Facebook-owned messaging platform WhatsApp is facing yet another backlash in India as it goes ahead with its new privacy policy update.
WhatsApp, which has 530 million users in India, plans to roll out the policy from May 15, 2021. Several cases are pending in various courts in the country against the company’s policy.
The new policy should originally have come into effect on February 8, 2021, but was postponed till May following widespread protests. This also led to WhatsApp’s peers, Signal and Telegram, gaining users overnight.
As WhatsApp pushes its policy again, it has come under the radar of India's competition watchdog, the Competition Commission of India (CCI).
What did CCI do?
The CCI, on March 24, 2021, took suo motu cognizance of the new WhatsApp privacy policy and have asked the Director General to investigate it within 60 days for abuse of dominance.
What does the policy say?
According to WhatsApp, the new privacy policy is aimed at easing doing business on the platform, where users can “message businesses, ask questions, make purchases and get information.”
The company also states that users have the choice to block or remove them from contact list.
On the other hand, if users like to do business on WhatsApp, they can use Facebook as a technology provider to respond to user queries. “We will clearly label chats to make you aware when that happens,” the policy update says.
The messaging platform will tell the users, how they collect, share and use data. The policy update states that WhatsApp or Facebook cannot read personal chats.
How is this new update intrusive?
The platform collects more data about the users automatically and also through third parties.
For instance, it will have access to user location if they share data with their friends on WhatsApp. So, even if the message is encrypted, WhatsApp can track your whereabouts.
In addition, the policy says the company will collect payment information if you are transacting through WhatsApp pay. “If you use our payment services, or use our Services meant for purchases or other financial transactions, we process additional information about you, including payment account and transaction information. Payment account and transaction information include information needed to complete the transaction (for example, information about your payment method, shipping details and transaction amount),” the policy update says.
However, users cannot opt out of the update.
Is that why CCI is investigating the case?
In part, yes. In its 21-page order, the competition watchdog compared the latest update with the changes in 2016 when WhatsApp expanded its data collection from users.
The competition watchdog noted that in 2016, it allowed users to opt out of sharing their WhatsApp account information with other Facebook companies. The company will continue to honour that.
However, that does not seem to be the case in 2021. The CCI is of the view that WhatsApp’s new policy “seems to emanate out of the entrenched dominant position of WhatsApp in the said relevant market (India).”
The order has also pointed out that the platform’s dominance continues, despite newer players like Signal and Telegram gaining users since January. “The network effects working in favour of WhatsApp reinforces its position of strength and limits its substitutability with other functionally similar apps/platforms.”
So, by forcing users to accept updates, the CCI said: “It appears that consent to sharing and integration of user data with other Facebook companies for a range of purposes, including marketing and advertising, has been made a precondition for availing WhatsApp service.”
It further said that by making users “mandatorily agree to sharing of their personalised data by WhatsApp with Facebook companies”, the company is looking at collecting data that appears to be “unduly expansive and disproportionate”.
What does CCI mean by unduly expansive and disproportionate?
There is a vast amount of data the app collects automatically. Apart from location and payment data, it will capture the whole range of information, as is evident from the CCI report and also WhatsApp privacy update.
- Device information: mobile number, battery level, signal strength, mobile networking operator, language, time zone, IP address
- Usage information: profile photo, status information, whether the user is online/offline, duration and frequency of use and how they interact
- Track the location of users using IP address, phone number, and STD code.
- Cookies when WhatsApp web is used.
Third parties also can share information. Businesses that users interact with can share that information to WhatsApp or Facebook companies.
What is CCI’s take on WhatsApp capturing expansive user information?
The commission is of the view that users should be entitled to know about the extent of how their data would be used by WhatsApp, its scope and purpose. Right now, most of what is given is vague and too broad.
For instance, information on how users “interact with others (including businesses)” is not clearly defined. What would constitute “service-related information”, “mobile device information”, and “payments or business features” are also undefined.
“Such opacity, vagueness, open-endedness and incomplete disclosures hide the actual data cost that a user incurs for availing WhatsApp services,” the order said.
It is also not clear from the policy whether the historical data of users would be shared with Facebook companies. It is also not clear whether WhatsApp will share the data of users who are not using other apps of Facebook like Instagram.
What does the order say about data protection?
The CCI made an important point about the lowering of data protection standards and how that directly affects competition, especially when a single player commands a significant user base.
The app is, by far, one of the largest social networks. Based on user data shared by the government, WhatsApp has 530 million users in India. Including Facebook (410 million) and Instagram (210 million), it makes Facebook companies the largest player in the country.
YouTube, with 448 million users, is the second-largest.
Because of “network effect”, users are unable to shift to new platforms since their social circle has not moved. According to CCI, users’ loss of control over their personalised data “can be taken as reduction in quality under the antitrust law.”
What does lowering of data protection have to do with antitrust?
Data is the new oil. This essentially means that larger the database of a company, greater is its competitive advantage in the market.
The policy update allows third-party service providers that use WhatsApp for doing business to share data with Facebook companies.
So, when a dominant player like WhatsApp lowers data protection standards, it can lead to exploitation of consumer data.
This way, WhatsApp and Facebook would be able to further reinforce their leadership position. They can also use the information to further venture into related or even unrelated markets, say display advertising market. This could result in huge barriers for new entrants.
But the CCI has not made it clear whether anonymised data will also lead to competition concerns.
What is WhatsApp's response to all this?
This is how a WhatsApp spokesperson responded to the CCI probe: “We look forward to engaging with the CCI. WhatsApp remains committed to protecting people’s personal communications with end-to-end encryption and providing transparency about how these new optional business features work,”
On January 19, 2021, in a meeting, the Commission took suo motu cognizance of this issue and sought response from WhatsApp and Facebook the same day.
In its response on February 25, 2021, WhatsApp said that its primary aim of the 2021 update is two-fold:
- To provide users with further transparency about how WhatsApp collects, uses and shares data; and,
- to inform users about how optional business messaging features work when certain business messaging features become available to them.
It further said that the issue of data localisation and data sharing, which the CCI it is investigating, does not necessarily come under the purview of the Commission, based on the verdicts given in two separate cases in 2020.
Did Facebook have anything to say?
No. The social media major said in its response that Facebook and WhatsApp are two different legal entities, and, hence, it should not be added as a party to the investigation.
What happens now?
Obviously, the CCI is neither buying the ignorance feigned by Facebook, nor is it happy with the “take-it-or-leave-it” policy of WhatsApp.
According to the Commission, the manner in which WhatsApp is complying with it is unfair and it merits a detailed investigation in view of the dominant position enjoyed by WhatsApp.
What does it mean for users in the meantime?
Probably nothing, at least not until one of the courts pronounces a verdict.
There are cases filed in different Indian courts against the WhatsApp update since 2016. At the Delhi Court, the 2016 update was challenged by Karmanya Singh Sareen. The case is currently pending in the Supreme Court.
Recently, the Ministry of Electronics and Information Technology (MeitY) filed a counter-affidavit in the Delhi High Court, urging the court to block WhatsApp from rolling out its privacy policy update.
Discover the latest Business News, Sensex, and Nifty updates. Obtain Personal Finance insights, tax queries, and expert opinions on Moneycontrol or download the Moneycontrol App to stay updated!
