Fact Check

Does WhatsApp's New Terms of Service Share Data with Facebook?

An updated user agreement resulted in millions of users downloading other messaging applications.

Published Jan. 12, 2021

Updated Jan. 18, 2021
Whatsapp chatting outdoor 20180808 (Santeri Viinamäki / Wikimedia Commons.)
Whatsapp chatting outdoor 20180808 (Image Via Santeri Viinamäki / Wikimedia Commons.)
Claim:
WhatsApp’s new terms of service as of early January 2021 allows the messaging app to share bank account information and other data with Facebook, as well as censor private messages.
What's True

WhatsApp has actually been sharing user data with Facebook for years. Under the updated user agreement, which is mandatory after Feb. 8, 2021, information shared by users with businesses on the app may be shared by WhatsApp with Facebook, including financial transactions and payments, contacts list, usage data, location, phone identifiers, and various metadata.

What's False

There is no evidence that WhatsApp will censor private messages. WhatsApp says it will not have access to user’s private chats, groups, or call logs, and neither will Facebook.

In early 2021, a pop-up on WhatsApp user’s phones alerted them to a new terms of service and privacy policy for the messaging app that set off alarm bells.

The privacy policy and terms of service said that as of Feb. 8, 2021, the company’s policies would change, and users had to accept the new terms if they wanted to keep using the app. As part of the change, WhatsApp removed a passage allowing users to opt out of sharing certain data with Facebook.

The policy now states, “WhatsApp receives information from, and shares information with, the other Facebook Companies. We may use the information we receive from them, and they may use the information we share with them, to help operate” and market services.

This created an outcry from privacy advocates and users. The week after the announcement, millions downloaded other apps like Signal and Telegram, which, similar to WhatsApp, offer free encrypted messaging services.

Our readers asked us a range of questions around this, including whether Facebook would now have access to private messages, and a range of user data that included bank account information. The answer is complicated and requires diving into WhatsApp’s new policies.

Firstly, the new policy appears to apply to user interactions with businesses on the messaging platform. Will Cathcart, who oversees development and strategy for WhatsApp, said on Twitter, “This update describes business communication and does not change WhatsApp’s data sharing practices with Facebook.”

WhatsApp’s new privacy policy states:

Businesses you interact with using our Services may provide us with information about their interactions with you. We require each of these businesses to act in accordance with applicable law when providing any information to us. When you message with a business on WhatsApp, keep in mind that the content you share may be visible to several people in that business. In addition, some businesses might be working with third-party service providers (which may include Facebook) to help manage their communications with their customers. For example, a business may give such third-party service provider access to its communications to send, store, read, manage, or otherwise process them for the business. To understand how a business processes your information, including how it might share your information with third parties or Facebook, you should review that business’ privacy policy or contact the business directly.

The update was part of Facebook’s efforts to serve more targeted ads to people on Facebook and Instagram by knowing their usage habits on WhatsApp, and let businesses receive payments on WhatsApp for items that users may have clicked on Instagram first.

The company has clarified that neither WhatsApp nor Facebook will have access to private messages and media shared between users and groups. They cannot share your call logs, location, contact lists, and groups from your personal messaging. End-to-end encryption on the app remains intact, and there is no evidence the company could “censor” messages, as some of our readers were asking. They said: "We want to be clear that the policy update does not affect the privacy of your messages with friends or family in any way. Instead, this update includes changes related to messaging a business on WhatsApp, which is optional, and provides further transparency about how we collect and use data."

What kind of information will be shared with their parent company, then?

According to Cathcart, this would be information conveyed through “optional people-to-business” features. This could include location, contact lists, financial information and usage data, and other types of so-called metadata that would help Facebook target ads. Users can interact with the businesses in other ways and don’t necessarily have to use WhatsApp.

Many of our readers were concerned about their financial information being shared with Facebook. It is not clear whether bank account information will be shared with the company. According to WhatsApp’s policy, users provide their financial information if they use the app’s payments features:

If you use our payments services, or use our Services meant for purchases or other financial transactions, we process additional information about you, including payment account and transaction information. Payment account and transaction information includes information needed to complete the transaction (for example, information about your payment method, shipping details and transaction amount). If you use our payments services available in your country or territory, our privacy practices are described in the applicable payments privacy policy.

We reached out to WhatsApp and Facebook to get more details, and they directed us back to their FAQs.

As it turns out, WhatsApp has been sharing user information with Facebook since 2016. At that time, the service offered its users 30 days to opt out of at least some of the sharing. The company says it must receive user information "to operate, provide, improve, understand, customize, support, and market our Services” and that information depends on how we use their services. So even though our private messages are encrypted, there is still a lot of data WhatsApp can share with Facebook, and has been sharing for years from the majority of its users.

We spoke to Gennie Gebhart, a privacy researcher at the Electronic Frontier Foundation (EFF), a non-profit digital rights group. "The good news is that this is not an extreme privacy policy change," she said. "The bad news is the extreme policy change already happened in 2016, all those years ago. WhatsApp is and has been sharing a lot more data with Facebook than most users were aware of [...] Facebook is correct that nothing changed because the bad stuff already happened."

She added that WhatsApp is still a good messaging service, "It's reliable, it's usable [...] but when Facebook acquired WhatsApp, all this wasn't on the table. All this is an erosion of the original promise [WhatsApp made]. No one asked for shopping on WhatsApp, except maybe businesses. It's moving WhatsApp to become an everything app, like WeChat [in China]."

Ultimately, Gebhart worried that connecting businesses advertising on Facebook, to conducting their transactions on WhatsApp, is collapsing the barriers between three different services: Facebook, Instagram, and WhatsApp, which has privacy implications for users. "The best case scenario is users will freak out [and have conspiracy theories] about how Facebook is listening to everything. [But] people who separate their identities between apps, will see them merge in unpredictable ways that they have no control over [...] Activities on one app pollute what is exposed when using another."

This new privacy policy also does not apply to WhatsApp in the European Union (EU), which has strict privacy laws. WhatsApp said any plan to share data with Facebook or other group companies would only be done once the company made an agreement with the Irish Data Protection Commission, the lead regulator for the service in Europe.

On Jan. 15, 2021, after the backlash from users and privacy advocates, WhatsApp announced they would be delaying the planned update to May 15, 2021, to give users more time to review their planned changes.

Given that WhatsApp users’ private messaging is still protected, but a range of other data related to business communications on the messaging platform, including financial transactions, could be shared by WhatsApp with Facebook, we rate this claim a “Mixture.”

Updates

Jan. 12, 2021: Added information WhatsApp cannot share from personal messaging. Added interview with Gebhart.

Jan. 18, 2021: Added update on WhatsApp's delay in implementing the new policy.

Nur Nasreen Ibrahim is a reporter with experience working in television, international news coverage, fact checking, and creative writing.