Is WhatsApp safe to use? The confusing privacy policy explained.

A timeline of WhatsApp’s handling of their controversial Privacy Policy

According to WhatsApp's 2016 your metadata is already being shared with Facebook
Are your WhatsApp conversations safe?, Artwork by Arjun Manohar

In July 2020, WhatsApp had an update that allowed users to opt out of sharing data with their parent organisation, Facebook. But as of January 2021, the company seems to be reneging on this decision of theirs, essentially forcing users to comply with their new updated privacy policy or get blocked out of the platform. This new policy has three important changes. Starting with how WhatsApp processes your data, followed by, how businesses can use Facebook-hosted services to store and manage their WhatsApp chats, and finally, how WhatsApp will soon partner with Facebook to offer deeper integrations across all of Facebook's products. The policy goes on to say, “all users must comply with these updates by the 8th of February, in order to continue to use the platform.”

While this might be a bold call on Facebook’s part, especially in India where it has a staggering 400 million active users, in reality, I doubt they will lose much sleep over losing their market share. Sure, they might lose a small percentage of these users, but I reckon as time passes most people would just click “Accept” and go on pretending like nothing happened. This behaviour can best be explained by the bandwagon effect, which is nothing but the tendency of an individual to acquire a particular behaviour, follow or uptake certain beliefs, ideas, fads and trends because everyone else is doing it. The proportion of conviction of a certain topic is directly proportional to the amount of people following the topic. News cycles thrive on people falling prey to the bandwagon effect. Therefore, whilst this may be a hot topic now, pretty soon, it is going to cool down.

I know I am treading a fine line between pessimism and realism here, but I think there are much larger conversations to be had.

The Bigger Problem

Firstly, I’d like to address the monopolistic trade practices by Big Tech. Cliches aside, this is a very important issue and it's one that has caught the attention of the US Senate and the US Federal Trade Commission. They have accused the company of using predatory strategies to destroy their competition and snap up smaller rivals, all in the name of dominating the market share. According to Letitia James, the New-York Attorney General, the antitrust lawsuit filed against the company is a bid to block the predatory acquisition of companies and instil confidence back into the market. In order to comply, Facebook might have to part ways from their two biggest acquisitions yet, Instagram and WhatsApp. The former was purchased back in 2012 for a measly sum of $1 billion whilst the latter was purchased for a barely believable price of $19 billion dollars in 2014. For context, that was 50% more than GDP of Mauritius in 2014. Facebook responded by calling these actions by the government as “revisionist theories” designed to penalise successful businesses. Ironically, Facebook maintains that the customers are free to switch to any platform they like. Just one problem, there aren't any worthy alternatives to Instagram or WhatsApp in the market.

Secondly, let’s discuss the current state of events, the updated privacy policy. This update by and large only affects countries where there aren’t any strict laws protecting the data and privacy of its citizens, like GDPR (which is the rest of the world minus the European Union). In fact, Facebook cannot compel WhatsApp users living in the EU to forcefully share their WhatsApp data with them. This begs the question: Does having well defined and strict laws designed to safeguard the privacy of an individual stop these companies from creating such invasive privacy policies? The answer is yes. I think it's time every nation drafted up their own version of GDPR to protect how citizens’ data is being processed and shared. Laws such as these, provides users the much needed confidence, control and legal protection against how online services use their data.

Nations looking to create such laws, need not start from scratch. Both the EU's GDPR and California’s CCPA provide excellent reference points for anyone looking to draft their own versions. Sure, they would need to contextualise the intricacies of their local laws and cultural differences of their respective nations, and this would naturally take some time. But it is a conversation we ought to be having seeing how the world is becoming increasingly digital. From a consumers point of view, it is a matter of choice. A choice that enables us to control what data we’d like to share and with whom.

Misunderstood Public Outcry

Although the following changes to WhatsApp’s privacy policy doesn’t really look good for Facebook’s “Privacy Focused Vision”, I honestly believe a lot of the public outcry has been rather misinformed.

According to WhatsApp's 2016 update, they have already been sharing metadata (like account information, phone number, how long you use the app, device details like IP address, operating system, browser details, battery health information, app version, mobile network, language and time zone) with Facebook since 2016. Therefore the new update can be summarised as a simple copy change at the very best. To be absolutely clear, your personal chat information, like messages and photos are end-to-end encrypted. Those exist on your phone’s local memory or cloud and remain encrypted. To that extent, Matthew Green, a cryptographer at John Hopkins University, said it best, “WhatsApp is great for protecting the privacy of your message content, but it feels like the privacy of everything else you do is up for grabs."

So, what then is changing? According to WhatsApp the new updates affect those who run their business on WhatsApp. They claim these updates provide further transparency on how businesses collect and use data on the platform. Their rationale is that, more and more people will start buying things directly out of WhatsApp in the years to come. In fact in India, the company has expressed interest into entering the Indian UPI (Unified Payment Interface) market through WhatsApp Pay. The only problem is that business accounts represent a very small fraction of their 2 billion user base. So why then is WhatsApp making it mandatory for all users (personal and business) to share their data with Facebook? The answer to this question is something WhatsApp and Facebook have yet to address.

The Rise of Signal

Now, it would be remiss on my part if I were to conclude this article without mentioning Signal, so I shan’t. For those who haven’t been keeping up with the times, the following image speaks volumes for itself.

Elon Musk’s Tweet retweeted by Edward Snowden asking users to switch to Signal Messaging App
Edward Snowden retweeting Elon’s Tweet Asking people to switch to Signal over WhatsApp, Source: Twitter

Never has the power of social proofing been this obvious. Shortly after Elon’s tweet and Edward Snowden’s retweet, Signal was downloaded 7.5 million times globally between January 6th and 11th (according to a report by CNBC based on data compiled by Sensor Tower).

Google Search Trend for people searching for Signal after Elon Musk’s Tweet
Spike in people searching for “Signal” after Elon’s Tweet, Source: Google Trends

Psychologically speaking, this spike makes a tonne of sense. We humans tend to follow the actions of others when we are unable to determine what is the correct course of action. This behaviour is largely driven by our assumption that the people surrounding us seem to have a better understanding of the situation. Social proof is one small part of our conformist tendency as human beings (commonly known as herd mentality). Therefore, people succumbing to social proof is nothing but a rational move on their part in order to act on the limited information provided to them. Whilst this is not always a good thing, in the case of switching to Signal, there is some substance.

Here’s why. Signal like WhatsApp uses the same end-to-end encryption algorithm to secure chats. But where it differs is in the data it collects from its users. In light of recents events Signal took to Reddit to explain the same in a picture that speaks a thousand words. Literally.

Data collected by Signal versus WhatsApp, iMessage and Facebook Messenger
Data collected by Signal versus other messaging platforms, Source: Reddit

Since Signal is its own entity, they do not need to share users data to any parent organisations. Plus if the app is designed to make communication safer, the fewer back channels to parse data back and forth, the lesser is the chance of the system being susceptible to attacks. Simple… isn’t it?

Concluding with a Behavioral Economics Perspective

To conclude, I think we are reaching the end of this news cycle and this sudden surge in users shifting to Signal, Telegram or Discord will soon die down. This is because of a psychological phenomenon called status quo bias. This bias refers to people’s preference for the current state of affairs to remain unaltered. We tend to stick to choices that are familiar to us because they have worked well in the past. We tend to overlook any problems that may disrupt this status quo. In the case of WhatsApp, it's the time and effort required to switch platforms and the effort that will go in convincing your friends to make the switch with you.

Another reason why people may stick with WhatsApp can be explained through the concept of bounded rationality. This phrase was originally coined by Herbert Simon, who said

“Rationality is bounded because there are limits to our thinking capacity, available information and time.” - Herbert Simon

In the case of WhatsApp, the deadline of February 8th puts a definite timeline on us to decide whether or not we should stick with the platform or leave it. As this date is fast approaching and since the current information available is neither conclusive nor reliable, making an informed decision becomes infinitely difficult.

Finally, there will be a plethora of new messaging apps, all rising up to capitalise on WhatsApp potential downfall. This will lead to a choice overload which in turn will force users to revert to the status quo, i.e. WhatsApp.

But if I am being honest here, and this is just a personal observation. I doubt I will stop using WhatsApp completely, because it took the better part of 5 years for my folks to get acclimated to any kind of instant messaging. The number of hours I have invested in tutoring, guiding and helping them is just inadmissible (I am quite certain you can find this situation relatable). So yes, for that reason alone, I do not see myself deleting WhatsApp but I am definitely considering using it less.

Written by Arjun Manohar