WhatsApp’s New Privacy Policy Just Kicked In. Here’s What You Need to Know

[Karlston]

WhatsApp’s New Privacy Policy Just Kicked In. Here’s What You Need to Know

Instead of a hard cutoff, the messaging app will gradually degrade and eventually cease to function if you don’t accept the changes.

WhatsApp's been sharing account data with Facebook since 2016—which came as a surprise to many of its users.Photograph: John Lamparski/Getty Images

 

At the beginning of the year, WhatsApp took the seemingly mundane step of updating its terms of use and privacy policy, mostly focused on the app's business offerings. The changes sparked a major backlash, though, because they inadvertently highlighted WhatsApp's years-old policy of sharing certain user data, like phone numbers, with parent company Facebook. Rather than change the policy that sparked the controversy, WhatsApp instead moved the deadline for users to accept it from the original date of February 8 to Saturday. If you don't? WhatsApp will become unusable.

 

But not all at once. If you haven't accepted the new policy by now, you'll start to see more pop-ups in WhatsApp outlining the changes with a big green Accept button at the bottom. If you tap it, WhatsApp will continue to share certain account data of yours with Facebook. If you'd rather not agree, you'll at first be able to hit a back arrow in the upper left corner of the overlay. Over time, though, the pop-ups will appear more frequently. Eventually you won't be able to click away at all, and the app's functionality will start to degrade. 

 

WhatsApp originally indicated in February that anyone who declined the updates would immediately lose functionality. But the company has since opted to let the wheels very gradually come off the car over several weeks before the app careens into a ditch and stops working altogether.

 

“For the last several weeks we've displayed a notification in WhatsApp providing more information about the update,” the company said in a statement. “After giving everyone time to review, we're continuing to remind those who haven’t had the chance to do so to review and accept. After a period of several weeks, the reminder people receive will eventually become persistent.”

 

Once you reach the point that WhatsApp has plastered its policy notification atop its interface, you'll still be able to use the app in some capacity for a time. You'll be able to field incoming calls, for instance, and if you have notifications turned on you can read and respond to messages that way. But you won't be able to see your chat list or initiate contact of any kind with WhatsApp friends, because again, a privacy policy update will be blocking your path. After a few weeks of that stunted experience, WhatsApp will fully pull the plug, and you won't even get calls or messages anymore.

 

The reality is that for most users, accepting the privacy policy changes won't impact their interactions with WhatsApp very much. All communications on WhatsApp will still be end-to-end encrypted by default, meaning that your messages and photos will still only be viewable by you and the users you're chatting with. And WhatsApp still won't be able to access any of your communications or share them with Facebook. Meanwhile, WhatsApp will be able to share user account information like your phone number, logs of how long and how often you use WhatsApp, device identifiers, IP addresses, and other details about your device with Facebook. Plus, WhatsApp can share transaction and payment data, cookies, and location information with Facebook if you grant permission. All of which has been true since 2016.

 

The strength of the backlash likely caught WhatsApp off-guard, given that it reminded users of an existing policy rather than creating a new one. Mere days after WhatsApp first announced the changes on January 4, the messaging app Telegram said it had gained tens of millions of users, and Signal boasted “unprecedented” growth. In an attempt to staunch the bleeding, WhatsApp delayed the full rollout of the new policies for months so users would have more time to learn about the changes. 

 

“We've spent the last few months communicating directly with users about our update,” a spokesperson told WIRED in a statement. “The majority of people have already accepted the update, and for anyone who hasn't, we won't be deleting their account on May 15 and we'll be giving plenty of opportunities for them to review the update in the future. We know WhatsApp is a lifeline for many people around the world.”

 

There's still the matter, though, of the lengths WhatsApp has had to go to to carry off this routine policy update. “When your users have made it clear that they would rather not accept a new policy, and your response is to very gradually push them out of an airlock, it doesn't prove that they're happy about it just because they eventually accept," says Johns Hopkins University cryptographer Matthew Green.

 

The other option would be to sever those connections with Facebook, but after years of sharing certain account data, both organizations likely consider rolling back the 2016 change as either inconceivable or intolerable. Or both.

 

The gradual removal of features is unusual, says Whitney Merrill, a privacy and data protection lawyer and former Federal Trade Commission attorney. But other companies go even further, she says, locking users out altogether until they accept a new policy. “In a way this is more friendly,” Merrill says. From WhatsApp's perspective, the slow burn gives users more chances to accept and keep using the app rather than being shut out and defecting to competitors for good.

 

"WhatsApp is being relied on more than ever right now and we want to keep it that way,” the spokesperson told WIRED.

 

Merrill points out though, that WhatsApp is in this situation in the first place because users clearly didn't understand the privacy policy changes the company made back in 2016. “If you don’t give users a good, clear notice when you make a change, people freak out whenever it’s eventually communicated properly,” she says. "This is why simple, easy-to-read policies go a long way, as do updates that include a summary of the major changes."

 

For WhatsApp, that bill from its 2016 privacy policy changes came due this year. Holdouts who steadfastly refuse to accept the new policy in the weeks to come will have 120 days after their accounts becomes inactive to reconsider. After that, the protracted, conscious uncoupling will really be over.

 

 

WhatsApp’s New Privacy Policy Just Kicked In. Here’s What You Need to Know (may require free registration)