WhatsApp has reiterated in a blog post on Tuesday that the service is end-to-end encrypted and neither it or Facebook can see messages. It has further emphasized that it does not share contacts with Facebook, that location shared on chat and group chats remains private, that users can set messages to disappear, and can download their data. However, WhatsApp’s end-to-end encryption was not in question. It is understood that neither WhatsApp nor Facebook can read messages between users; the concern is that the user’s own information and granular device info, as well as users interaction with any Businesses can be combined with their data from Facebook and even Instagram to better target ads.
Further, as WhatsApp said in its new privacy updates, messages to business accounts on WhatsApp can be shared with third-party service providers, which may include Facebook itself. For example, Facebook (as the third-party service provider) could store, read and “manage” messages sent to businesses by users. This only becomes clearer in the WhatsApp’s clarification posted on Tuesday:
How data from WhatsApp Business usage will be used: Businesses on WhatsApp can use a hosting service from Facebook to manage chats with customers. Businesses can use the interaction with customers that use them for marketing, which may include advertising on Facebook. Further, they can use Facebook-branded features such as Shops to display their products on WhatsApp. Users’ activities with Shops can be used to personalise their Shops experience as well as ads on Facebook and Instagram. Users will also see ads on Facebook to message a button on WhatsApp; users interactions with these ads can further be used by Facebook to personalise ads.
Essentially, there is freer flow of data between WhatsApp, Facebook, and Instagram. While nobody can peek into your texts, thanks to end-to-end encryption, data points about users, and how they use WhatsApp’s business services, and their broader interaction with the Facebook group of products (Messenger, Facebook, Instagram, WhatsApp, Onavo) can be combined. The theoretical use cases of this could be multiple: see ads for a product being sold on WhatsApp Business on Facebook, buy the product via WhatsApp Business, and that interaction is used to show you more ads and relevant content.
There’s another caveat worth noting; it concerns sharing of contact lists. WhatsApp’s privacy updates clearly state that it can share any data it collects under its “Information we collect” section with Facebook. This includes individual users’ address books. However, WhatsApp FAQs state that “we don’t share your contacts lists with the other apps Facebook offers”. This is a contradiction by WhatsApp; it’s privacy update allows it to share contacts list, but a public update says it will not. We need more clarity on how much data is being shared, and more importantly what isn’t being shared.
WhatsApp reported 2 billion monthly active users globally in February 2020 (before the pandemic), with 400 million reportedly being in India. It has launched its UPI-payments service in India. As of July, WhatsApp Business accounts had 50 million MAUs, with 15 million of those in India, per TechCrunch. As as WhatsApp head Will Cathcart said, 175 million people globally message a business account each day.
For now, as downloads of more privacy-mindful messaging apps such as Signal increase, WhatsApp has taken out a full-page front page ad in India’s largest English daily.