WhatsApp’s nightmare week has continued to get worse—a backlash against the scale of its data collection quickly followed by its sudden forcing of new terms of service on its users to share their data with Facebook. Agree to this now or delete your account, it has said. And so, as many users look for alternatives, should you do the same?
WhatsApp has a serious issue—one that hit home hard in the last week. The world’s leading messaging platform claims security and privacy are in its DNA, but it is owned by the world’s most avaricious data harvesting machine. Now this WhatsApp balancing act has just become much harder, as it finds itself threatening users with deleted accounts unless they accept new terms that take effect on February 8.
The inevitable backlash prompted WhatsApp boss Will Cathcart to take to Twitter to set the record straight. The risk for WhatsApp, though, is that defending its awkward relationship with Facebook is a high-risk bubble that may have just burst. And millions of users around the world are now looking at alternatives.
In reality, WhatsApp has had this Facebook issue ever since the social media giant acquired the messaging app back in 2014. So, what has suddenly changed?
If you’ve been following the story over the last month, it will all seem to have started with Apple’s introduction of mandatory privacy labels. Facebook has been the most vocal critic of Apple’s new privacy measures. But everyone knows that Facebook is a data machine. WhatsApp, which was arguably hit harder by these privacy labels, complained that its data collection was misrepresented, and that Apple’s own iMessage was not subject to the same scrutiny, which was unfair.
Be careful what you wish for, as I commented last week. After WhatsApp complained, Apple published iMessage’s privacy labels—almost as if it had been choreographed. The contrast was stark. WhatsApp’s metadata went much further than iMessage, all of it was linked back to a user and device identity, all those security reporters and protesters that had raised concerns over WhatsApp metadata appeared vindicated.
iMessage Vs WhatsAppApple App Store ‘Privacy Labels’
WhatsApp continued to defend its data privacy—attesting that little was shared with Facebook, that the labelling overlooked its security measures, that all the data was needed to operate a platform serving 2 billion users and 100 billion daily messages. Somewhat missing the point, WhatsApp also suggested that its commercial services and its plans for shopping made comparisons with iMessage unfair.
But the seeds for this latest backlash were actually sown earlier, back in October, when WhatsApp confirmed those shopping plans. Everything that has now prompted such angst was evident back then, including data linkages and WhatsApp messages between consumers and businesses potentially hosted by Facebook. All of this, WhatsApp said at the time, would enable it to “continue building a business of our own, while we provide and expand free end-to-end encrypted text, video and voice calling.”
And this is the crux. WhatsApp is free. But now the price we need to pay for that free service is becoming clear. “Has Facebook finally broken WhatsApp,” I asked back then, when it was already clear that this risk “radical” change to WhatsApp was in train.
And so back to this week. Whether a case of woeful timing or an attempt to get all the bad news out at once, WhatsApp followed the privacy label debacle with the controversial implementation of its forced change in its terms of service. Again, this has been on the cards since last year. And, critically, it has been largely misunderstood.
This isn’t about WhatsApp sharing any more of your general data with Facebook than it does already, this is about using your data and your engagement with its platform to enable shopping and other business services, to provide a platform where businesses can communicate with you and sell to you, all for a price they will pay to WhatsApp. It’s also important to note that there are differences in Europe in what WhatApp can do, given GDPR. WhatsApp does not share data for its European users with Facebook for the enhancement of its products and services—that hasn’t changed.
“As we announced in October,” a WhatsApp spokesperson told me, “WhatsApp wants to make it easier for people to both make a purchase and get help from a business directly on WhatsApp.” But the combination of the words Facebook and data is a red rag to the media, and the backlash has quickly intensified. The fact that the changed terms of service were mandatory, that users would need to accept the change or lose their accounts, made headlines globally and caused a viral stir on social media.
And then Elon Musk stepped in.
The primary beneficiary from WhatsApp’s nightmare week has been Signal, a smaller but more secure alternative. I’ve long advocated for Signal, which has managed to combine the usability of WhatsApp without the same holes in its security and data practices. Signal even offers genuine multi-device access, unlike its larger rival.
“This was inevitable,” says security researcher Sean Wright. “There’s a reason why Facebook bought WhatsApp, I am really surprised that it has taken this long to do it. It’s interesting to see the volume of people appearing to be switching to Signal. And this is a good thing, it means there are alternatives. Personally, after past actions from the likes of Facebook, it’s going to take a lot for them to restore my confidence in them regarding my privacy. I’d much rather use something such as Signal instead. The challenge however is getting others with whom you communicate to switch as well.”
Signal installs have been flying in recent days, and such is the viral nature of messaging that each of those new users will likely attract others. Signal’s marketing doesn’t need to go much further than we’re not Facebook, in reality, WhatsApp has actually been doing the marketing for its rival these past few days. WhatsApp even uses Signal’s own protocol for its encryption, albeit it has a proprietary version of this which is not open-source, unlike Signal itself which shares everything to enable the open-source community to find and report bugs and vulnerabilities.
And so, should you stop using WhatsApp? The short answer is no, nothing has really changed. WhatsApp’s data sharing hasn’t really changed, its security hasn’t changed, it remains the largest end-to-end encrypted platform available, and one that’s likely be used by all those you communicate with. WhatsApp is materially better than SMS and Facebook Messenger, its mainstream alternatives, it is secure cross-platform unlike iMessage, and it’s end-to-end encrypted by default, unlike Telegram.
That’s the short answer. The longer answer is more complicated. WhatsApp has turned a long-expected corner, it is now embarking on a journey to better monetize its users. But while your messages are secure, protected from prying eyes (while that level of encryption is allowed by governments worldwide), your data could become fair game as the platform builds its commercial offerings and risks falling to the temptation that data might provide as it looks to accelerate those revenue models.
As ESET’s Jake Moore points out, “privacy focused apps are the flavor of 2021, but the small print has often been missed. Unfortunately, being told that an app is unavailable unless you agree may not be best. It is inevitable that we will see people move away from these apps to those that better protect our data.”
WhatsApp’s response to Apple’s privacy labels should not have been to defend its data collection—Signal, iMessage and others manage to operate without linking all that data back to their users. WhatsApp should have accepted that its data collection is out of step with other secure messengers and changed its practices.
WhatsApp needs to decide whether its priority is commercializing or securing its userbase. For a time at least this week, Signal found itself going head to head for installs with Facebook, beating Messenger and with just WhatsApp to catch. But, the reality is that WhatsApp can afford to lose millions of concerned users as a trade-off to its commercial plans, knowing that it will retain the vast, indifferent majority.
January 9, 2021Apple App Store
“I get the ire of people that hate that WhatsApp being a Facebook asset is now being brought seemingly under its rod of monetization through data sharing and targeted advertising,” says cybersecurity analyst Mike Thompson. “But who knows what normal users out there are thinking. No one asks them and so they will continue to use WhatsApp and Facebook Messenger and life will go on. People will have more of their personal data utilized in monetization campaigns as the Earth continues to rotate.”
And so, for those of you weighing up the decision as to what you do next, here’s my advice. First, regardless of the specific changes being implemented, there are no short term risks. You can take your time. But this is clearly the new direction for WhatsApp, running counter to promises it has made in years gone by to keep the platform commercial-free. If you value secure messaging above all, this is a good time to play with alternatives—you’ll find many of your contacts now doing the same.
Second, there is a longer-term aspiration on Facebook’s part to fully integrate the backends of WhatsApp, Messenger and Instagram—and while there are questions around WhatsApp’s data, the privacy labels for the other two are shockingly bad. And so whatever your view on this current change to WhatsApp, you’d be brave to bet against further changes in the future. It comes down to those competing priorities—are you Facebook’s customer or are you its product.
The Facebook FactorApple App Store ‘Privacy Labels’
Ultimately, once the dust has settled on this week, the question will remain as to whether this is the beginning of the end for the simple messenger Facebook acquired all those years ago. Has the data giant made a decision to take WhatsApp down a different path, step by step, until it aligns with the rest of its empire. If so, all those fears from 2014 will have been proven true.
