WhatsApp's popularity took a hit after it released its new 'Terms of Services,' which are going to come into effect on February 8. These new terms of services said they were going to share data and usage statistics of its users with its parent company Facebook.
This data would be a gold mine for digital marketers who want to give more targeted, useful ads to their users. This is being done to monetise Whatsapp and make it more advertising friendly, said Rahul Sasi, founder of CloudSEK, a company that uses AI to enhance cybersecurity. Sasi and Nikhil Pahwa, founder of Medianama shared their insights about WhatsApp's new policy update in a discussion with BOOM Live.
"WhatsApp is not asking for more information than it already did. They're just trying to be transparent," added Sasi.
Nikhil Pahwa said the panic reaction caused by the new terms might be because WhatsApp's parent company is Facebook, which is one of the least trusted companies globally when it comes to privacy.
"Would people be still reacting to that if it wasn't Facebook? And that's the question that I'm asking myself if the data was not being shared with Facebook, but rather with Google or with a Twitter, would the reaction be the same? Twitter direct messages are not encrypted nor are our emails," he said.
Privacy policies can vary if a country or region doesn't want to enforce them, companies are not allowed to share their users' data across Europe since 2016.
But even if users don't use Facebook, there are dangers of your digital footprint being tracked. "Facebook is tracked through third-party data brokers across the internet. Even if you don't have an account, I remember there were instances where non-users were also being tracked. And similarly, in case of Google with advertising, you may not have a Google account. But if you're exposed to Google advertising, they're still profiling you by dropping a cookie on your device. So data collection, data tracking is happening at multiple levels globally, there is a global market failure in privacy and data protection. And we need regulation to address it," said Pahwa.
Excerpts of the interview follow:
Govindraj Ethiraj: Could you help us understand WhatsApp is really trying to do? To what extent has it been doing it already, which is collecting your data? And which part of that is harmful to you? And what should you be doing for yourself? And the larger question, what should we be looking at or doing from a policy point of view, which is specific to a country like India? And could they be an override?
Rahul Sasi: Facebook is a media company and 90% of their revenue comes from advertisements. Since the last couple of years, Facebook has been funding WhatsApp and its projects, and they have never made money out of WhatsApp. Now they are trying to make WhatsApp into an advertising machine as well.
And how do they do that?
Well, the fundamental way all these advertising companies make money is to show their users more relevant ads. You might be browsing for a pizza, and Facebook wants to show you a piece of advertisement so that the pizza company can make money, right? Similarly, their objective is, can we now leverage WhatsApp data? Some of the data might not be a part of the encrypted chats, but it can be some of the other metadata, which can be used to show you more relevant ads. In order to make WhatsApp generate revenue out of advertising, they've implemented this new privacy system.
They're basically going to the users and saying that we will require your permission to show you ads. They're telling the user, 'If you are okay with this new privacy policy you can stay on the platform, but if you're not okay you may feel free to leave the platform.' So in my perspective is that, while it's okay to show ads, it's their business model, but giving people the only option whether to stay in or leave is hard enforcement of their policy.
Govindraj Ethiraj: Whatsapp clarified saying that this new policy only affects business users. What does that mean?
Rahul Sasi: That's not true. It affects all users actually, The notification prompt is for all users not specifically for a particular set.
Govindraj Ethiraj: But at this point, obviously, we are not seeing advertisements. So this is, in some ways, preparing the ground to start serving advertisements?
Rahul Sasi: Yes. Also, the advertisement might not be happening on WhatsApp. It will happen on Facebook. But, you know, but they will try to leverage some sort of data from WhatsApp to show you those advertisements. And again, it can be on WhatsApp as well, but we don't know about that clearly at this point of time.
Govindraj Ethiraj: So Nikhil, how are you interpreting this move so far, including the clarification that WhatsApp has given at this point of time?
Nikhil Pahwa: So given a bunch of things to explain over here. Firstly, there are only parts to this privacy policy update which are new. In 2016, after WhatsApp had been acquired by Facebook, they had then updated its privacy policy to enable data sharing with Facebook. There are two types of data sets which are generated or which are on your WhatsApp when you use it. One is the metadata, which is basically your information in terms of who you're interacting with, which mobile number is interacting with which mobile number, how many times were you online, maybe your profile picture, information about your address book, what the status updates are. So that kind of information is metadata. What is being exchanged between you and me when we are chatting is encrypted data, and it's covered by end-to-end encryption. I know many users are looking to shift to Signal app as an alternative to WhatsApp. WhatsApp uses the same protocol that Signal does. And so the chats that we exchange are protected. And that's not being used or in any way impacting advertising. I also don't think that it's likely that we will see ads on WhatsApp.
But some of this information related to interactions and especially interactions with businesses might be used to inform advertising on WhatsApp's portfolio of apps which do not use end to end encryption. So it could probably inform advertising on Instagram or on Facebook. Facebook is trying to leverage WhatsApp in whatever ways it is possible because it can't leverage the chat information as such, when it comes to the business information.
There are specific businesses which use WhatsApp, so I always have seen WhatsApp as a replacement for Telecom. So first, it replaced messaging then it replaced calling and then it had something called transactional messaging, transactional information. So for example, if you booked a ticket on BookMyShow, it would send you details of a ticket via WhatsApp message.
So many of these transactions that we do, we get information from businesses that we're interacting with on WhatsApp itself. So those are business messages, and WhatsApp is saying is, now that information may be shared with Facebook by the business, if that business is using WhatsApp for hosting. So if that business is using Facebook's self-hosted services, then that information will probably not be used by Facebook for advertising or for interaction with other businesses. But just because it is hosted on Facebook, you should know that the information is going to be shared with Facebook as a service provider to that business.
So that is basically meant to help Facebook get a picture of just ensuring delivery of service for its business customers. A little too much is being made about the business part.
Govindraj Ethiraj: So if MakeMyTrip sends me a WhatsApp saying that here is a copy of the ticket you've booked from Mumbai to Delhi with a PNR, and so on. Now that information could go to Facebook, with my name and everything else?
Nikhil Pahwa: As a service provider, it can access that information. So if Google is providing a service, if you're using Google Apps, or WordPress, or Google Pro, and in that sense they are using their own hosting service to run your business, then information would have also been shared with them in their capacity as a service provider, not in their capacity as as an advertiser or, etc. That's the basic difference.
Govindraj Ethiraj: You also answered the question that I didn't ask, right in the beginning, which is that, you know, is our conversations, are our private conversations, including within groups safe? The answer is yes. Because of this end-to-end encryption, which means that all the data is either sitting on my mobile phone or yours, but not on any servers that are owned by WhatsApp. So to that extent, our videos, our chats, our messages are safe. However, the data behind that -- which is my phone number, or my location could find its way to Facebook. Am I correct?
Nikhil Pahwa: Yes but Facebook was already getting that information. So in that sense, there is nothing new. What we are seeing right now, in terms of the panic reaction that's happening, is largely Facebook throwing shade on WhatsApp. WhatsApp is a platform that people have trusted for many years.
Facebook is probably among the least trusted companies when it comes to privacy globally, right. So this is the effect on WhatsApp of the company it keeps in, or rather the company that owns it, that face that people are reacting to WhatsApp, even though our chats are not compromised. And much of personal information that goes into those chats is not compromised. Would people be still reacting to that if it wasn't Facebook? And that's the question that I'm asking myself if the data was not being shared with Facebook, but whether it's a Google or with a Twitter, would the reaction be the same? Twitter direct messages are not encrypted nor are our emails.
Rahul Sasi: This is the same for Instagram chats and a bunch of other things. Yeah, the only messages which are encrypted are in WhatsApp and Signal, etc etc. WhatsApp is not asking for more than what they already had. They already have it. They are just trying to leverage and they are trying to be transparent and build a business.
Govindraj Ethiraj: Rahul, there are two things now. So one is the information that I communicate or generate, which lies either on my phone or yours, and the other is the information that is intrinsic to me, my location, my phone number, my behaviour. Now, which of this in a way is more dangerous? Or is it that one type of information is worth more and therefore could also do me more harm down the line? And I when I say this, I mean, the data that is intrinsic to me?
Rahul Sasi: No, I mean, like the example where Nikhil mentioned MakeMyTrip sharing the data with Facebook, and you asked for the question of business?
Well, you have to understand Facebook, by default, already has access to all this data. If you go there's a service Facebook itself has given to every user, so you can go to that particular page, and it will list you all the third party apps, which are tracking you outside Facebook, and sharing data to Facebook.
So for example, Swiggy is one of them. Swiggy shares multiple activities with Facebook, a mobile application which you use to edit photographs, they share information with Facebook. This information includes things like what was the activity, whether you added something to cart, and some cases what you added to cart, some rare cases, some cases is just the set of activities you took on that particular portal, right? So it's not all these places, people are not sharing who you are, but your activities.
But in the end, yes, Facebook as a company knows who this is, obviously, from different different partners, and they can aggregate and build on top of this data, which is how it works. So the question of question is which one is more dangerous? The information about your chats is on your phone but any metadata you have is infomation that can be used by other people.
Govindraj Ethiraj: So data versus metadata. So metadata. So you're saying that metadata was always in the hands of the big tech companies and tech giants. So therefore, yeah, there is nothing that can be more damaging than what it is already today.
Rahul Sasi: Yes. that's true.
Govindraj Ethiraj: So Nikhil you know, now, these kinds of regulations or these kinds of product policies and updates are interpreted differently in different countries. Has a country or have some countries brought force onFacebook or WhatsApp to change these regulations a little bit. Could that happen here? Or will this be uniform across the world?
Rahul Sasi: Well, it's not uniform across the world very clearly, in Europe, this data sharing is not happening because in 2016, itself, European regulators put a stop to it. I don't quite recall what they did. But I know that the data is not being shared with Facebook in Europe. In our case, this case had gone to the CCI. And the CCI approved that particular acquisition of WhatsApp and I don't know what's come out of any challenge involved; whether there was a challenge regarding the data sharing in India. So it's not that there isn't a regulatory option available. This data sharing can be stopped, especially given the scale. But we also have to bear in mind that an understanding of data, as in terms of how it impacts competition, and the network effects that it creates, and how it is effective has an economic impact is only just improving. These, we weren't having these conversations in 2009, 2010, and 2011. And network effects are only being understood now. And there's a prospect that's taking place in multiple jurisdictions about this network effect. See, if you think about it, both with Facebook and with Google, they're kind of like Hotel California; "You can check out anytime you like, but you can never leave."
Nikhil Pahwa: You move from Facebook to WhatsApp, if you leave Facebook, you're on WhatsApp and Instagram, if you leave one you're on the other. And similar things happen with Google's family of apps also, that scale then creates a problem. One, it creates a privacy problem because of the amount of data and profiling that happens across those platforms. So WhatsApp is sharing data with Facebook, and that is informing advertising and other practices on both Instagram and Facebook. That is clearly a competitive advantage and a privacy concern because of all the sources that are collecting data.
Govindraj Ethiraj: So suppose I am on WhatsApp, but I'm not on Facebook, or Instagram, how does it affect my life?
Nikhil Pahwa: Well, in some instances, Facebook is tracked through third party data brokers across the internet. Even if you don't have an account, I remember there were instances where non users were also being tracked. And similarly, in case of Google with advertising, you may not have a Google account. But if you're exposed to Google advertising, they're still profiling you by dropping a cookie on your device. So data collection, data tracking is happening at multiple levels globally, there is a global market failure in privacy and data protection. And we need regulation to address it.
Govindraj Ethiraj: Rahul, so what is it that I can do or what should I Is there something else I should know about what this new ecosystem means? If it's particularly if it's something that should concern me? Secondly, if I want to protect myself, for whatever reason, in in any better way, what should I be doing?
Rahul Sasi: Yeah. So one of the interesting things Apple has done is in their new iOS they have let individual users have more control over their privacy. Individual users are allowed to choose if they want to let a app track them outside the functionalities of the app. And that's where Facebook has been having concerns with with Apple and this new functionality. Okay, so I see a more of these functionalities being doled out by Apple, because Apple is not an advertising company. And I see it not happening with Android, because Android parent company, Google, just their revenue is still coming from 70 80% comes from advertising, right? So this is one option, which people have at this point of time.
Govindraj Ethiraj: And Nikhil, how should we be looking at, if at all, to address this from a policy point of view, if only to you know, make users and there are hundreds of millions, as we said in this country more secure about their usage?
Nikhil Pahwa: So, before I get into that, given, I just want to add that you know, the three forms that are being considered by users are Whatsapp, Signal, telegram. Most of the switch is happening from WhatsApp to either Telegram or Signal. Signal is the best of these platforms, you can prevent people from taking screenshots of your messages you can prevent, you can put disappearing messages. So that you know that your message gets cleared after a period of time that you can set and Signal also does not collect metadata on you. So, you know, Signal is the safest platform to use that is strongly recommended in case of Telegram. Its regular chats are less secure than that of WhatsApp. So if I had to choose between Telegram and WhatsApp, I would choose WhatsApp that aside from a privacy perspective, I think there are things in Android also which are very useful. So you can still go to your settings for each app and change the privacy policy, you can change what data is being tracked about you by that app, you can also select whether apps can only track for example, your location when that app is in use, and not all the time.
So to the changes. from a policy perspective, I think India needs a data protection bill, and we did it yesterday, the sooner we get it, the better. And I do think we need competition regulation to address the scale at which data collection is being done by a consortium of apps or services that are owned by a single large company. So that scale is of data that is being collected about us as a big problem. Number three, I think we need to do something about data brokers, and who collects, buys and sells data to multiple platforms about us. Our data is being shared by them, even without us giving our consent to the data being said, so a bunch of things need to be addressed.
Govindraj Ethiraj: And that's very useful, Nikhil, because knowing about it, the fact that my data is getting shared, whether I'm using that app or not. Secondly, that a broker or a data broker could be actually picking it up and selling it to someone else is in itself. A good starting point for many people, Ravel very quickly. Signal, Telegram and WhatsApp. What are you going to stick to?
Rahul Sasi: Through my perspective, whatever has been happening since a long time. I don't see this as a new phenomenon. In my perspective, I personally believe people will always stick to applications that have a higher or elevated user experience. WhatsApp has that elevated user experience, and you will only use instant messaging apps which your friends use, right?
If you are on an instant messaging app, but if your friend is not on it, then there is no point in having the app in the first place. Right. So I think a lot of people will migrate to Signal but! I still see WhatsApp dominating the market timing because of the elevated user experience which they have provided and continue providing.