Updated WhatsApp Privacy Policy

WhatsApp announced an update to its privacy policy this month which resulted in a lot of protest, forcing them to extend the deadline for the new policy from February 8 to May 15, 2021. A lot of users had several questions regarding the privacy of their chats and their WhatsApp data. Here are answers to some questions you may have in mind:

1) What is the update to the WhatsApp Privacy Policy? The update changes the privacy of information shared with business accounts on WhatsApp, enabling them to share the information exchanged in the chat with third parties, including Facebook and integrating payment and chat services from websites of businesses. The new update gives users the option to either accept these changes in order to continue using WhatsApp or delete their WhatsApp account.

2) Can WhatsApp read my chats? No. Chats remain end-to-end encrypted, which means only you and the recipients of the message in a private or group chat can read the messages; see photos, videos and location pins and hear voice notes and audio or video calls.

3) What data does WhatsApp collect about me? Still a lot. WhatsApp collects metadata (information related to your identity). This includes your phone number, information about your device and internet connection, names of groups you are a part of, your status, your stories, your profile display picture, what time you are online on WhatsApp. How you chat with a business using WhatsApp is also information that will be shared with Facebook and they will use this information to personalise ads on Facebook and Instagram.

4) What does WhatsApp do with user metadata? WhatsApp was bought by Facebook for $19 billion in 2014, the highest acquisition at the time. Facebook’s business model relies on user data which is sold to advertisers to target personalised advertisements based on the user’s ad profile. Metadata collected by WhatsApp is valuable for advertisers on Facebook and Instagram and hence profitable for WhatsApp to collect this data. You can also download your WhatsApp data.

5) What does this mean for businesses? Businesses now have the option to use hosting services from Facebook to manage chats with customers. Businesses can also share data in chats for advertising purposes, including on Facebook. Businesses are now also able to add the option of chatting with their business account through ads on Facebook.

6) How can I be more private and secure while using WhatsApp? There are several steps a user can take to ensure maximum privacy on WhatsApp.
• Avoid interacting with business accounts on WhatsApp.
• Never share a pin code sent to you by SMS from Whatsapp with anyone, even if people close to you ask for it. It is likely that they have been hacked and the hacker is trying to hack your account by asking for the code sent on your number.
• Enable 2-step verification on WhatsApp through a pin, so that if you are hacked, you can quickly retrieve your account.
• Turn off ‘last seen’ and read receipts on WhatsApp so people are not able to stalk you.
• Avoid uploading up your picture on display, but if you do, change the settings for who can see them to “Nobody” or “Contacts only”
• Avoid posting stories and status updates, especially those that give away personal information.
• If you want to post stories and status updates, change the settings of who can see them to ‘Contacts only’.
• Avoid backing up your chat history on online clouds such as iCloud because that is stored in unencrypted form and is vulnerable to hacking.

7) Are there more secure alternatives? Signal is the most secure messaging application. It is owned by the non-profit Signal Foundation, founded by the cofounder of WhatsApp who left the company due to disagreements with Facebook in 2017. Because it is a non-profit Foundation, they have no interest in accessing user data as they cannot sell it and they offer encryption across all your data, including metadata. Their open source code, which offers secure encrypted messaging is also used by WhatsApp for encrypting chats and open source means the company cannot exclusively own and control the code or data.

Whatever decision you make, it should be an informed one, preferably protecting your personal information and privacy.

Usama Khilji is Director of Bolo Bhi, board member of the Global Network Initiative and member of Privacy Experts Group of Facebook APAC.