An information-privacy nonprofit is asking the Federal Trade Commission to investigate and possibly even block Facebook’s $19 billion acquisition of the wildly popular messaging service WhatsApp.
The complaint comes from the Electronic Privacy Information Center, a Washington, D.C.-based research group that has also filed complaints in the past over things like Google’s acquisition of the ad service Doubleclick, Microsoft Passport, and changes to Facebook’s privacy policies.
EPIC’s complaint about the Facebook/WhatsApp acquisition alleges that WhatsApp has made data-privacy promises to users that it will be unable and/or unlikely to keep now that it’s owned by Facebook. Julia Horwitz, EPIC’s lead lawyer on the case, told me via email:
WhatsApp users rely on WhatsApp to maintain the privacy of their communications. Facebook has a proven record of collecting user data form companies that it acquires. So users are worrying about what happens to their data now that Facebook and WhatsApp have announced the deal. Our complaint urges the FTC to investigate whether there are sufficient privacy protections in place to continue to shield the data of WhatsApp users from access by Facebook—which (for many users) was the very feature that made WhatsApp so appealing in the first place.
The complaint asks the FTC to investigate WhatsApp and block the Facebook deal until the issues it raises are resolved. If the deal does go forward, EPIC further asks that the FTC to “order Facebook to insulate WhatsApp users’ information from access by Facebook’s data collection practices.”
Note that this is not a lawsuit—just a complaint filed with the FTC, with the same legal standing as any complaint an individual consumer might file about a company’s trade practices.
EPIC notes that the FTC has “responded favorably” to several of its complaints in the past. That said, the FTC did approve Google’s Doubleclick acquisition over EPIC’s privacy objections. And generally speaking, mergers and acquisitions are reviewed for their effects on competition, not consumer privacy. It would therefore be unusal for deal like this to be a blocked on privacy grounds.
The FTC does, however, have the authority to bring a suit against a company for unfair or deceptive trade practices, under the Federal Trade Commission Act. Typically the FTC will not confirm or deny its investigations until they’re over, and sometimes not even then if it decides not to bring a case.
Facebook has insisted in the wake of the deal that it will leave WhatsApp alone, at least for the time being. And Facebook chief Mark Zuckerberg says he has no plans to bring ads to the messaging service. Still, critics point out that privacy was one of WhatsApp’s biggest selling points, whereas Facebook makes billions by mining its users’ data. Some WhatsApp users simply don’t trust Facebook to keep its hands off their messages.
As communications scholar and privacy blogger Nicholas John has pointed out, WhatsApp’s terms of service clarify that they don’t keep the contents of your messages: “Once a message has been delivered, it no longer resides on our servers,” the terms say. “The contents of any delivered messages are not kept or retained by WhatsApp.” But they do keep your metadata: "WhatsApp may retain date and time stamp information associated with successfully delivered messages and the mobile phone numbers involved in the messages, as well as any other information which WhatsApp is legally compelled to collect."
John speculates that Facebook could use that information to figure out which of your friends you’re genuinely close to. That could be a big asset in the company’s quest to build the world’s most comprehensive social graph.
Asked for comment on the complaint, a Facebook spokesperson sent me the following statement:
Facebook's goal is to bring more connectivity and utility to the world by delivering core internet services efficiently and affordably—this partnership will help make that happen. As we have said repeatedly, Whatsapp will operate as a separate company and will honor its commitments to privacy and security.