses the open signal protocol. I know a lot of people who are shifting from WhatsApp to Signal, but WhatsApp uses the same technology as Signal, except the difference is that WhatsApp collects a lot of additional information, especially metadata, which Signal doesn’t. And it can’t access media such as photographs, videos, unless it is reported as spam. When one reports a media as ‘spam’, he/she, in effect, are decrypting that message and permitting WhatsApp to check it”, Nikhil Pahwa, Founder, Medianama said.

On being asked about what the problem is and why are people concerned about the change in policy, he further said, “In 2016, when the privacy policy was last changed, data sharing policy between WhatsApp and Facebook was announced. Now, they have clarified the same and added some more information to that policy. For instance, WhatsApp has optional features that require collection of additional information, especially location. So, the company says that the users won’t be able to share their locations with other users in chats if they don’t allow WhatsApp to receive location data, and if they disable location data on WhatsApp, the app can still use their IP addresses and phone area code to estimate their location. WhatsApp will also collect additional information, like the battery level, signal strength etc. and these are the type of information that WhatsApp tracks and will be sharing with Facebook. Some information will also be used for advertising. If one is interacting with businesses on WhatsApp, that information can probably, in the future, allow businesses to target on different platforms. WhatsApp won’t be receiving advertising, but the information that it collects will be used to target the users on either WhatsApp, Facebook or Instagram service.”

WhatsApp claims that the data by the users are end-to-end encrypted, meaning when a user sends another user a message, it can never be accessed by a third user in the middle. But in some messaging services, the message gets transferred to a server and from the server to the user, and the server reads the message in the process. In case of WhatsApp, even if it gets through the server it doesn’t get decrypted in the middle. SMS’s can be read by the government, but not WhatsApp (claims by the company).

According to WhatsApp, it won’t view the messages or videos or photographs by the users, but the data that WhatsApp collects already such as, the location, the battery level etc. – which would too be shared with the parent company from on onwards. And if a user happens to have a conversation with a business account, i.e. the user placing an order of some sort with someone who is registered as a business, will too be stored on a server. Businesses can subscribe to WhatsApp’s services for basically hosting WhatsApp for business, and in that case Facebook, as a company which is providing those services to the business would then be storing that information with it.

WhatsApp has done its homework in realising the policy vacuum that exists in the country, because India doesn’t have a law on privacy, data protection, nor a law on cyber security. So, this is a fertile ground for the companies to go ahead and unilaterally make changes, like an Emperor makes changes to his Empire. When we look at the fine print, they have actually gone far beyond in updating their policies. It isn’t merely Instagram or Facebook that will have access, but access would also be shared with all business partners or agents, and all third parties, including independent service providers. So, it’s a much bigger gamut of stakeholders that will have access to the data. It’s a common knowledge that WhatsApp has been sharing our data with Facebook group of companies since September, 2016. The logic for this is that in its terms and conditions, WhatsApp considered all that’s published on WhatsApp to be merely public information – whether its audio, video or text where one isn’t entitled to privacy. But now the proposed amendments go a step further when they have actually gone ahead and looked at an entire issue of accessing, sharing, transmitting, disseminating, and monetising sensitive personal data. What’s intriguing in this entire issue is the silence on behalf of the government, where the government is by and large acting as a spectator when potentially the sensitive personal data of humongous volumes of Indians are likely to be prejudicially impacted.