💾 Archived View for tilde.pink › ~ssb22 › whatsapp.gmi captured on 2022-04-29 at 11:47:53. Gemini links have been rewritten to link to archived content

-=-=-=-=-=-=-

Unclarity in WhatsApp’s new Terms

On 7th January 2021, WhatsApp Messenger asked me to agree to send data to Facebook. I did not.

(WhatsApp had previously asked for agreement in 2016, but at that time there had been an option for existing users to opt out. No such opt-out was available with the 2021 change.)

Although it is disputed that Cambridge Analytica really did swing two major elections in the Anglo-American world power by clever use of Facebook data in 2016, it’s nevertheless clear that Facebook may be *dangerously competent* at mining personal data. In fact I would sooner agree to having my data looked after by an oppressive regime than by Facebook, because Facebook’s data analysis skills seem stronger than that of major governments.

What I’m trying to avoid with WhatsApp is quite simple:

I do not want my account to be a “signal” in the profile analysis of my contacts.

For example:

I don’t want the system to say, in effect, “It looks like you know Silas. Other people who know Silas are interested in *this* advert, so we’ll show it to you too.” That would interfere with my freedom to exchange contacts with anyone I meet *without* having to think “hold on—could adding this person pollute what my other contacts see?”
I don’t want the system to say “Silas himself likes this, so we’ll show it to you,” as that would compel me to be constantly on guard against accidentally letting their system count me as “liking” something if I’m not sure enough to recommend it to all my contacts,
and I definitely don’t want anybody to be able to trick their system into sending a specific advertisement to my contacts, as in “I don’t like something Silas said, and I’ll get revenge by showing this nasty advert to all his contacts.” When GMail ran advertising based on the content of messages (later withdrawn), I found one overzealous local church member had set ‘attack’ advertisements to be triggered by the *street address* of another religion, who then had to invite their interested ones to events without saying where! Google closed that account when reported, but damage had already been done. We can’t assume a policy with a complaints team can stop all attacks any more than a law with a police force can stop all crime—I’d rather use a system that doesn’t make it easy in the first place.

European confusion

Various media reports said WhatsApp data will not be shared with Facebook for users within the EEA (strangely including Britain even after “Brexit” although I’m not sure for how long that would last), but I’d prefer to get my information by reading *the agreement itself* rather than possibly-mistaken reports about it.

One piece of questionable web design was the way the European and non-European agreements were headed. The European version started out with the sentence “If you don’t live in the European Region, WhatsApp LLC provides WhatsApp to you under this Terms of Service and Privacy Policy” whereas the *non*-European version said “If you live in the European Region, WhatsApp Ireland Limited provides the Services to you under this Terms of Service and Privacy Policy.” Each of these statements linked to the *other* version of the policy, but the use of the term “this” could easily be read as “this one on this page,” causing confusion about which one *is* the European version. Clearer headings could have prevented this, but perhaps clarity is regarded as a less-important skill by some legal departments.

The European version (the one that had eea in the URL) linked to a Privacy Policy that included these words:

WhatsApp shares information globally, both internally within the Facebook Companies, and externally with our partners and with those you communicate around the world in accordance with this Privacy Policy and our Terms.

which has a PP-attachment ambiguity: does the “in accordance with” part apply *only* to the “externally” part, or does it apply to the whole sentence? If it applies to the whole sentence, then they should have added an extra comma before the “in” to make this clear—as it stands, it’s *possible* to read it as saying the policy restricts only “external” sharing and does not restrict “internal” sharing within the Facebook Companies which is a rather important comma to leave out.

The (European) Privacy Policy does link to a FAQ page that says “WhatsApp does not share your contacts with Facebook” (changed to “WhatsApp does not share your contacts with Meta” in November due to the company name change), but I’m not sure if that’s assurance enough because:

1. this statement is not on the policy page *itself*, but on an *auxiliary* page—it’s not clear that linking to it from the policy makes it *part* of the policy, and if it’s not part of the policy then they could change it at any time without needing any further agreement from you (compare for example YouTube’s 2020 change that said they’ll start advertising on your videos even if you’ve opted out—they *said* this would take the form of links in an already-cluttered sidebar, but that detail was not *part* of the policy, and within months I had to delete my educational videos because pressing Play gave full-screen noisy advertising for products I do not endorse);

2. there may be a difference between sharing “your contacts” and sharing *data derived from* your contacts (for example, Facebook could decide to query WhatsApp about how many contacts you have that fit within a supplied cohort, which would still derive advertising signals from them without counting as “sharing” the contacts themselves);

3. another FAQ entry says:

Today, Facebook does not use your WhatsApp account information to improve your Facebook product experiences or provide you more relevant Facebook ad[vertisement] experiences on Facebook. We’re always working on new ways to improve how you experience WhatsApp and the other Facebook Company Products you use. We’ll keep you updated on new experiences we offer and our data practices.

which seems to say they *will* derive advertising signals from your WhatsApp data, they just haven’t figured out how to do it *yet*,

4. and elsewhere it says “Should we choose to share such data with the Facebook Companies for this purpose in the future, we will only do so when we reach an understanding with the Irish Data Protection Commission on a future mechanism to enable such use” and I’m not entirely sure the Commission can be counted on not to declare post-Brexit Britain to be out of their remit, effectively giving Facebook the go-ahead without any further consultation from us.

Advertising on WhatsApp itself

The (EEA version of the) Privacy Policy said:

“We still do not allow third-party banner ad[vertisement]s on our Services. We have no intention to introduce them, but if we ever do, we will update this Privacy Policy”

The problem with this is the word banner—it doesn’t say there won’t be any *advertising*; it says only that there won’t be any “banner” advertising. Banner advertising is not the *only* kind of advertising! Including the word “banner” here gives superficial reassurance while still leaving open the way to third-party advertising in *any format that’s not a banner*.

And would *that* advertising be allowed to use Contacts data as a signal? Consider:

1. The policy includes “providing marketing communications to you” under “Legitimate Interests” of data use, and says “We use information described in the “Information You Provide,” “Automatically Collected Information,” and “Third-Party Information” sections of this Privacy Policy for this purpose”

2. and the full range of Facebook algorithms should be available for this, as the wording:

“When we receive services from the Facebook Companies, the information we share with them is used on WhatsApp’s behalf and in accordance with our instructions. Any information WhatsApp shares on this basis cannot be used for the Facebook Companies’ own purposes.”

still allows WhatsApp to say “hey Facebook, here’s some personal data, don’t *you* keep it, but suggest an advertisement for this person and we’ll deliver it from WhatsApp.”

I don’t want to agree to a policy that might allow sociograms to be used as advertising signals, and I’m not convinced this one is watertight enough.

Closing WhatsApp

As I had no reply from the dedicated enquiries address posted with the EU Privacy Policy, and the revised 15th May deadline drew near without any indication that they were going to fix the wording, I gave notice to all active WhatsApp groups I was in, mostly saying:

Sorry leaving this WhatsApp group Friday when my account closes. I asked them about loopholes in new agreement that I think lets them mix our contacts’ advert feeds (can’t OK that with students on my phone), I suggested words to fix it, but no reply & no change, so I leave at their extended deadline to accept.

I’m still on phone & text, + happy to re-join group if we move it to Telegram or Signal, can help set up if needed. (Telegram has 500 million users & I’ve had no trouble with it for 6 years, works better than WhatsApp. Not telling anyone what to do, just reporting my personal experience.)

In most cases I was able to use WhatsApp’s “Export Chat” function to send things I needed to keep to K9 Mail and email it to myself. It was also sometimes possible to send these to Telegram (although Telegram makes it possible for all parties to delete history, so it might not be suitable for keeping agreements etc).

I then closed the account under Settings before deleting the app.

I found closing the WhatsApp account resulted in groups being informed you’d “left” but did not inform anyone sending you a message that you wouldn’t receive it—any messages sent just sat as “unread” indefinitely (with no ‘last seen’ time on the contact). It may therefore be advisable to broadcast individual messages explaining that you’re leaving.

But isn’t WhatsApp end-to-end encrypted?

End-to-end encryption of *messages* does not stop companies from analysing your *contacts*. Any messaging system must necessarily get data about your contacts (or at the very least the people you communicate with), so it’s a question of picking one that’s less likely to do something *else* with that data.

Incidentally, although the actual contents of messages is not my main concern here, I should still point out that WhatsApp’s “end-to-end encryption” means little unless I can verify the client’s source code. Skype had end-to-end encryption too, but that didn’t stop them from adding ‘spyware’ *in the client* in at least one country’s version—end-to-end encryption doesn’t stop a proprietary client from sending *a separate copy* of messages to a third party. Closed-source proprietary software is never something I can fully trust: if I haven’t seen the source code myself (or know a reliable person who has) then I can’t vouch for it. I therefore do not consider WhatsApp communication to be any more “secret” than that of systems *not* featuring end-to-end encryption. If you want secrecy then use a messaging client whose source code you can verify.

Are we “wrong” to think it’s unclear?

WhatsApp never replied to *me* but on 11th May a German official was widely quoted as saying “even after close analysis, it is not clear what consequences approval has for users” and disallowing it in Germany, to which WhatsApp reportedly said “the Hamburg DPA’s claims are wrong” so they “will not impact the continued roll-out of the update” and the wording of the new agreement was not changed.

Personally I can see why the Hamburg DPA said “it is not clear” after his “close analysis” since that is what I also felt after my own analysis. If the statement that “it is not clear” is included in what WhatsApp calls “the Hamburg DPA’s claims” when it says “the Hamburg DPA’s claims are wrong”, then presumably WhatsApp think they can show the agreement is clear enough—and I’d very much like to read their argument if it can be made available, but meanwhile I’m not in the habit of agreeing to things I feel are unclear just because of some company’s unsubstantiated implication that there exists somewhere an argument that shows I’m “wrong” to feel it’s unclear. Show me the *actual argument* and I’ll consider it—but it must be based on the actual agreement, not any *other* statements by the company (there’s an “entire agreement” clause in there to make nothing *else* binding), and if it tries to tell me that the legal meaning of words is different from what I think then I’d appreciate being able to check this from publically-available legal references.

Legal

All material © Silas S. Brown unless otherwise stated. Facebook is a trademark of Facebook, Inc. Google is a trademark of Google LLC. Skype is a trademark of Microsoft in the US (but not in Europe because it was too similar to Sky). Telegram is a trademark of Telegram Messenger LLP. WhatsApp is a trademark of WhatsApp Inc., registered in the U.S. and other countries. YouTube is a trademark of Google Inc. Any other trademarks I mentioned without realising are trademarks of their respective holders.