Thread by @WolfieChristl

Regardless of the announced update, what kind of personal information does Whatsapp currently share with FB, according to its website?

- account+device info
- transaction data
- service-related information
- information on how you interact with others

Basically, all metadata.

Personal data Whatsapp shares with Facebook "may include other information identified in the Privacy Policy section entitled ‘Information We Collect’ or obtained upon notice to you or based on your consent"

Upon 'notice'?

Current non-EU privacy policy:
whatsapp.com/legal/updates/…

According to the current privacy policy for non-EU users, Facebook may use Whatsapp (meta)data for all kinds of extensive digital profiling including for "product suggestions (for example, of friends or connections, or of interesting content) and showing relevant offers and ads".

This data sharing is happening since 2016.

When Facebook acquired Whatsapp in 2014, it told users and US/EU regulators that FB would not combine user data across the services.

This is from the recent antitrust lawsuit of 46 US states against Facebook: ag.ny.gov/sites/default/…

So, Facebook lied to users and regulators.

According to the lawsuit, FB "took great pains to avoid negative press coverage" in 2016.

The Whatsapp founder was told to get not "too much into the weeds on the types of data we’re sharing" and instead prepare some "‘safe’ examples".

In 2014, FB formally told the EU Commission, it would even be *unable* to establish reliable automated matching between FB and WhatsApp user accounts (🙄).

Because of this lie Facebook was fined €110 million in 2017 (still a tiny amount of its profits):
ec.europa.eu/commission/pre…

Can Facebook and Whatsapp be trusted?

No.

As long as fines or other sanctions do not substantially endanger their business, I expect them to continue violating the law, delaying investigations and lawsuits until profits are locked in, and misleading regulators and the public.

Whatsapp provides services under a very different privacy policy to users in the EU and other GDPR countries.

Here's the key paragraph regarding Whatsapp data sharing with FB. Left: global. Right: EU/GDPR.

Digital profiling only for safety and security.
whatsapp.com/legal/privacy-…

I suspect that Facebook has been massively violating the GDPR since 2018 in several respects. The Irish data protection authority has been investigating several FB cases for years and there still isn't any decision since 2018.

Anyway, the GDPR seems to make a difference.

Nevertheless, while Whatsapp doesn't mention ads or other kinds of profiling in the GRPR policy it still states it shares data to "help operate, provide, improve, understand, customize, support, and market" Facebook's services and offerings. Also, safety+security are broad areas.

There's a separate page about data sharing with FB in EU/GDPR countries.

It states that *today* FB does not use Whatsapp data for extensive profiling (aka 'improve product experiences', 'provide ad experiences') bc of discussions with the Irish regulator.
faq.whatsapp.com/general/securi…

This is what they say. I don't trust in what they say, because I don't see GDPR enforcement.

Generally, I don't question their e2e encryption for content, even though @swodinsky has written about Whatsapp's "idea of baking a brand-sized loophole" into it: gizmodo.com/this-was-whats…

Anyway, even if the content of Whatsapp messages is reliably protected, metadata on who people are communicating with, how often, and when, is powerful. Tiny details about which data is being shared matter.

Communication metadata should not be exploited for commercial profiling.

This is not only about 'privacy'.

Tiny details about which data is being shared matter when it's about 2 billion people and when tiny details can decide about network effects, platform power and billions of profit.

I wrote the GDPR seems to make a difference for Whatsapp's EU practices, but completely forgot to mention the ePrivacy directive. Of course, thx @je5perl!

ePrivacy is probably the main reason why Whatsapp is more careful in the EU.

https://twitter.com/je5perl/status/1350232599499857921

https://twitter.com/WolfieChristl/status/1350391324432879616

(while the GDPR implements Article 8 of the EU fundamental rights charter and generally protects the rights+freedoms of people when personal data is being processed, ePrivacy basically implements Article 7 and specifically protects the confidentiality of electronic communication)

Btw. @thezedwards pointed to Wit, Facebook's voice/speech recognition subsidiary, which 'may' receive data from Whatsapp and other FB companies for 'business purposes that help us provide you with an innovative, relevant, consistent, and safe experience':

https://twitter.com/thezedwards/status/1350251303071465475