WhatsApp faces consumer groups’ complaint over new privacy policy

Several consumer organisations have launched a complaint against WhatsApp, accusing the messaging app of unduly pressuring users to accept its new privacy policy without explaining its consequences for personal data.

The European Consumer Organisation (BEUC) and eight of its members filed a complaint against WhatsApp on Monday (12 July) for “unfairly pressuring users to accept its new policies”, according to an official statement.

The consumer organisations point to the built-in notifications that the messaging app has been sending to its users, asking them to accept its updated privacy policy.

“WhatsApp has been bombarding users for months with aggressive and persistent pop-up messages to force them to accept its new terms of use and privacy policy,” said BEUC Director General Monique Goyens.

“They’ve been telling users that their access to their app will be cut off if they do not accept the new terms. Yet consumers don’t know what they are actually accepting.”

Updated privacy policy

According to the consumer organisations, WhatsApp has violated the EU Unfair Commercial Practices Directive by deploying an aggressive commercial practice. The complaint deems the notifications ‘persistent’ and ‘intrusive’, orchestrated with such a frequency as to put undue pressure on users, thereby limiting their freedom of choice.

The second aspect of the complaint points to an alleged lack of clarity in the change of privacy policy. BEUC and its members deem that the messaging service did not explain to users what the policy update would entail for their personal data in an understandable way, and gave the false impression that without their approval the app functionalities would be limited.

“WhatsApp has been deliberately vague about this and consumers would be exposed to far-reaching data processing without valid consent. That’s why we’re calling on the authorities to take swift action against WhatsApp to ensure that it respects consumer rights,” Goyens added.

WhatsApp, however, rejected the accusation that its new privacy policy was not sufficiently explained, pointing to a statement and FAQs published on its website. According to the messaging service, the updated privacy policy in fact provides more information to users.

“BEUC’s action is based on a misunderstanding of the purpose and effect of the update to our terms of service. Our recent update explains the options people have to message a business on WhatsApp and provides further transparency about how we collect and use data,” a WhatsApp spokesperson told EURACTIV.

Data protection scrutiny

The associations view WhatsApp as having failed to explain the privacy implications of personal data transfers to Facebook and other third parties, violating the EU Unfair Contract Terms Directive. WhatsApp’s updated privacy policy is currently also being investigated by the Hamburg Commissioner for Data Protection and Freedom of Information.

The German privacy watchdog issued on 11 May an order to WhatsApp to stop applying its new terms and conditions in the processing of personal data.

The Hamburg Data Protection Authority (DPA) considered the new privacy policy as giving the service too much power over personal data and the way in which it could be shared with Facebook, WhatsApp’s parent company.

The DPA also said the new provisions were misleading and unclear in defining the consequences of users’ approval for their privacy.

“The update does not expand our ability to share data with Facebook, and does not impact the privacy of your messages with friends or family, wherever they are in the world. We would welcome an opportunity to explain the update to BEUC to clarify what it means for people,” the WhatsApp spokesperson added.

The messaging service also pointed to the fact that personal communications will continue to be protected by its end-to-end encryption, a technology that ensures the privacy and integrity of the messages between the sender and receiver.

The DPA’s order was based on the urgency provisions of the General Data Protection Regulation (GDPR), which have a limited time application of three months. The emergency procedure was then brought to the attention of the European Data Protection Board (EDPB), which is expected to issue a binding decision in the coming weeks.

Consequences of the complaint

Since January 2020, BEUC and other umbrella organisations have been designated under the Consumer Protection Cooperation Regulation as bodies entitled to file complaints about cases of EU-wide infringements affecting consumers.

These infringements are brought to the attention of national consumer protection authorities in the EU and of the European Commission, through these complaints, called ‘external alerts’. BEUC now expects consumer authorities to launch an investigation into WhatsApp’s practices to ensure that it respects EU law and consumer rights.

BEUC has also recently launched external alerts against TikTok, Nintendo and airlines in the context of the pandemic.

[Edited by Molly Killeen/Zoran Radosavljevic]

Read more with EURACTIV

Digital Brief: ePrivacy derogation adopted, YouTube’s algorithm, killer acquisitions