In a letter, Consumer Protection Bureau director Jessica Rich told Facebook and WhatsApp that the agency will hold the Facebook to the letter of the law and to its own statements saying that it would not change WhatsApp policies against collecting and sharing personal data with advertisers. WhatsApp's privacy policies were a key draw for many of its original users.
“We want to make clear that, regardless of the acquisition, WhatsApp must continue to honor these promises to consumers," Rich wrote. "Further, if the acquisition is completed and WhatsApp fails to honor these promises, both companies could be in violation of Section 5 of the Federal Trade Commission (FTC) Act and, potentially, the FTC’s order against Facebook."
In 2012, Facebook agreed to 20 years of privacy audits after the FTC said the firm "deceived" customers by publicly sharing information that it had promised would remain private. Those actions, along with others, have earned Facebook a bad reputation among privacy advocates -- and close scrutiny from consumers on the issue of privacy.
Last month, leading privacy advocates from the Electronic Privacy Information Center (EPIC) and the Center for Digital Democracy filed a complaint with the FTC saying the firms would be unlikely or unable to keep promises that WhatsApp's privacy policies would remain completely intact even after the acquisition.
"Our complaint urges the FTC to investigate whether there are sufficient privacy protections in place to continue to shield the data of WhatsApp users from access by Facebook—which (for many users) was the very feature that made WhatsApp so appealing in the first place," the groups wrote in their March complaint.
In a statement, Center for Digital Democracy director Jeffrey Chester said, "The FTC is to be commended for sending a very strong signal that they will hold Facebook and Whatsapp accountable for their promises. The commission's action has likely spoiled, for now, the plans Facebook has developed to turn its $19 billion into even more digital gold for themselves."
The letter from Rich makes clear that the public statements Facebook and WhatsApp made promising to keep the messaging service's privacy policies as they were before the deal constitute "clear promises" to the public about what they will -- or will not -- do with WhatsApp consumer data in the future.
Before changing any WhatsApp privacy practices in the future, she said, Facebook must get "affirmative consent" from users to make substantial changes and not misrepresent how it collects or uses the data. And, if the company does choose to make changes to how it deals with data, Rich said that the FTC recommends "that you offer consumers an opportunity to opt out of such changes" or at least make it clear that users can stop using WhatsApp.
"We're pleased the FTC has completed its review and cleared our acquisition of WhatsApp," said a Facebook spokeswoman in a statement.