đŸ Archived View for gemini.ctrl-c.club âș ~ssb22 âș whatsapp.gmi captured on 2023-01-29 at 03:24:42. Gemini links have been rewritten to link to archived content
âŹ ïž Previous capture (2022-07-16)
âĄïž Next capture (2024-03-21)
-=-=-=-=-=-=-
On 7th January 2021, WhatsApp Messenger asked me to agree to send data to Facebook.âI did not.
(WhatsApp had previously asked for agreement in 2016, but at that time there had been an option for existing users to opt out.âNo such opt-out was available with the 2021 change.)
Although it is disputed that Cambridge Analytica really did swing two major elections in the Anglo-American world power by clever use of Facebook data in 2016, itâs nevertheless clear that Facebook may be *dangerously competent* at mining personal data.âIn fact I would sooner agree to having my data looked after by an oppressive regime than by Facebook, because Facebookâs data analysis skills seem stronger than that of major governments.
What Iâm trying to avoid with WhatsApp is quite simple:
I do not want my account to be a âsignalâ in the profile analysis of my contacts.
For example:
Various media reports said WhatsApp data will not be shared with Facebook for users within the EEA (strangely including Britain even after âBrexitâ although Iâm not sure for how long that would last), but Iâd prefer to get my information by reading *the agreement itself* rather than possibly-mistaken reports about it.
One piece of questionable web design was the way the European and non-European agreements were headed.âThe European version started out with the sentence âIf you donât live in the European Region, WhatsApp LLC provides WhatsApp to you under this Terms of Service and Privacy Policyâ whereas the *non*-European version said âIf you live in the European Region, WhatsApp Ireland Limited provides the Services to you under this Terms of Service and Privacy Policy.ââEach of these statements linked to the *other* version of the policy, but the use of the term âthisâ could easily be read as âthis one on this page,â causing confusion about which one *is* the European version.âClearer headings could have prevented this, but perhaps clarity is regarded as a less-important skill by some legal departments.
The European version (the one that had eea in the URL) linked to a Privacy Policy that included these words:
WhatsApp shares information globally, both internally within the Facebook Companies, and externally with our partners and with those you communicate around the world in accordance with this Privacy Policy and our Terms.
which has a PP-attachment ambiguity: does the âin accordance withâ part apply *only* to the âexternallyâ part, or does it apply to the whole sentence?âIf it applies to the whole sentence, then they should have added an extra comma before the âinâ to make this clearâas it stands, itâs *possible* to read it as saying the policy restricts only âexternalâ sharing and does not restrict âinternalâ sharing within the Facebook Companies which is a rather important comma to leave out.
The (European) Privacy Policy did link to a FAQ page that said âWhatsApp does not share your contacts with Facebookâ (changed to âWhatsApp does not share your contacts with Metaâ in November due to the company name change), but that page was removed in January?2023, and before that I didnât think it was assurance enough because:
1. this statement is not on the policy page *itself*, but on an *auxiliary* pageâitâs not clear that linking to it from the policy makes it *part* of the policy, and if itâs not part of the policy then they could change it at any time without needing any further agreement from you (compare for example YouTubeâs 2020 change that said theyâll start advertising on your videos even if youâve opted outâthey *said* this would take the form of links in an already-cluttered sidebar, but that detail was not *part* of the policy, and within months I had to delete my educational videos because pressing Play gave full-screen noisy advertising for products I do not endorse);
2. there may be a difference between sharing âyour contactsâ and sharing *data derived from* your contacts (for example, Facebook could decide to query WhatsApp about how many contacts you have that fit within a supplied cohort, which would still derive advertising signals from them without counting as âsharingâ the contacts themselves);
3. another FAQ entry says:
Today, Facebook does not use your WhatsApp account information to improve your Facebook product experiences or provide you more relevant Facebook ad[vertisement] experiences on Facebook.âWeâre always working on new ways to improve how you experience WhatsApp and the other Facebook Company Products you use.âWeâll keep you updated on new experiences we offer and our data practices.
which seems to say they *will* derive advertising signals from your WhatsApp data, they just havenât figured out how to do it *yet*,
4. and elsewhere it says âShould we choose to share such data with the Facebook Companies for this purpose in the future, we will only do so when we reach an understanding with the Irish Data Protection Commission on a future mechanism to enable such useâ and Iâm not entirely sure the Commission can be counted on not to declare post-Brexit Britain to be out of their remit, effectively giving Facebook the go-ahead without any further consultation from us.
The (EEA version of the) Privacy Policy said:
âWe still do not allow third-party banner ad[vertisement]s on our Services.âWe have no intention to introduce them, but if we ever do, we will update this Privacy Policyâ
The problem with this is the word bannerâit doesnât say there wonât be any *advertising*; it says only that there wonât be any âbannerâ advertising.âBanner advertising is not the *only* kind of advertising!âIncluding the word âbannerâ here gives superficial reassurance while still leaving open the way to third-party advertising in *any format thatâs not a banner*.
And would *that* advertising be allowed to use Contacts data as a signal?âConsider:
1. The policy includes âproviding marketing communications to youâ under âLegitimate Interestsâ of data use, and says âWe use information described in the âInformation You Provide,â âAutomatically Collected Information,â and âThird-Party Informationâ sections of this Privacy Policy for this purposeâ
2. and the full range of Facebook algorithms should be available for this, as the wording:
âWhen we receive services from the Facebook Companies, the information we share with them is used on WhatsAppâs behalf and in accordance with our instructions.âAny information WhatsApp shares on this basis cannot be used for the Facebook Companiesâ own purposes.â
still allows WhatsApp to say âhey Facebook, hereâs some personal data, donât *you* keep it, but suggest an advertisement for this person and weâll deliver it from WhatsApp.â
I donât want to agree to a policy that might allow sociograms to be used as advertising signals, and Iâm not convinced this one is watertight enough.
As I had no reply from the dedicated enquiries address posted with the EU Privacy Policy, and the revised 15th May deadline drew near without any indication that they were going to fix the wording, I gave notice to all active WhatsApp groups I was in, mostly saying:
Sorry leaving this WhatsApp group Friday when my account closes.âI asked them about loopholes in new agreement that I think lets them mix our contactsâ advert feeds (canât OK that with students on my phone), I suggested words to fix it, but no reply & no change, so I leave at their extended deadline to accept.
Iâm still on phone & text, + happy to re-join group if we move it to Telegram or Signal, can help set up if needed.â(Telegram has 500 million users & Iâve had no trouble with it for 6 years, works better than WhatsApp.âNot telling anyone what to do, just reporting my personal experience.)
In most cases I was able to use WhatsAppâs âExport Chatâ function to send things I needed to keep to K9Â Mail and email it to myself.âIt was also sometimes possible to send these to Telegram (although Telegram makes it possible for all parties to delete history, so it might not be suitable for keeping agreements etc).
I then closed the account under Settings before deleting the app.
I found closing the WhatsApp account resulted in groups being informed youâd âleftâ but did not inform anyone sending you a message that you wouldnât receive itâany messages sent just sat as âunreadâ indefinitely (with no âlast seenâ time on the contact).âIt may therefore be advisable to broadcast individual messages explaining that youâre leaving.
End-to-end encryption of *messages* does not stop companies from analysing your *contacts*. Any messaging system must necessarily get data about your contacts (or at the very least the people you communicate with), so itâs a question of picking one thatâs less likely to do something *else* with that data.
Incidentally, although the actual contents of messages is not my main concern here, I should still point out that WhatsAppâs âend-to-end encryptionâ means little unless I can verify the clientâs source code.âSkype had end-to-end encryption too, but that didnât stop them from adding âspywareâ *in the client* in at least one countryâs versionâend-to-end encryption doesnât stop a proprietary client from sending *a separate copy* of messages to a third party.âClosed-source proprietary software is never something I can fully trust: if I havenât seen the source code myself (or know a reliable person who has) then I canât vouch for it.âI therefore do not consider WhatsApp communication to be any more âsecretâ than that of systems *not* featuring end-to-end encryption.âIf you want secrecy then use a messaging client whose source code you can verify.
WhatsApp never replied to *me* but on 11th May a German official was widely quoted as saying âeven after close analysis, it is not clear what consequences approval has for usersâ and disallowing it in Germany, to which WhatsApp reportedly said âthe Hamburg DPAâs claims are wrongâ so they âwill not impact the continued roll-out of the updateâ and the wording of the new agreement was not changed.
Personally I can see why the Hamburg DPA said âit is not clearâ after his âclose analysisâ since that is what I also felt after my own analysis.âIf the statement that âit is not clearâ is included in what WhatsApp calls âthe Hamburg DPAâs claimsâ when it says âthe Hamburg DPAâs claims are wrongâ, then presumably WhatsApp think they can show the agreement is clear enoughâand Iâd very much like to read their argument if it can be made available, but meanwhile Iâm not in the habit of agreeing to things I feel are unclear just because of some companyâs unsubstantiated implication that there exists somewhere an argument that shows Iâm âwrongâ to feel itâs unclear.âShow me the *actual argument* and Iâll consider itâbut it must be based on the actual agreement, not any *other* statements by the company (thereâs an âentire agreementâ clause in there to make nothing *else* binding), and if it tries to tell me that the legal meaning of words is different from what I think then Iâd appreciate being able to check this from publically-available legal references.
All material © Silas S. Brown unless otherwise stated. Facebook is a trademark of Facebook, Inc. Google is a trademark of Google LLC. Skype is a trademark of Microsoft in the US (but not in Europe because it was too similar to Sky). Telegram is a trademark of Telegram Messenger LLP. WhatsApp is a trademark of WhatsApp Inc., registered in the U.S. and other countries. YouTube is a trademark of Google Inc. Any other trademarks I mentioned without realising are trademarks of their respective holders.