Facebook's acquisition of WhatsApp user data questioned

Privacy groups say phone numbers and other data should not be transferred without consent

Facebook's $19 billion acquisition of WhatsApp included a lot more than just WhatsApp's business and technology platform. It also included the names, phone numbers, and other data of millions of WhatsApp users, priceless fodder for Facebook's targeted advertising business.

Two prominent privacy groups took issue with that, and now the Federal Trade Commission says it will "carefully review" the complaints from the Electronic Privacy Information Center (EPIC) and Center for Digital Democracy (DCC).

The FTC said in a letter to the groups that it prohibits companies from engaging in unfair and deceptive practices and will enforce its 2012 Consent Order with Facebook. The FTC letter also acknowledged that the organizations' complaint “contains allegations regarding statements WhatsApp has made about how it limits the use of mobile phone numbers or other personally identifiable information." 

EPIC and CDD wrote that WhatsApp's plan to transfer user data to Facebook for user profiling and targeted advertising -- without first obtaining users' opt-in consent -- contradicts numerous FTC statements and violates Section 5 of the FTC Act.

"Broken that commitment ..."

“When Facebook acquired WhatsApp, WhatsApp made a commitment to its users, to the Federal Trade Commission, and to privacy authorities around the world not to disclose user data to Facebook. Now they have broken that commitment,” said Marc Rotenberg, President of EPIC, in a prepared statement. “Clearly, the Federal Trade Commission must act. The edifice of Internet privacy is built on the FTC’s authority to go after companies that break their privacy promises.” 

EPIC Consumer Protection Counsel Claire Gartland said users' telephone numbers are especially valuable.

“The phone number may also be the single most valuable piece of personal data obtained by WhatsApp. WhatsApp users are required to provide a verified phone number to use the service. And the phone number provides a link to a vast amount of personal information.”

Gartland said that in 2014, the FTC said that WhatsApp had to obtain affirmative consent to transfer user data to Facebook.

"There was an opt-out provision but that only applied to new information. Since WhatsApp intends to transfer user telephone numbers, which is not new data, it must obtain opt-in consent,” she said. “The proposed change – an opt-out for data previously obtained – is exactly what the FTC said WhatsApp could not do.”