Embedded in WhatsApp’s new privacy policy is a competition issue

WhatsApp’s new privacy policy release caused a flutter and a massive out-migration to alternative apps like Signal and Telegram. The new policy has significant changes in privacy from previous policies. More importantly, it lays the ground for the consolidation of the Facebook group of companies into one integrated whole, and for a massive expansion of WhatsApp into the retail sector.

One major change that concerns users’ privacy is that WhatsApp will now collect some new metadata and hardware data. Metadata is data about data; the new metadata collected include time, frequency and duration of interactions, group names, pictures and descriptions, payments data, online status, last seen, general location, etc.

Also read: Know why WhatsApp’s new privacy policy should worry you

Earlier, this information was said to be available to ‘anyone who uses WhatsApp’s services’ and not necessarily to WhatsApp itself. The new hardware data being collected includes battery level and signal strength. Metadata and hardware data can be used for surveillance and profiling or triangulating individuals or targeted groups. Besides, all this data helps tremendously in targeted advertising by businesses. Importantly, the new privacy policy still preserves end-to-end encryption – WhatsApp or third parties cannot read your messages.

Facilitating targeted advertising

The other big change is that WhatsApp will now share your data with other Facebook companies and this data will be used by them to design their products and improve targeting. This is another major privacy concern because, previously, the user had the choice to opt out of such sharing. Now, that choice has been taken away – the policy presents itself as a take-it-or-leave-it idea of user consent to data sharing. In the European region, where the General Data Protection Regulation is in force, the policy is different – it still allows for sharing, but shared data cannot be used for the other Facebook companies’ own purposes. The takeaway here is that a strong privacy law can force large technology companies to limit at least the purposes for which they track user behaviour. The upcoming personal data protection bill in India must include similar purpose limitations and restrictions on sharing data with third parties.

Currently, the law has left it to users to vote on these policies with their feet. But there are several issues with this idea of consent. Users may not be aware of the privacy policy; they may not understand its import; they may not correctly compute the costs to society, believing this level of privacy to be adequate for their personal needs. Even if users were concerned at the erosion of their privacy, moving out of WhatsApp requires a critical mass: if everyone I want to talk to still uses WhatsApp, I cannot move out of it to another app. Whether the current outcry is enough to reach this critical mass is still an open question. A strong privacy law would ensure that such questions do not remain open – that platforms would have to comply with a minimum non-negotiable level of privacy.

More than just privacy

However, this data sharing is more than a privacy issue. Such sharing enables the further integration of the Facebook group companies. It will now become easier for businesses to sell and target users across the Facebook platforms, including WhatsApp, Instagram and Facebook itself. Since payments data will also be shared, one can expect the integration of payments systems across these platforms.

Also read: WhatsApp Pay now available in India in 10 regional languages after govt nod

Facebook has long expressed its intention to carry out such integration. It consolidates the power of its scale and scope as a business; behavioural data of people from multiple platforms can now be used together, giving Facebook a leg up over other companies that do not own comparable multiple platforms. This is a social media behemoth like no other and is openly anti-competitive. Further, deep integration of this kind makes any future separation or breaking up of the different Facebook businesses that much more difficult. A case will be made that separation is too costly due to all the integration. The plans for breaking up Big Tech, popularised by Elizabeth Warren, will be left with no teeth. Competition regulators worldwide did not stop the acquisition of WhatsApp by Facebook in 2014; perhaps they would do well today to halt further integration of these platforms if there is ever to be any hope of separating them to prevent monopolisation of communication platforms.

Preparing for a retail assault

The new privacy policy also prepares WhatsApp for its foray into retail. In April, Facebook invested about $5.7 billion in Reliance Jio for a 9.9% stake in the latter. A deal was made between Reliance Retail, Jio Platforms and WhatsApp to jointly use the capabilities of JioMart, Reliance’s grocery app, and WhatsApp. Jio Platforms is India’s biggest telecom operator, and WhatsApp is India’s most popular messaging app. WhatsApp’s privacy policy allows commercial messaging like delivery and shipping notifications, and has also included this line since at least July: “Messages you may receive containing marketing could include an offer for something that might interest you.” This is an indication that businesses can now engage in targeted advertising using WhatsApp data (or at least metadata). They can also engage in targeted advertising on WhatsApp using user data from other Facebook platforms because the new privacy policy provides for unique identifiers linking your accounts across WhatsApp and other Facebook platforms. WhatsApp still does not allow third-party banner ads, but seems to be offering direct targeting through messages.

Also read: COVID times: Your WhatsApp fact-checker just a text away

Given the Reliance deal and the plans of Reliance to bring millions of kirana stores online, many of these businesses that WhatsApp expects to interact with users will be kirana stores. Thus the policy allows for the creation of a ‘super app’ on the lines of WeChat – an app where you communicate as well as perform commercial transactions, with all data integrated, making profiling that much easier – and that much more vulnerable to surveillance. Further, with the expansion of WhatsApp-Jio as a retail platform and with no competitors to speak of, small shops will have no choice but to play by the platform’s rules. In the future, these rules may include commissions and other conditions of sale. A similar situation has arisen with Amazon in the US, where commissions are now about 30 per cent, and sellers on Amazon are unable to move to other platforms because of the hold Amazon has over a large part of the consumer market.

Jio and WhatsApp have already captured the consumer market – capturing the sellers’ market will not be too difficult for them.

Reliance and Facebook claimed that despite their deal, JioMart and WhatsApp would still be competitors – and the Competition Commission of India bought into this assertion. What this privacy policy heralds is not only a glaring disrespect for privacy, but also further consolidation – of WhatsApp with the other Facebook companies, of the capabilities of Facebook and Reliance, and of the retail sector in India. Competition regulators may do well to take another serious look at these obvious signs of monopolisation. These developments concern not only people’s privacy but also their bare minimum economic rights to fair market conditions.

(Jai Vipra is a Senior Resident Fellow at the Centre for Applied Law and Technology Research (ALTR), Vidhi Centre for Legal Policy).