WhatsApp controversy reveals data privacy fears

Millions of digital messenger app users seem to have scrambled for alternative services in the last week, after Facebook-owned WhatsApp announced changes to its privacy policy. The reaction highlights a growing concern — and lack of clarity — among users around data privacy. 

According to the mobile app analytics firm Sensor Tower, WhatsApp competitor Signal saw 17.8 million downloads between January 5 and January 12, up from just 285,000 the previous week. Fellow messenger app Telegram saw 15.7 million downloads during the same period, over twice the 7.6 million downloads it saw the week before. Many also flocked to the lesser known Threema, a paid messenger app that caters largely to German-speaking countries, where sensitivity to data protection is high. 

"The downloads are going through the roof," Threema's head of Marketing & Sales, Roman Flepp, told DW. "Last week we recorded 10 times more daily downloads than on a regular day. So we are now talking about hundreds of thousand new users each day. That's a lot."

User confusion abounds

Meanwhile, downloads of WhatsApp dropped to 10.6 million, down from 12.7 million the week before. It prompted WhatsApp to issue a clarification, later going as far as to announce they would delay the updates until May 15. 

"I'm not surprised that the people don't really know what they should additionally consent to compared to the things that they were consenting before," European Data Protection Supervisor Wojciech Wiewiorowski told DW. WhatsApp's announcement to its users was "extremely short" and "trivial," he said. 

"Since people are aware of the concentration of the market, and the fact that there are fewer and fewer companies which are actually having more and more control over the information online, the situation with the sharing of the data between services is creating some doubt for the users," he said.

In early January, WhatsApp users received a pop-up message announcing updates to the app's privacy policy. A closer look revealed that all accounts that did not consent to the new terms by the February 8 deadline would be suspended or deleted.

Confusion followed.  The update was unclear for many, and a reference to Facebook had users fearing that the contents of their messages would be shared with the social media giant. Facebook has had near-constant bad press for its shoddy data privacy practices. The negative reaction prompted WhatsApp to issue a clarification and delay the changes until May. 

'Data is the gold of our time'

Despite the three-month delay, the intended update is to remain the same. 

The changes are necessary to allow users to message businesses through WhatsApp, the company said in a statement. The updates primarily concern businesses that host shops on Facebook and communicate with users through WhatsApp. The new rules clarify that communications with these businesses may be hosted on Facebook's servers.

This "is probably the first step to monetize and get a return from the incredible investment they did in 2014 when Facebook bought WhatsApp," said Threema's Flepp. "As we all know, user data is the gold of our time. I think that that's actually what it is about the controversy right now."

The changes will not be applied the same globally, however. The changes for European users omit details announced for other regions. Among other things, plans to enable users' Facebook Pay accounts so they can "pay for things on WhatsApp" were not included in the European update.

Data protection laws in Europe are among the strongest in the world. In recent years, European data authorities have taken increasingly aggressive action against Big Tech.

In Europe, "the person has to be explained quite carefully what actually will be done with the data that the person provides," said Wiewiorowski, a concept known as "informed consent."

"Moreover, if we consented on one day, we have to remember that we can withdraw our consent."

"But consent means that you can withdraw at any time. [...] And you don't need to explain anything," he added. "You can just say, 'I don't consent for the things which I consented before.' And withdrawing consent should be as easy as the consent was."

The alternatives

Wiewiorowski stressed that people need to decide themselves what social media they are comfortable using. Many are choosing messenger apps that claim superior data protection. 

Users of the messenger app Signal can send private or group messages as well as documents, pictures, and audio and video files are end-to-end encrypted. The app also supports voice and video calls. Signal also has on-screen privacy features, anti-surveillance tools and disappearing messages.

The free app's straightforward privacy policy states that data is not linked to the user's identity nor is it stored on company servers. The richest man on Earth, Elon Musk, endorsed the service after WhatsApp announced its policy change. A week later, the messenger app crashed and was down for the greater part of a day. In a tweet, Signal attributed the technical difficulties to the surge in new users.

Telegram is another free platform that uses end-to-end encryption. The app uses a unique distributed infrastructure that divides the relevant decryption keys into two parts so they are "never kept in the same place as the data they protect," according to the company's website.

Due to its secure nature, in recent years Telegram has become increasingly popular among conspiracy theorists and extremist groups.

Switzerland-based Threema is an open source, paid messenger app with end-to-end encryption. Founded by software designers, it creates as little data as possible on the company's servers. One of the things that makes Threema unique is that each user is identified with an 8-digit ID rather than with their mobile phone number, adding another level of data privacy.

"What is really special about Threema," Flepp adds,"is that we are a Swiss European provider. So we are not subject to US laws."

"Most other services are based in the US, and as we all know, this is not the country with the best privacy protections."