EU Commission requires WhatsApp to clarify how it processes personal data

Messaging app WhatsApp has been requested to provide more information on its data processing practices. [guteksk7/Shutterstock]

The European Commission sent a letter to WhatsApp on Thursday (27 January) asking how its new privacy policy meets the EU consumer protection requirements and clarifications on the exchanges of personal data with the parent company Meta.

The letter results from a complaint filed by the European Consumer Organisation (BEUC) with eight of its members in July. The consumer organisations considered the messaging app unfairly pressured consumers with aggressive pop-ups to accept its new terms without adequately explaining how their personal data would be processed.

“WhatsApp must ensure that users understand what they agree to and how their personal data is used, in particular where it is shared with business partners,” said justice commissioner Didier Reynders. “I expect from WhatsApp to fully comply with EU rules that protect consumers and their privacy.”

WhatsApp faces consumer groups’ complaint over new privacy policy

Several consumer organisations have launched a complaint against WhatsApp, accusing the messaging app of unduly pressuring users to accept its new privacy policy without explaining its consequences for personal data.

WhatsApp, for its part, rebuts that it reorganised and added more detail to its privacy policy following the direction of the Irish Data Protection Commissioner in November 2021, four months after BEUC filed the complaint.

Still, the European Commission and the national consumer authorities deemed the complaint worth investigating further and officially launched a regulatory dialogue requesting WhatsApp to provide more information by the end of February.

“We look forward to explaining to the European Commission how we protect our users’ privacy in compliance with our obligations under EU law,” a WhatsApp spokesperson told EURACTIV.

WhatsApp will have to illustrate whether it provided sufficient information to the consumer to properly understand the new terms and the potential consequences for accepting or refusing them.

The in-app notifications prompting users to accept the new terms are also questioned, as the company is accused of unfairly putting pressure on users into accepting the privacy policy.

“We expect WhatsApp to clarify and amend its policies in full respect of consumers’ rights, including for those consumers who agreed to the new terms due to the company’s unfair practices,” said BEUC deputy director-general Ursula Pachl.

If the commercial practice is considered too aggressive, it will violate the EU Unfair Commercial Practices Directive.

Similar provisions have also been included in the EU Parliament’s version of the Digital Services Act (DSA), which is currently an object of interinstitutional negotiations. The new Article 13a concerns dark pattern, an interface designed to trick or pressure the users into something they do not want, focusing on obtaining consent for data processing practices.

Perhaps even more disruptive for WhatsApp, regulators are also trying to shed light on how the app is sharing personal data with its parent company Meta, formerly known as Facebook, as well as other third parties.

The data-sharing between WhatsApp and Facebook has been a point of concern for regulators ever since the social network took over the messaging service in 2014.

In case WhatsApp clarifications do not dissipate the raised concerns, the letter might be just the first step of a formal procedure under EU consumer law.

BEUC presented the complaint in the context of the Consumer Protection Cooperation Network, which since January 2020 allows designated entities to issue alerts about emerging market threats.

[Edited by Nathalie Weatherald]

Subscribe to our newsletters