National Herald 13 Jan 2021

WhatsApp ad in newspapers is deceptive, spreading misinformation, say tech policy experts 

by Ashlin Mathew

A few days after rolling out their new privacy policy for WhatApp, the Facebook-owned messaging service put out full-page ads in leading English dailies such as the Hindu, Indian Express, The Telegraph, Deccan Herald and the Times of India titled “WhatsApp respects and protects your privacy”. Tech policy experts have slammed the ad for misleading users as WhatsApp collects massive metadata which still undermine privacy by revealing sensitive information about users.

WhatsApp metadata means information on which numbers were contacted which over WhatsApp, when, and for how long, as well as the IP addresses. It can also include location and contacts data

The ad comes with the line, ‘Respect for your privacy is coded into our DNA’. However, this line is a lie too. “Interestingly this used to be the case in WhatsApp’s previous privacy policy of 2016, but it has been removed in the new privacy policy,” underscored Apurva Singh, volunteer legal counsel at Software Freedom Legal Centre (SFLC). It works to defend digital freedom, internet governance and freedom of expression.

WhatsApp released this advertisement in papers to instill trust in the messaging app. “But the ad fails to do just that. It does not state what data are collected and how they intend to process the data that are collected. They are simply repeating the same things – the app is end-to-end encrypted, private messages are not shared with Facebook. If they really wanted to instill trust in people, they have to explicitly state what they are collecting rather than publishing these deceptive ads,” asserted Tripti Jain, a lawyer and researcher with Internet Democracy Project. Facebook needs to be absolutely clear about the data being collected, how is it being shared and what it is being used for.

The advertisement mentions that WhatsApp protects your privacy because messages are encrypted, groups remain private and because they cannot see your shared location. All the three points are obfuscating the truth.

“It is misleading because while WhatsApp chats are encrypted, they still get your log information, the hardware you are using, and they know who you are talking to. They also know your phone number and IP address. The ad skims over these details,” added Jain.

When Facebook and WhatsApp mention privacy in the advertisement, the company wants it to mean private messages. In doing so, it is attempting to change the definition of privacy. “This ad is deceptive because Facebook is restricting privacy to end-to-end encryption of messages. Privacy means users do not want Facebook to know which Wi-Fi network they are using, their IP address, who they are talking to and for how long. Privacy is not only about messages. Why does a company need to know my log-in information? This is a major concern,” argued Singh.

The advertisement states that this update is about changes related to messaging a business on WhatsApp, which is optional and provides further transparency about how we collect and use data. “This is not true. If you look at the privacy policy that users have received on WhatsApp, it states that if we wish to continue using WhatsApp, we must agree to this policy, otherwise we will not have access to the app. This is not a real choice when you are seeking informed consent. A person should be given the opportunity to negotiate to agree or deny the choice to share their data even while continuing on the app,” explained Jain.

They are spreading misinformation in disguise. “The fact that I have to be integrated into the ecosystem though I do not aim to use WhatsApp Business is problematic. Anyone who has to use WhatsApp, has to give the company access to their contact list whether they use WhatsApp Business or not. If all the businesses are on FB, a single user does not have a bargaining power,” said Jain.

In the ad, they want it to appear as though the policy update is only for WhatsApp Business. But that is a lie. If you are using WhatsApp, your information will be shared. They have not clarified what exactly will be collected and shared.

In 2016, users had the choice of opting-out of sharing data with Facebook, but the option is no longer there. When WhatsApp says that it does not share your contacts with Facebook or any other app, users are not sure what this means. WhatsApp has said in the past that the contacts on WhatsApp are not matched with the contacts on Facebook. “There is no way to verify it,” pointed out Singh.

This advertisement adds to the confusion and in convoluted sense it obfuscates more than clarifying. A regular citizen does not understand these privacy policies and there is always a cost to understanding what these policies mean.

“We need to ask why a digital communications company has put out ads in newspapers instead of on social media. They haven’t put out anything on social media. If there is a miscommunication about their policies, shouldn’t they be using their digital platforms to put out the information instead of using newspapers,” asked Jain.

When we compare Facebook’s huge data collection with the other messaging app Signal, it becomes clear that Signal only collects the first time you logged into their system and the last time you were online on the app.

National Herald has sent all these questions to the Facebook Chats team, which handles WhatsApp communication. This article will be updated if and when they respond.

Originally published in National Herald.