WhatsApp Complaint
Electronic Privacy Information Center, Center for Digital Democracy FTC complaint vs. Facebook-WhatsApp merger
Content
FEDERAL TRADE COMMISSION Washington, DC 20580 In the Matter of WhatsApp, Inc. ) ) ) ) )
Complaint, Request for Investigation, Injunction, and Other Relief Submitted by The Electronic Privacy Information Center and The Center for Digital Democracy I. Introduction 1. This complaint concerns the impact on consumer privacy of the proposed acquisition of WhatsApp, Inc. by Facebook, Inc. As set forth in detail below, WhatsApp built a user base based on its commitment not to collect user data for advertising revenue. Acting in reliance on WhatsApp representations, Internet users provided detailed personal information to the company including private text to close friends. Facebook routinely makes use of user information for advertising purposes and has made clear that it intends to incorporate the data of Whats App users into the user profiling business model. The proposed acquisition will therefore violate WhatsApp users’ understanding of their exposure to online advertising and constitutes an unfair and deceptive trade practice, subject to investigation by the Federal Trade Commission. II. Parties 2. The Electronic Privacy Information Center (“EPIC”) is a public interest research center located in Washington, D.C. EPIC focuses on emerging privacy and civil liberties issues and is a leading consumer advocate before the FTC. EPIC has a particular interest in protecting consumer privacy, and has played a leading role in developing the authority of the FTC to address emerging privacy issues and to safeguard the privacy rights of consumers.1 EPIC’s 2010 complaint concerning
1
See, e.g., Letter from EPIC Exec. Dir. Marc Rotenberg to FTC Comm’r Christine
In re: WhatsApp, Inc.
1
Federal Trade Commission March 6, 2014
Google Buzz provided the basis for the Commission’s investigation and October 24, 2011 subsequent settlement concerning the social networking service.2 In that case, the Commission found that Google “used deceptive tactics and violated its own privacy promises to consumers when it launched [Buzz].”3 The Commission’s settlement with Facebook also followed from a Complaint filed by EPIC and a coalition of privacy and civil liberties organization in December 2009 and a Supplemental Complaint filed by EPIC in February 2010.4 EPIC has previously urged the Commission to investigate businesses that make misleading representations as to record destruction practices. In 2008, EPIC notified the Commission that AskEraser falsely represented that search queries would be deleted when in fact they were retained by the company and made available to law enforcement agencies.5 3. The Center for Digital Democracy (CDD) is a not-for-profit DC-based organization focused on protecting consumers in the digital marketplace.6 During the 1990’s (and then operating as the Center for Media Education) its work to protect privacy on the Internet led to the passage of the Children’s Online Protection Act (COPPA) by Congress in 1998.7 CDD’s advocacy on the GoogleDoubleclick merger played a major role in the FTC's decision to address privacy concerns arising from online behavioral advertising.8 Through a series of complaints filed at the commission, CDD has brought attention to privacy concerns with mobile devices, real-time tracking and targeting platforms, social
Varney (Dec. 14, 1995) (urging the FTC to investigate the misuse of personal information by the direct marketing industry), http://epic.org/privacy/internet/ftc/ftc_letter.html; DoubleClick, Inc., FTC File No. 071-0170 (2000) (Complaint and Request for Injunction, Request for Investigation and for Other Relief), http://epic.org/privacy/internet/ftc/DCLK_complaint.pdf; Microsoft Corporation, FTC File No. 012 3240 (2002) (Complaint and Request for Injunction, Request for Investigation and for Other Relief), http://epic.org/privacy/consumer/MS_complaint.pdf; Choicepoint, Inc., FTC File No. 052-3069 (2004) (Request for Investigation and for Other Relief) , http://epic.org/privacy/choicepoint/fcraltr12.16.04.html. 2 Press Release, Federal Trade Comm’n, FTC Charges Deceptive Privacy Practices in Google’s Rollout of Its Buzz Social Network (Mar. 30, 2011), http://ftc.gov/opa/2011/03/google.shtm (“Google’s data practices in connection with its launch of Google Buzz were the subject of a complaint filed with the FTC by the Electronic Privacy Information Center shortly after the service was launched.”). 3 Id. 4 In the Matter of Facebook, Inc., (2009) (EPIC Complaint, Request for Investigation, Injunction, and Other Relief), https://epic.org/privacy/inrefacebook/EPIC-FacebookComplaint.pdf [hereinafter EPIC 2009 Facebook Complaint]; In the Matter of Facebook, Inc., (2010) (EPIC Supplemental Materials in Support of Pending Complaint and Request for Injunction, Request for Investigation and for Other Relief), https://epic.org/privacy/inrefacebook/EPIC_Facebook_Supp.pdf [hereinafter EPIC 2009 Facebook Supplement]; In the Matter of Facebook, Inc., (2010) (EPIC Complaint, Request for Investigation, Injunction, and Other Relief) , https://epic.org/privacy/facebook/EPIC_FTC_FB_Complaint.pdf [hereinafter EPIC 2010 Facebook Complaint]. 5 EPIC: Does AskEraser Really Erase?, https://epic.org/privacy/ask/ 6 Ctr. for Digital Democracy, About CDD, http://www.democraticmedia.org/about-cdd (last accessed Mar. 6, 2014). 7 Katherine C. Montgomery, Generation Digital, MIT PRESS, http://mitpress.mit.edu/books/generationdigital (last accessed Mar. 6, 2014). 8 Louise Story, F.T.C. Approves Doubleclick Deal, N.Y. TIMES, Dec. 21, 2007, available at http://www.nytimes.com/2007/12/21/business/21adco.html.
In re: WhatsApp, Inc.
2
Federal Trade Commission March 6, 2014
media, and from the databroker industry.9 CDD’s recent four-year campaign to ensure that COPPA was effectively implemented across all major platforms and applications resulted in the FTC’s December 2012 decision to strengthen its rules on children’s privacy.10 4. WhatsApp, Inc. is an American incorporated in Delaware.11 WhatsApp, Inc.’s primary place of business is 650 Castro Street, Suite 120-219, Mountain View, CA 94041.12 WhatsApp, Inc. is the developer of WhatsApp, a subscription-based Small Message Service (SMS) application for mobile phones.13 WhatsApp, Inc. was formed in 2009. The company currently processes over 10 billion messages per day from approximately 450 million active users.14 III. Factual Background A. WhatsApp’s Privacy Policies and Official Blog Posts Reflect a Strong Commitment to User Privacy 5. According to WhatsApp’s privacy policy, last updated in July 2012, WhatsApp “does not collect names, emails, addresses or other contact information from its users’ mobile address book or contact lists” other than mobile phone numbers.15 6. The mobile application’s association of a phone number with a user’s name “occurs dynamically on the mobile device itself and not on WhatsApp’s servers and is not transmitted to WhatsApp.”16 7. The only messages stored on WhatsApp servers are “undelivered” messages whose recipients have not logged into WhatsApp to retrieve messages. These are automatically deleted after 30 days.17 8. “The contents of messages that have ben delivered by the WhatsApp Service” are not copied, kept, or archived by WhatsApp in the normal course of business.”18
9
Rimma Katz, Center for Digital Democracy asks FTC to investigate mobile data targeting, MOBILE MARKETER, Apr. 9, 2010, available at http://www.mobilemarketer.com/cms/news/legal-privacy/5927.html. 10 Press Release, Federal Trade Comm’n, FTC Strengthens Kids' Privacy, Gives Parents Greater Control Over Their Information By Amending Childrens Online Privacy Protection Rule (Dec. 19, 2012), http://www.ftc.gov/news-events/press-releases/2012/12/ftc-strengthens-kids-privacy-gives-parents-greatercontrol-over. 11 California Secretary of State Business Entity Detail, http://kepler.sos.ca.gov/ 12 Id. 13 Brian X. Chen and Vindu Goel, Founders of an Anti-Facebook Are Won Over, N.Y. TIMES, Feb. 21, 2014, http://nytimes.com/2014/02/21/technology/founders-of-an-anti-facebook-are-won-over.html. 14 Id. 15 WhatsApp Privacy Policy, http://www.whatsapp.com/legal/#Privacy 16 Id. 17 Id. 18 Id.
In re: WhatsApp, Inc.
3
Federal Trade Commission March 6, 2014
9. WhatsApp’s privacy policy states, “We do not use your mobile phone number or other Personally Identifiable Information to send commercial or marketing messages without your consent or except as part of a specific program or feature for which you will have the ability to opt-in or opt-out.”19 10. On November 19, 2009, founder Jan Koum posted to the WhatsApp official Blog, “So first of all, let’s set the record straight. We have not, we do not and we will not ever sell your personal information to anyone. Period. End of story. Hopefully this clears things up.”20 11. On June 18, 2012, Koum posted to the WhatsApp Blog: At every company that sells ads, a significant portion of their engineering team spends their day tuning data mining, writing better code to collect all your personal data, upgrading the servers that hold all the data and making sure it’s all being logged and collated and sliced and packaged and shipped out… And at the end of the day the result of it all is a slightly different advertising banner in your browser or on your mobile screen. … At WhatsApp, our engineers spend all their time fixing bugs, adding new features and ironing out all the little intricacies in our task of bringing rich, affordable, reliable messaging to every phone in the world. That’s our product and that’s our passion. Your data isn’t even in the picture. We are simply not interested in any of it.21 12. On February 19, 2014, Koum posted to the WhatsApp Blog: Here’s what will change for you, our users: nothing. WhatsApp will remain autonomous and operate independently. You can continue to enjoy the service for a nominal fee. You can continue to use WhatsApp no matter where in the world you are, or what smartphone you’re using. And you can still count on absolutely no ads interrupting your communication. There would have been no partnership between our two companies if we had to compromise on the core principles that will always define our company, our vision and our product.22
19 20
Id. WhatsApp Blog, Just Wanted to Say a Few Things, https://blog.whatsapp.com/index.php/2009/11/a-fewthings/ (Nov. 9, 2009). 21 WhatsApp Blog, Why We Don’t Sell Ads, http://blog.whatsapp.com/index.php/2012/06/why-we-dontsell-ads/ (Jun. 18, 2012). 22 WhatsApp Blog, Facebook, http://blog.whatsapp.com/index.php/2014/02/facebook/ (Feb. 19, 2014).
In re: WhatsApp, Inc.
4
Federal Trade Commission March 6, 2014
13. Asked if the US government has attempted to access WhatsApp servers, Koum said, “People need to differentiate us from companies like Yahoo! and Facebook that collect your data and have it sitting on their servers. We want to know as little about our users as possible. We don't know your name, your gender… We designed our system to be as anonymous as possible. We're not advertisement-driven so we don't need personal databases.”23 B. WhatsApp’s Business Practices Affect Millions of Consumers 14. On August 23, 2012, WhatsApp processed ten billion user messages.24 15. On June 13, 2013, processed 27 billion user messages.25 16. As of December 2013, WhatsApp claimed that 400 million active users use the service each month.26 17. By the time the Facebook acquisition was announced at the end of February 2014, WhatsApp was processing 50 billion messages per day from 450 million monthly users.27 C. Facebook’s Messaging Service Regularly Collects And Stores Virtually All Available User Data 18. When Facebook revamped its messaging system in November 2010, it automatically opted all users into the new messaging system.28 19. Facebook’s new messaging system initially disabled users’ ability to delete individual messages. 29 20. Without user consent, the new messaging system also pulled data from Facebook’s social graph to prioritize messages from certain users. 30
23 24
Id. Twitter, https://twitter.com/WhatsApp/status/238680463139565568 (“new daily record: 4B inbound, 6B outbound = 10B total messages a day! #freebsd #erlang”) (last accessed Mar. 5, 2014). 25 Twitter, https://twitter.com/WhatsApp/status/344966710241161216 (last accessed Mar. 5, 2014). 26 WhatsApp Blog, http://blog.whatsapp.com/index.php/2013/12/400-million-stories/?lang=de 27 Kristin Burnham, Facebook’s WhatsApp Buy: 10 Staggering Stats, InformationWeek (Feb. 21, 2014), http://www.informationweek.com/software/social/facebooks-whatsapp-buy-10-staggering-stats-/d/did/1113927. 28 Joel Seligstein, See the Messages That Matter, Facebook Blog, Nov. 15, 2011, https://www.facebook.com/notes/facebook/see-the-messages-that-matter/452288242130. 29 Jan Jezabek, Steps Toward the New Messaging System, Facebook Blog, Nov. 2, 2011, https://developers.facebook.com/blog/post/591/ 30 Alex Wawro, Facebook Messages: Our First Look, PCWORLD, Nov. 15, 2010, http://www.techhive.com/article/210709/fbmessages_video1.html
In re: WhatsApp, Inc.
5
Federal Trade Commission March 6, 2014
21. Even when users delete a message, it continues to be stored on Facebook’s servers.31 22. Even when a user chooses not to send a message, Facebook still tracks what the user wrote.32 D. Facebook Routinely Incorporates Data from Companies It Has Acquired 23. Facebook has regularly collected user data from companies it acquires. 24. For example, when Facebook purchased Instagram in 2012, Instagram users were not subjected to advertisements based on the content they uploaded to the site.33 25. Like WhatsApp, Instagram’s Terms of Service included a provision that in the event of acquisition, users’ “information such as name and email address, User Content and any other information collected through the Service may be among the items sold or transferred.”34 26. After the acquisition, Facebook did in fact access Instagram users’ data and changed the Instagram Terms of Service to reflect this change. 35 E. Many WhatsApp Users Object to the Facebook Acquisition 27. Aliya Abbas, a Delhi-based mediaperson, said, “I started using WhatsApp five months ago. If it gets integrated with Facebook, I will uninstall [WhatsApp]. And I think others will do the same if this happens. WhatsApp is popular because of its
31
Zack Whittaker, Facebook Does Not Erase User-Deleted Content, ZD NET, Apr. 28, 2010, http://www.zdnet.com/blog/igeneration/facebook-does-not-erase-user-deleted-content/4808; Miranda Miller, Your Facebook Data File: Everything You Never Wanted Anyone to Know, Search Engine Watch, Oct. 3, 2011, http://searchenginewatch.com/article/2114059/Your-Facebook-Data-File-Everything-YouNever-Wanted-Anyone-to-Know. 32 Jennifer Golbeck, On Second Thought… Facebook Wants to Know Why You Didn’t Publish that Status Update You Started Writing, SLATE, Dec. 13, 2013, http://www.slate.com/articles/technology/future_tense/2013/12/facebook_self_censorship_what_happens_t o_the_posts_you_don_t_publish.html 33 Craig Timberg, Instagram outrage reveals a powerful but unaware Web community, WASH. POST, Dec. 21, 2012, http://www.washingtonpost.com/business/technology/instagram-outrage-reveals-a-powerful-butunaware-web-community/2012/12/21/b387e828-4b7a-11e2-b709-667035ff9029_story.html. 34 Id. 35 Hayley Tsukayama, Instagram reminds users of privacy policy change, WASH. POST, Jan. 16, 2013, http://www.washingtonpost.com/business/technology/instagram-reminds-users-of-privacy-policychange/2013/01/16/124a8712-5fee-11e2-9940-6fc488f3fecd_story.html
In re: WhatsApp, Inc.
6
Federal Trade Commission March 6, 2014
privacy, and I don't think users will like the idea of advertisements popping up in the middle of a conversation.”36 28. Columnist Carly Page wrote, “I'm a user of Whatsapp, and of course Facebook’s ridiculously expensive acquisition of the firm has got me concerned about my privacy, especially the fact that the social network likely now has access to my mobile phone number.”37 29. Journalist Tali Arbel wrote, “WhatsApp is my respite from Facebook. For me, the world's largest social network has become a junkyard of updates from people I don't really know and ads for products I don't care about. It's all about people jostling for publicity and craving approval, seeking likes and comments from near-strangers. But WhatsApp is the best stand-in for a conversation you have over dinner with people you love. It's intimate. It's personal. I rely on it. […] Facebook says it won’t run ads on WhatsApp. But I'm afraid they won't be able to help themselves. With all those food pictures, won't Facebook figure I want to see ads for restaurants and cookware? And will Facebook urge my ‘friends’ to connect with me on WhatsApp? Facebook has done something similar with Instagram, the photo-sharing app it has owned since 2012.”38 30. Corley Paige, a product developer from Austin, Texas, wrote, “I suddenly want to delete my Whatsapp. Hello Viber.”39 31. Twitter user Tara Aghdashloo wrote, “Facebook is like an evil parent that keeps finding the new hiding place for your diary.”40 32. User @tabandchord posted to Twitter, “Facebook + WhatsApp = The Ultimate Spying Machine #facebook #WhatsApp.”41 33. Some users of both WhatsApp and Facebook created a Facebook Page titled “Please Don’t Ruin WhatsApp.” Under the designation “Community description,”
36
Nitin Sreedhar, Status update: WhatsApp now a chapter in Facebook, BUSINESS STANDARD, Feb. 24, 2014, http://www.business-standard.com/article/technology/status-update-whatsapp-now-a-chapter-infacebook-114022300669_1.html. 37 Carly Page, Facebook’s Whatsapp buy is a privacy nightmare for users, but it makes sense for the social network, THE INQUIRER, Feb. 20, 2014, http://www.theinquirer.net/inquirer/opinion/2329985/facebookswhatsapp-buyout-is-a-privacy-nightmare-for-users-but-it-makes-sense-for-the-social-network. 38 Tali Arbel, My Love Affair With WhatsApp: Does It Have to End?, WASH. TIMES, Feb. 20, 2104, http://www.washingtontimes.com/news/2014/feb/20/my-love-affair-with-whatsapp-does-it-have-to-end. 39 Jessica Guynn, Users threaten to delete WhatsApp now that Facebook is buying it, LOS ANGELES TIMES, Feb. 19, 2014, http://www.latimes.com/business/technology/la-fi-tn-users-threaten-to-delete-whatsapp20140219,0,4153795.story#axzz2v7TZZFCR. 40 Twitter, https://twitter.com/taraaghdashloo/status/436272358312378371 (last accessed Mar. 5, 2014). 41 Twitter, twitter.com/tabandchord
In re: WhatsApp, Inc.
7
Federal Trade Commission March 6, 2014
the page creators posted, “Hey Facebook: Please don't ruin WhatsApp and make all of our message go through Facebook Messenger.” 42 F. Industry Experts Warn that the Merger Will Diminish User Privacy 34. Industry experts object to the Facebook acquisition because it allows Facebook access to the repository of mobile phone numbers that WhatsApp has collected. 35. Wim Nauwelaerts, a lawyer specializing in EU data protection law at Hunton & Williams, LLP in Brussels, told Bloomberg, “Facebook is not only buying a popular messaging app, it is also acquiring the addresses and telephone numbers of 450 million users worldwide. […] Many of these users are already signed up to Facebook, so through this deal Facebook will be able to build complete profiles on users.”43 36. St. John Deakins, the head of the online identity monitoring application Citizenme, said, “Facebook already has a very broad copyright license on people's content and already shares your data with many other services. Now with Facebook buying Whatsapp, this could see more and more private information becoming part of Facebook's database. From a personal data standpoint, this is extremely worrying.”44 37. Tim Grossman, a senior branding consultant at Brand Union, wrote in The Guardian: “One of the reasons why so many millions have flocked to WhatsApp is the added level of privacy the brand provides. In a world where your every word echoes endlessly across the internet it was a communication channel where sharing could take place on a more contained level. However, much like Google's acquisition of Nest and Facebook's of Instagram, with this purchase consumers are suddenly associated with, and have their information accessible by a brand that they didn't buy into. It's this intrusion that can make it feel uncomfortable, as both you and your data are seized without your say-so.”45
42 43
Facebook, Please Don’t Ruin WhatsApp, https://www.facebook.com/dontruinwhatsapp Stephanie Bodoni, Facebook WhatsApp Deal Risks Sparking Privacy Probes Across EU, BLOOMBERG, Feb. 25, 2014, http:// bloomberg.com/news/2014-02-25/facebook-whatsapp-deal-risks-sparking-privacyprobes-across-eu.html. 44 Samuel Gibbs, Six Alternatives to WhatsApp Now That Facbook Owns It, THE GUARDIAN, Feb. 20, 2014, http://www.theguardian.com/technology/2014/feb/20/six-alternatives-whatsapp-facebook. 45 Tim Gosman, Why WhatsApp is a worthy addition to the Facebook fold, THE GUARDIAN, http://www.theguardian.com/media-network/partner-zone-brand-union/facebook-acquisition-whatsappdamage-brand-privacy.
In re: WhatsApp, Inc.
8
Federal Trade Commission March 6, 2014
G. Facebook’s Acquisition of WhatsApp Implicates Safe Harbor Compliance 38. The Commission has previously issued an Order and Settlement Agreement with Facebook, following an investigation into whether “Facebook deceived consumers by telling them they could keep their information on Facebook private, and then repeatedly allowing it to be shared and made public.”46 39. In addition to requiring Facebook to give users “clear and prominent notice” and obtain “their express consent before sharing their information beyond their privacy settings,” and to maintain “a comprehensive privacy program to protect consumers’ information,” the Order also prohibited Facebook from misrepresenting the extent to which it participates in the US-EU Safe Harbor program.47 40. The Safe Harbor Framework is an industry-developed self-regulatory approach to privacy compliance.48 Coordinated by the Department of Commerce, the Safe Harbor program allows firms to self-certify privacy policies in lieu of establishing adequate privacy protections in the United States that regulate business practice. The Safe Harbor arrangements developed in response to the European Union Data Directive, a comprehensive legal framework that established essential privacy safeguards for consumers across the European Union.49 41. The Federal Trade Commission has been tasked with penalizing US firms that incorrectly claim current Safe Harbor certification.50 42. Currently, Facebook represents that it complies with the requirements of Safe Harbor program.51 H. European Data Protection Authorities Have Already Begun Investigations 43. Jacob Kohnstamm, the Dutch data protection Commissioner, has begun an investigation into data protection issues related to Facebook’s purchase of
46
In the Matter of Facebook, Inc., a corporation; FTC File No. 092 3184, FTC.gov (Dec. 30, 2011), http://www.ftc.gov/enforcement/cases-proceedings/092-3184/facebook-inc. 47 Id. 48 U.S. Dep’t of Commerce, Safe Harbor Privacy Principles, http://export.gov/safeharbor/eu/eg_main_018475.asp (last updated Jan. 30, 2009). 49 Directive 95/46/EC of the European Parliament and of the Council of Oct. 24, 1995 on the Protection of Individuals with Regard to the Processing of Personal Data and on the Free Movement of Such Data, 1995 O.J. (L 281) 31, available at http://eurlex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:31995L0046:EN:HTML. 50 Fed. Trade Comm’n, Bureau of Consumer Protection Business Center, US-E.U. Safe Harbor Framework, http://www.business.ftc.gov/us-eu-safe-harbor-framework (last accessed Mar. 6, 2014). 51 Facebook, Safe Harbor, https://www.facebook.com/safeharbor.php (last accessed Mar. 6, 2014).
In re: WhatsApp, Inc.
9
Federal Trade Commission March 6, 2014
WhatsApp.52 His investigation is focusing on the collection of data from WhatsApp users’ address books and the potential for misuse of that information.53 44. Thilo Weichert, the data protection commissioner for the German state of Schleswig-Holstein, has also begun an investigation into the acquisition.54 He told Bloomberg, “The mixing of data is strictly regulated by German law, especially through the Telemedia Act and the Federal Data Protection Act. Both acts rely on the principle of purpose binding, that data stored for one purpose cannot be processed for any other purposes - there are no such restrictions in the U.S.”55 45. Commissioner Kohnstamm, who served as the head of the European Union’s Article 29 Data Protection Working Party until February 27, 2014, said that any of the European Union’s “28 data protection regulators could open an investigation” into the acquisition as well.56 IV. Legal Analysis A. The FTC’s Section 5 Authority 46. The FTC Act prohibits unfair and deceptive acts and practices, and empowers the Commission to enforce the Act’s prohibitions.57 These powers are described in FTC Policy Statements on Deception58 and Unfairness.59 47. A trade practice is unfair if it “causes or is likely to cause substantial injury to consumers which is not reasonably avoidable by consumers themselves and not outweighed by countervailing benefits to consumers or to competition.”60 48. The injury must be “substantial.”61 Typically, this involves monetary harm, but may also include “unwarranted health and safety risks.”62 Emotional harm and
52 53
Gibbs, supra at 47. Id. 54 Jabeen Bhatti and Stephanie Bodoni, Facebook Purchase of WhatsApp Raises German, Dutch, Art. 29 Privacy Concerns, BLOOMBERG BNA, Mar. 3, 2014, http://www.bna.com/facebook-purchase-whatsappn17179882555. 55 Id. 56 Bodoni, supra at 46. 57 See 15 U.S.C. § 45 (2010). 58 Fed. Trade Comm’n, FTC Policy Statement on Deception (1983), available at http://www.ftc.gov/bcp/policystmt/ad-decept.htm [hereinafter FTC Deception Policy]. 59 Fed. Trade Comm’n, FTC Policy Statement on Unfairness (1980), available at http://www.ftc.gov/bcp/policystmt/ad-unfair.htm [hereinafter FTC Unfairness Policy]. 60 15 U.S.C. § 45(n); see, e.g., Fed. Trade Comm’n v. Seismic Entertainment Productions, Inc., Civ. No. 1:04-CV- 00377 (Nov. 21, 2006) (finding that unauthorized changes to users’ computers that affected the functionality of the computers as a result of Seismic’s anti-spyware software constituted a “substantial injury without countervailing benefits.”). 61 FTC Unfairness Policy, supra.
In re: WhatsApp, Inc.
10
Federal Trade Commission March 6, 2014
other “more subjective types of harm” generally do not make a practice unfair.63 Secondly, the injury “must not be outweighed by an offsetting consumer or competitive benefit that the sales practice also produces.”64 Thus the FTC will not find a practice unfair “unless it is injurious in its net effects.”65 Finally, “the injury must be one which consumers could not reasonably have avoided.”66 This factor is an effort to ensure that consumer decision making still governs the market by limiting the FTC to act in situations where seller behavior “unreasonably creates or takes advantage of an obstacle to the free exercise of consumer decisionmaking.”67 Sellers may not withhold from consumers important price or performance information, engage in coercion, or unduly influence highly susceptible classes of consumers.68 49. An act or practice is deceptive if it involves a representation, omission, or practice that is likely to mislead the consumer acting reasonably under the circumstances, to the consumer’s detriment.”69 50. There are three elements to a deception claim. First, there must be a representation, omission, or practice that is likely to mislead the consumer.70 The relevant inquiry for this factor is not whether the act or practice actually misled the consumer, but rather whether it is likely to mislead.71 51. Second, the act or practice must be considered from the perspective of a reasonable consumer.72 “The test is whether the consumer’s interpretation or reaction is reasonable.”73 The FTC will look at the totality of the act or practice and ask questions such as “how clear is the representation? How conspicuous is any qualifying information? How important is the omitted information? Do other sources for the omitted information exist? How familiar is the public with the product or service?”74
62
Id.; see, e.g., Fed. Trade Comm’n v. Information Search, Inc., Civ. No. 1:06-cv-01099 (Mar. 9, 2007) (“The invasion of privacy and security resulting from obtaining and selling confidential customer phone records without the consumers’ authorization causes substantial harm to consumers and the public, including, but not limited to, endangering the health and safety of consumers.”). 63 FTC Unfairness Policy, supra. 64 Id. 65 Id. 66 Id. 67 Id. 68 Id. 69 FTC Deception Policy, supra. 70 FTC Deception Policy, supra ; see, e.g., Fed Trade Comm’n v. Pantron I Corp., 33 F.3d 1088 (9th Cir. 1994) (holding that Pantron’s representation to consumers that a product was effective at reducing hair loss was materially misleading, because according to studies, the success of the product could only be attributed to a placebo effect, rather than on scientific grounds). 71 FTC Deception Policy, supra. 72 Id. 73 Id. 74 Id.
In re: WhatsApp, Inc.
11
Federal Trade Commission March 6, 2014
52. Finally, the representation, omission, or practice must be material.75 Essentially, the information must be important to consumers. The relevant question is whether consumers would have chosen another product if the deception had not occurred.76 Express claims will be presumed material.77 Materiality is presumed for claims and omissions involving “health, safety, or other areas with which the reasonable consumer would be concerned.”78 53. The FTC presumes that an omission is material where “the seller knew, or should have known, that an ordinary consumer would need omitted information to evaluate the product or service, or that the claim was false . . . because the manufacturer intended the information or omission to have an effect.”79 54. The Commission has previously found that a company may not alter the privacy settings of its users.80 55. The Commission has previously found that a company may not repurpose user data for a use other than the one for which the user’s data was collected without first obtaining the user’s “express affirmative consent.”81 56. In the FTC’s consideration of the Google acquisition of Doubleclick, where similar issues were raised about the impact on user privacy, the Commission allowed the merger to go forward, but only because the Commission found that the scope of its antitrust review did not encompass issues related to consumer privacy.82 57. In the Google acquisition of Doubleclick, Commissioner Harbor dissented and warned, “The truth is, we really do not know what Google/DoubleClick can or will do with its trove of information about consumers’ Internet habits. The merger creates a firm with vast knowledge of consumer preferences, subject to very little accountability.”83
75 76
Id. Id. 77 Id. 78 Id. 79 Cliffdale Associates, Inc., 103 F.T.C. 110, 110 (1984). 80 In the Matter of Facebook, Inc., a corporation; FTC File No. 092 3184, FTC.gov (Dec. 30, 2011), http://www.ftc.gov/enforcement/cases-proceedings/092-3184/facebook-inc. 81 In the Matter of Google, Inc.; FTC File No. 102 3136 (Oct. 13, 2011) (Decision and Order), http://www.ftc.gov/sites/default/files/documents/cases/2011/10/111024googlebuzzdo.pdf. 82 In the Matter of DoubleClick, Inc., FTC File No. 071-0170 (2000) (Statement of the Commission), http://www.ftc.gov/sites/default/files/documents/cases/2007/12/071220statement.pdf. 83 In the Matter of DoubleClick, Inc., FTC File No. 071-0170 (2000) (Dissenting Statement of Commissioner Pamela Jones Harbour), http://www.ftc.gov/os/caselist/0710170/071220harbour.pdf.
In re: WhatsApp, Inc.
12
Federal Trade Commission March 6, 2014
B. Count I: Deceptive Failure to Represent that WhatsApp’s Governing Principles of Anonymity and Privacy Were Subject to Reversal 58. As described above, WhatsApp represented to consumers that the company will not retain or repurpose information collected from their mobile phones. 59. As described in detail above, facts about WhatsApp’s philosophy of privacy and anonymity were material to users in their decision to install and use WhatsApp. 60. As described above, some users selected WhatsApp as a pro-privacy alternative to other messaging services. 61. Therefore, WhatsApp’s failure to adequately disclose that this commitment to privacy was subject to reversal constitutes a deceptive act or practice in violation of Section 5(a) of the FTC Act, 15 U.S.C. § 45(a). 62. Users could not reasonably avoid being aware of the inadequate disclosures regarding the potential for reversal of the privacy policy. 63. The inadequate disclosures are not outweighed by countervailing benefits to consumers or to competition. 64. WhatsApp’s inadequate disclosures constitute deceptive acts or practices in violation of Section 5 of the FTC Act, 15 U.S.C. § 45(a). C. Count II: Unfair Failure to Adequately Protect User Data In the Event of an Acquisition 65. As described in detail above, WhatsApp users reasonably expected that selecting WhatsApp would provide them with a privacy-protective messaging service. 66. As described in detail above, industry experts have identified that Facebook’s acquisition of WhatsApp will dramatically expand Facebook’s ability to gather user data. 67. As described in detail above, Facebook regularly collects and stores virtually all user information that it can extract. 68. By failing to make special provisions to protect user data in the event of an acquisition, WhatsApp “unreasonably creates or takes advantage of an obstacle to the free exercise of consumer decisionmaking.” 69. Specifically, WhatsApp users could not reasonably have anticipated that by selecting a pro-privacy messaging service, they would subject their data to Facebook’s data collection practices. In re: WhatsApp, Inc. 13 Federal Trade Commission March 6, 2014
70. The inadequate protections are not outweighed by countervailing benefits to consumers or to competition. 71. Therefore, WhatsApp’s inadequate disclosures constitute unfair acts or practices in violation of Section 5 of the FTC Act, 15 U.S.C. § 45(n). V. Prayer for Investigation and Relief 1. EPIC urges the Commission to investigate WhatsApp, Inc., and enjoin its unfair and deceptive data collection practices for any future changes to its privacy policy. 2. Specifically, EPIC requests the Commission to: a. Initiate an investigation of the proposed acquisition of WhatsApp by Facebook specifically with regard to the ability of Facebook to access WhatsApp’s store of user mobile phone numbers and metadata; b. Until the issues identified in this Complaint are adequately resolved, use the Commission’s authority to review mergers to halt Facebook’s proposed acquisition of WhatsApp; c. In the event that the acquisition proceeds, order Facebook to insulate WhatsApp users’ information from access by Facebook’s data collection practices; and d. Provide such other relief as the Commission finds necessary and appropriate.
In re: WhatsApp, Inc.
14
Federal Trade Commission March 6, 2014
Respectfully Submitted, Marc Rotenberg, EPIC Executive Director Julia Horwitz, EPIC Consumer Protection Counsel Ginger McCall, EPIC Associate Director Khaliah Barnes, EPIC Administrative Law Counsel Electronic Privacy Information Center 1718 Connecticut Ave. NW Suite 200 Washington, DC 20009 202-483-1140 (tel) 202-483-1248 (fax) Jeff Chester, CDD Executive Director Hudson Kingston, CDD Legal Director Center for Digital Democracy 1621 Connecticut Ave. NW Suite 550 Washington, DC 20009 (202) 332-2670 (tel)
In re: WhatsApp, Inc.
15
Federal Trade Commission March 6, 2014
Complaint, Request for Investigation, Injunction, and Other Relief Submitted by The Electronic Privacy Information Center and The Center for Digital Democracy I. Introduction 1. This complaint concerns the impact on consumer privacy of the proposed acquisition of WhatsApp, Inc. by Facebook, Inc. As set forth in detail below, WhatsApp built a user base based on its commitment not to collect user data for advertising revenue. Acting in reliance on WhatsApp representations, Internet users provided detailed personal information to the company including private text to close friends. Facebook routinely makes use of user information for advertising purposes and has made clear that it intends to incorporate the data of Whats App users into the user profiling business model. The proposed acquisition will therefore violate WhatsApp users’ understanding of their exposure to online advertising and constitutes an unfair and deceptive trade practice, subject to investigation by the Federal Trade Commission. II. Parties 2. The Electronic Privacy Information Center (“EPIC”) is a public interest research center located in Washington, D.C. EPIC focuses on emerging privacy and civil liberties issues and is a leading consumer advocate before the FTC. EPIC has a particular interest in protecting consumer privacy, and has played a leading role in developing the authority of the FTC to address emerging privacy issues and to safeguard the privacy rights of consumers.1 EPIC’s 2010 complaint concerning
1
See, e.g., Letter from EPIC Exec. Dir. Marc Rotenberg to FTC Comm’r Christine
In re: WhatsApp, Inc.
1
Federal Trade Commission March 6, 2014
Google Buzz provided the basis for the Commission’s investigation and October 24, 2011 subsequent settlement concerning the social networking service.2 In that case, the Commission found that Google “used deceptive tactics and violated its own privacy promises to consumers when it launched [Buzz].”3 The Commission’s settlement with Facebook also followed from a Complaint filed by EPIC and a coalition of privacy and civil liberties organization in December 2009 and a Supplemental Complaint filed by EPIC in February 2010.4 EPIC has previously urged the Commission to investigate businesses that make misleading representations as to record destruction practices. In 2008, EPIC notified the Commission that AskEraser falsely represented that search queries would be deleted when in fact they were retained by the company and made available to law enforcement agencies.5 3. The Center for Digital Democracy (CDD) is a not-for-profit DC-based organization focused on protecting consumers in the digital marketplace.6 During the 1990’s (and then operating as the Center for Media Education) its work to protect privacy on the Internet led to the passage of the Children’s Online Protection Act (COPPA) by Congress in 1998.7 CDD’s advocacy on the GoogleDoubleclick merger played a major role in the FTC's decision to address privacy concerns arising from online behavioral advertising.8 Through a series of complaints filed at the commission, CDD has brought attention to privacy concerns with mobile devices, real-time tracking and targeting platforms, social
Varney (Dec. 14, 1995) (urging the FTC to investigate the misuse of personal information by the direct marketing industry), http://epic.org/privacy/internet/ftc/ftc_letter.html; DoubleClick, Inc., FTC File No. 071-0170 (2000) (Complaint and Request for Injunction, Request for Investigation and for Other Relief), http://epic.org/privacy/internet/ftc/DCLK_complaint.pdf; Microsoft Corporation, FTC File No. 012 3240 (2002) (Complaint and Request for Injunction, Request for Investigation and for Other Relief), http://epic.org/privacy/consumer/MS_complaint.pdf; Choicepoint, Inc., FTC File No. 052-3069 (2004) (Request for Investigation and for Other Relief) , http://epic.org/privacy/choicepoint/fcraltr12.16.04.html. 2 Press Release, Federal Trade Comm’n, FTC Charges Deceptive Privacy Practices in Google’s Rollout of Its Buzz Social Network (Mar. 30, 2011), http://ftc.gov/opa/2011/03/google.shtm (“Google’s data practices in connection with its launch of Google Buzz were the subject of a complaint filed with the FTC by the Electronic Privacy Information Center shortly after the service was launched.”). 3 Id. 4 In the Matter of Facebook, Inc., (2009) (EPIC Complaint, Request for Investigation, Injunction, and Other Relief), https://epic.org/privacy/inrefacebook/EPIC-FacebookComplaint.pdf [hereinafter EPIC 2009 Facebook Complaint]; In the Matter of Facebook, Inc., (2010) (EPIC Supplemental Materials in Support of Pending Complaint and Request for Injunction, Request for Investigation and for Other Relief), https://epic.org/privacy/inrefacebook/EPIC_Facebook_Supp.pdf [hereinafter EPIC 2009 Facebook Supplement]; In the Matter of Facebook, Inc., (2010) (EPIC Complaint, Request for Investigation, Injunction, and Other Relief) , https://epic.org/privacy/facebook/EPIC_FTC_FB_Complaint.pdf [hereinafter EPIC 2010 Facebook Complaint]. 5 EPIC: Does AskEraser Really Erase?, https://epic.org/privacy/ask/ 6 Ctr. for Digital Democracy, About CDD, http://www.democraticmedia.org/about-cdd (last accessed Mar. 6, 2014). 7 Katherine C. Montgomery, Generation Digital, MIT PRESS, http://mitpress.mit.edu/books/generationdigital (last accessed Mar. 6, 2014). 8 Louise Story, F.T.C. Approves Doubleclick Deal, N.Y. TIMES, Dec. 21, 2007, available at http://www.nytimes.com/2007/12/21/business/21adco.html.
In re: WhatsApp, Inc.
2
Federal Trade Commission March 6, 2014
media, and from the databroker industry.9 CDD’s recent four-year campaign to ensure that COPPA was effectively implemented across all major platforms and applications resulted in the FTC’s December 2012 decision to strengthen its rules on children’s privacy.10 4. WhatsApp, Inc. is an American incorporated in Delaware.11 WhatsApp, Inc.’s primary place of business is 650 Castro Street, Suite 120-219, Mountain View, CA 94041.12 WhatsApp, Inc. is the developer of WhatsApp, a subscription-based Small Message Service (SMS) application for mobile phones.13 WhatsApp, Inc. was formed in 2009. The company currently processes over 10 billion messages per day from approximately 450 million active users.14 III. Factual Background A. WhatsApp’s Privacy Policies and Official Blog Posts Reflect a Strong Commitment to User Privacy 5. According to WhatsApp’s privacy policy, last updated in July 2012, WhatsApp “does not collect names, emails, addresses or other contact information from its users’ mobile address book or contact lists” other than mobile phone numbers.15 6. The mobile application’s association of a phone number with a user’s name “occurs dynamically on the mobile device itself and not on WhatsApp’s servers and is not transmitted to WhatsApp.”16 7. The only messages stored on WhatsApp servers are “undelivered” messages whose recipients have not logged into WhatsApp to retrieve messages. These are automatically deleted after 30 days.17 8. “The contents of messages that have ben delivered by the WhatsApp Service” are not copied, kept, or archived by WhatsApp in the normal course of business.”18
9
Rimma Katz, Center for Digital Democracy asks FTC to investigate mobile data targeting, MOBILE MARKETER, Apr. 9, 2010, available at http://www.mobilemarketer.com/cms/news/legal-privacy/5927.html. 10 Press Release, Federal Trade Comm’n, FTC Strengthens Kids' Privacy, Gives Parents Greater Control Over Their Information By Amending Childrens Online Privacy Protection Rule (Dec. 19, 2012), http://www.ftc.gov/news-events/press-releases/2012/12/ftc-strengthens-kids-privacy-gives-parents-greatercontrol-over. 11 California Secretary of State Business Entity Detail, http://kepler.sos.ca.gov/ 12 Id. 13 Brian X. Chen and Vindu Goel, Founders of an Anti-Facebook Are Won Over, N.Y. TIMES, Feb. 21, 2014, http://nytimes.com/2014/02/21/technology/founders-of-an-anti-facebook-are-won-over.html. 14 Id. 15 WhatsApp Privacy Policy, http://www.whatsapp.com/legal/#Privacy 16 Id. 17 Id. 18 Id.
In re: WhatsApp, Inc.
3
Federal Trade Commission March 6, 2014
9. WhatsApp’s privacy policy states, “We do not use your mobile phone number or other Personally Identifiable Information to send commercial or marketing messages without your consent or except as part of a specific program or feature for which you will have the ability to opt-in or opt-out.”19 10. On November 19, 2009, founder Jan Koum posted to the WhatsApp official Blog, “So first of all, let’s set the record straight. We have not, we do not and we will not ever sell your personal information to anyone. Period. End of story. Hopefully this clears things up.”20 11. On June 18, 2012, Koum posted to the WhatsApp Blog: At every company that sells ads, a significant portion of their engineering team spends their day tuning data mining, writing better code to collect all your personal data, upgrading the servers that hold all the data and making sure it’s all being logged and collated and sliced and packaged and shipped out… And at the end of the day the result of it all is a slightly different advertising banner in your browser or on your mobile screen. … At WhatsApp, our engineers spend all their time fixing bugs, adding new features and ironing out all the little intricacies in our task of bringing rich, affordable, reliable messaging to every phone in the world. That’s our product and that’s our passion. Your data isn’t even in the picture. We are simply not interested in any of it.21 12. On February 19, 2014, Koum posted to the WhatsApp Blog: Here’s what will change for you, our users: nothing. WhatsApp will remain autonomous and operate independently. You can continue to enjoy the service for a nominal fee. You can continue to use WhatsApp no matter where in the world you are, or what smartphone you’re using. And you can still count on absolutely no ads interrupting your communication. There would have been no partnership between our two companies if we had to compromise on the core principles that will always define our company, our vision and our product.22
19 20
Id. WhatsApp Blog, Just Wanted to Say a Few Things, https://blog.whatsapp.com/index.php/2009/11/a-fewthings/ (Nov. 9, 2009). 21 WhatsApp Blog, Why We Don’t Sell Ads, http://blog.whatsapp.com/index.php/2012/06/why-we-dontsell-ads/ (Jun. 18, 2012). 22 WhatsApp Blog, Facebook, http://blog.whatsapp.com/index.php/2014/02/facebook/ (Feb. 19, 2014).
In re: WhatsApp, Inc.
4
Federal Trade Commission March 6, 2014
13. Asked if the US government has attempted to access WhatsApp servers, Koum said, “People need to differentiate us from companies like Yahoo! and Facebook that collect your data and have it sitting on their servers. We want to know as little about our users as possible. We don't know your name, your gender… We designed our system to be as anonymous as possible. We're not advertisement-driven so we don't need personal databases.”23 B. WhatsApp’s Business Practices Affect Millions of Consumers 14. On August 23, 2012, WhatsApp processed ten billion user messages.24 15. On June 13, 2013, processed 27 billion user messages.25 16. As of December 2013, WhatsApp claimed that 400 million active users use the service each month.26 17. By the time the Facebook acquisition was announced at the end of February 2014, WhatsApp was processing 50 billion messages per day from 450 million monthly users.27 C. Facebook’s Messaging Service Regularly Collects And Stores Virtually All Available User Data 18. When Facebook revamped its messaging system in November 2010, it automatically opted all users into the new messaging system.28 19. Facebook’s new messaging system initially disabled users’ ability to delete individual messages. 29 20. Without user consent, the new messaging system also pulled data from Facebook’s social graph to prioritize messages from certain users. 30
23 24
Id. Twitter, https://twitter.com/WhatsApp/status/238680463139565568 (“new daily record: 4B inbound, 6B outbound = 10B total messages a day! #freebsd #erlang”) (last accessed Mar. 5, 2014). 25 Twitter, https://twitter.com/WhatsApp/status/344966710241161216 (last accessed Mar. 5, 2014). 26 WhatsApp Blog, http://blog.whatsapp.com/index.php/2013/12/400-million-stories/?lang=de 27 Kristin Burnham, Facebook’s WhatsApp Buy: 10 Staggering Stats, InformationWeek (Feb. 21, 2014), http://www.informationweek.com/software/social/facebooks-whatsapp-buy-10-staggering-stats-/d/did/1113927. 28 Joel Seligstein, See the Messages That Matter, Facebook Blog, Nov. 15, 2011, https://www.facebook.com/notes/facebook/see-the-messages-that-matter/452288242130. 29 Jan Jezabek, Steps Toward the New Messaging System, Facebook Blog, Nov. 2, 2011, https://developers.facebook.com/blog/post/591/ 30 Alex Wawro, Facebook Messages: Our First Look, PCWORLD, Nov. 15, 2010, http://www.techhive.com/article/210709/fbmessages_video1.html
In re: WhatsApp, Inc.
5
Federal Trade Commission March 6, 2014
21. Even when users delete a message, it continues to be stored on Facebook’s servers.31 22. Even when a user chooses not to send a message, Facebook still tracks what the user wrote.32 D. Facebook Routinely Incorporates Data from Companies It Has Acquired 23. Facebook has regularly collected user data from companies it acquires. 24. For example, when Facebook purchased Instagram in 2012, Instagram users were not subjected to advertisements based on the content they uploaded to the site.33 25. Like WhatsApp, Instagram’s Terms of Service included a provision that in the event of acquisition, users’ “information such as name and email address, User Content and any other information collected through the Service may be among the items sold or transferred.”34 26. After the acquisition, Facebook did in fact access Instagram users’ data and changed the Instagram Terms of Service to reflect this change. 35 E. Many WhatsApp Users Object to the Facebook Acquisition 27. Aliya Abbas, a Delhi-based mediaperson, said, “I started using WhatsApp five months ago. If it gets integrated with Facebook, I will uninstall [WhatsApp]. And I think others will do the same if this happens. WhatsApp is popular because of its
31
Zack Whittaker, Facebook Does Not Erase User-Deleted Content, ZD NET, Apr. 28, 2010, http://www.zdnet.com/blog/igeneration/facebook-does-not-erase-user-deleted-content/4808; Miranda Miller, Your Facebook Data File: Everything You Never Wanted Anyone to Know, Search Engine Watch, Oct. 3, 2011, http://searchenginewatch.com/article/2114059/Your-Facebook-Data-File-Everything-YouNever-Wanted-Anyone-to-Know. 32 Jennifer Golbeck, On Second Thought… Facebook Wants to Know Why You Didn’t Publish that Status Update You Started Writing, SLATE, Dec. 13, 2013, http://www.slate.com/articles/technology/future_tense/2013/12/facebook_self_censorship_what_happens_t o_the_posts_you_don_t_publish.html 33 Craig Timberg, Instagram outrage reveals a powerful but unaware Web community, WASH. POST, Dec. 21, 2012, http://www.washingtonpost.com/business/technology/instagram-outrage-reveals-a-powerful-butunaware-web-community/2012/12/21/b387e828-4b7a-11e2-b709-667035ff9029_story.html. 34 Id. 35 Hayley Tsukayama, Instagram reminds users of privacy policy change, WASH. POST, Jan. 16, 2013, http://www.washingtonpost.com/business/technology/instagram-reminds-users-of-privacy-policychange/2013/01/16/124a8712-5fee-11e2-9940-6fc488f3fecd_story.html
In re: WhatsApp, Inc.
6
Federal Trade Commission March 6, 2014
privacy, and I don't think users will like the idea of advertisements popping up in the middle of a conversation.”36 28. Columnist Carly Page wrote, “I'm a user of Whatsapp, and of course Facebook’s ridiculously expensive acquisition of the firm has got me concerned about my privacy, especially the fact that the social network likely now has access to my mobile phone number.”37 29. Journalist Tali Arbel wrote, “WhatsApp is my respite from Facebook. For me, the world's largest social network has become a junkyard of updates from people I don't really know and ads for products I don't care about. It's all about people jostling for publicity and craving approval, seeking likes and comments from near-strangers. But WhatsApp is the best stand-in for a conversation you have over dinner with people you love. It's intimate. It's personal. I rely on it. […] Facebook says it won’t run ads on WhatsApp. But I'm afraid they won't be able to help themselves. With all those food pictures, won't Facebook figure I want to see ads for restaurants and cookware? And will Facebook urge my ‘friends’ to connect with me on WhatsApp? Facebook has done something similar with Instagram, the photo-sharing app it has owned since 2012.”38 30. Corley Paige, a product developer from Austin, Texas, wrote, “I suddenly want to delete my Whatsapp. Hello Viber.”39 31. Twitter user Tara Aghdashloo wrote, “Facebook is like an evil parent that keeps finding the new hiding place for your diary.”40 32. User @tabandchord posted to Twitter, “Facebook + WhatsApp = The Ultimate Spying Machine #facebook #WhatsApp.”41 33. Some users of both WhatsApp and Facebook created a Facebook Page titled “Please Don’t Ruin WhatsApp.” Under the designation “Community description,”
36
Nitin Sreedhar, Status update: WhatsApp now a chapter in Facebook, BUSINESS STANDARD, Feb. 24, 2014, http://www.business-standard.com/article/technology/status-update-whatsapp-now-a-chapter-infacebook-114022300669_1.html. 37 Carly Page, Facebook’s Whatsapp buy is a privacy nightmare for users, but it makes sense for the social network, THE INQUIRER, Feb. 20, 2014, http://www.theinquirer.net/inquirer/opinion/2329985/facebookswhatsapp-buyout-is-a-privacy-nightmare-for-users-but-it-makes-sense-for-the-social-network. 38 Tali Arbel, My Love Affair With WhatsApp: Does It Have to End?, WASH. TIMES, Feb. 20, 2104, http://www.washingtontimes.com/news/2014/feb/20/my-love-affair-with-whatsapp-does-it-have-to-end. 39 Jessica Guynn, Users threaten to delete WhatsApp now that Facebook is buying it, LOS ANGELES TIMES, Feb. 19, 2014, http://www.latimes.com/business/technology/la-fi-tn-users-threaten-to-delete-whatsapp20140219,0,4153795.story#axzz2v7TZZFCR. 40 Twitter, https://twitter.com/taraaghdashloo/status/436272358312378371 (last accessed Mar. 5, 2014). 41 Twitter, twitter.com/tabandchord
In re: WhatsApp, Inc.
7
Federal Trade Commission March 6, 2014
the page creators posted, “Hey Facebook: Please don't ruin WhatsApp and make all of our message go through Facebook Messenger.” 42 F. Industry Experts Warn that the Merger Will Diminish User Privacy 34. Industry experts object to the Facebook acquisition because it allows Facebook access to the repository of mobile phone numbers that WhatsApp has collected. 35. Wim Nauwelaerts, a lawyer specializing in EU data protection law at Hunton & Williams, LLP in Brussels, told Bloomberg, “Facebook is not only buying a popular messaging app, it is also acquiring the addresses and telephone numbers of 450 million users worldwide. […] Many of these users are already signed up to Facebook, so through this deal Facebook will be able to build complete profiles on users.”43 36. St. John Deakins, the head of the online identity monitoring application Citizenme, said, “Facebook already has a very broad copyright license on people's content and already shares your data with many other services. Now with Facebook buying Whatsapp, this could see more and more private information becoming part of Facebook's database. From a personal data standpoint, this is extremely worrying.”44 37. Tim Grossman, a senior branding consultant at Brand Union, wrote in The Guardian: “One of the reasons why so many millions have flocked to WhatsApp is the added level of privacy the brand provides. In a world where your every word echoes endlessly across the internet it was a communication channel where sharing could take place on a more contained level. However, much like Google's acquisition of Nest and Facebook's of Instagram, with this purchase consumers are suddenly associated with, and have their information accessible by a brand that they didn't buy into. It's this intrusion that can make it feel uncomfortable, as both you and your data are seized without your say-so.”45
42 43
Facebook, Please Don’t Ruin WhatsApp, https://www.facebook.com/dontruinwhatsapp Stephanie Bodoni, Facebook WhatsApp Deal Risks Sparking Privacy Probes Across EU, BLOOMBERG, Feb. 25, 2014, http:// bloomberg.com/news/2014-02-25/facebook-whatsapp-deal-risks-sparking-privacyprobes-across-eu.html. 44 Samuel Gibbs, Six Alternatives to WhatsApp Now That Facbook Owns It, THE GUARDIAN, Feb. 20, 2014, http://www.theguardian.com/technology/2014/feb/20/six-alternatives-whatsapp-facebook. 45 Tim Gosman, Why WhatsApp is a worthy addition to the Facebook fold, THE GUARDIAN, http://www.theguardian.com/media-network/partner-zone-brand-union/facebook-acquisition-whatsappdamage-brand-privacy.
In re: WhatsApp, Inc.
8
Federal Trade Commission March 6, 2014
G. Facebook’s Acquisition of WhatsApp Implicates Safe Harbor Compliance 38. The Commission has previously issued an Order and Settlement Agreement with Facebook, following an investigation into whether “Facebook deceived consumers by telling them they could keep their information on Facebook private, and then repeatedly allowing it to be shared and made public.”46 39. In addition to requiring Facebook to give users “clear and prominent notice” and obtain “their express consent before sharing their information beyond their privacy settings,” and to maintain “a comprehensive privacy program to protect consumers’ information,” the Order also prohibited Facebook from misrepresenting the extent to which it participates in the US-EU Safe Harbor program.47 40. The Safe Harbor Framework is an industry-developed self-regulatory approach to privacy compliance.48 Coordinated by the Department of Commerce, the Safe Harbor program allows firms to self-certify privacy policies in lieu of establishing adequate privacy protections in the United States that regulate business practice. The Safe Harbor arrangements developed in response to the European Union Data Directive, a comprehensive legal framework that established essential privacy safeguards for consumers across the European Union.49 41. The Federal Trade Commission has been tasked with penalizing US firms that incorrectly claim current Safe Harbor certification.50 42. Currently, Facebook represents that it complies with the requirements of Safe Harbor program.51 H. European Data Protection Authorities Have Already Begun Investigations 43. Jacob Kohnstamm, the Dutch data protection Commissioner, has begun an investigation into data protection issues related to Facebook’s purchase of
46
In the Matter of Facebook, Inc., a corporation; FTC File No. 092 3184, FTC.gov (Dec. 30, 2011), http://www.ftc.gov/enforcement/cases-proceedings/092-3184/facebook-inc. 47 Id. 48 U.S. Dep’t of Commerce, Safe Harbor Privacy Principles, http://export.gov/safeharbor/eu/eg_main_018475.asp (last updated Jan. 30, 2009). 49 Directive 95/46/EC of the European Parliament and of the Council of Oct. 24, 1995 on the Protection of Individuals with Regard to the Processing of Personal Data and on the Free Movement of Such Data, 1995 O.J. (L 281) 31, available at http://eurlex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:31995L0046:EN:HTML. 50 Fed. Trade Comm’n, Bureau of Consumer Protection Business Center, US-E.U. Safe Harbor Framework, http://www.business.ftc.gov/us-eu-safe-harbor-framework (last accessed Mar. 6, 2014). 51 Facebook, Safe Harbor, https://www.facebook.com/safeharbor.php (last accessed Mar. 6, 2014).
In re: WhatsApp, Inc.
9
Federal Trade Commission March 6, 2014
WhatsApp.52 His investigation is focusing on the collection of data from WhatsApp users’ address books and the potential for misuse of that information.53 44. Thilo Weichert, the data protection commissioner for the German state of Schleswig-Holstein, has also begun an investigation into the acquisition.54 He told Bloomberg, “The mixing of data is strictly regulated by German law, especially through the Telemedia Act and the Federal Data Protection Act. Both acts rely on the principle of purpose binding, that data stored for one purpose cannot be processed for any other purposes - there are no such restrictions in the U.S.”55 45. Commissioner Kohnstamm, who served as the head of the European Union’s Article 29 Data Protection Working Party until February 27, 2014, said that any of the European Union’s “28 data protection regulators could open an investigation” into the acquisition as well.56 IV. Legal Analysis A. The FTC’s Section 5 Authority 46. The FTC Act prohibits unfair and deceptive acts and practices, and empowers the Commission to enforce the Act’s prohibitions.57 These powers are described in FTC Policy Statements on Deception58 and Unfairness.59 47. A trade practice is unfair if it “causes or is likely to cause substantial injury to consumers which is not reasonably avoidable by consumers themselves and not outweighed by countervailing benefits to consumers or to competition.”60 48. The injury must be “substantial.”61 Typically, this involves monetary harm, but may also include “unwarranted health and safety risks.”62 Emotional harm and
52 53
Gibbs, supra at 47. Id. 54 Jabeen Bhatti and Stephanie Bodoni, Facebook Purchase of WhatsApp Raises German, Dutch, Art. 29 Privacy Concerns, BLOOMBERG BNA, Mar. 3, 2014, http://www.bna.com/facebook-purchase-whatsappn17179882555. 55 Id. 56 Bodoni, supra at 46. 57 See 15 U.S.C. § 45 (2010). 58 Fed. Trade Comm’n, FTC Policy Statement on Deception (1983), available at http://www.ftc.gov/bcp/policystmt/ad-decept.htm [hereinafter FTC Deception Policy]. 59 Fed. Trade Comm’n, FTC Policy Statement on Unfairness (1980), available at http://www.ftc.gov/bcp/policystmt/ad-unfair.htm [hereinafter FTC Unfairness Policy]. 60 15 U.S.C. § 45(n); see, e.g., Fed. Trade Comm’n v. Seismic Entertainment Productions, Inc., Civ. No. 1:04-CV- 00377 (Nov. 21, 2006) (finding that unauthorized changes to users’ computers that affected the functionality of the computers as a result of Seismic’s anti-spyware software constituted a “substantial injury without countervailing benefits.”). 61 FTC Unfairness Policy, supra.
In re: WhatsApp, Inc.
10
Federal Trade Commission March 6, 2014
other “more subjective types of harm” generally do not make a practice unfair.63 Secondly, the injury “must not be outweighed by an offsetting consumer or competitive benefit that the sales practice also produces.”64 Thus the FTC will not find a practice unfair “unless it is injurious in its net effects.”65 Finally, “the injury must be one which consumers could not reasonably have avoided.”66 This factor is an effort to ensure that consumer decision making still governs the market by limiting the FTC to act in situations where seller behavior “unreasonably creates or takes advantage of an obstacle to the free exercise of consumer decisionmaking.”67 Sellers may not withhold from consumers important price or performance information, engage in coercion, or unduly influence highly susceptible classes of consumers.68 49. An act or practice is deceptive if it involves a representation, omission, or practice that is likely to mislead the consumer acting reasonably under the circumstances, to the consumer’s detriment.”69 50. There are three elements to a deception claim. First, there must be a representation, omission, or practice that is likely to mislead the consumer.70 The relevant inquiry for this factor is not whether the act or practice actually misled the consumer, but rather whether it is likely to mislead.71 51. Second, the act or practice must be considered from the perspective of a reasonable consumer.72 “The test is whether the consumer’s interpretation or reaction is reasonable.”73 The FTC will look at the totality of the act or practice and ask questions such as “how clear is the representation? How conspicuous is any qualifying information? How important is the omitted information? Do other sources for the omitted information exist? How familiar is the public with the product or service?”74
62
Id.; see, e.g., Fed. Trade Comm’n v. Information Search, Inc., Civ. No. 1:06-cv-01099 (Mar. 9, 2007) (“The invasion of privacy and security resulting from obtaining and selling confidential customer phone records without the consumers’ authorization causes substantial harm to consumers and the public, including, but not limited to, endangering the health and safety of consumers.”). 63 FTC Unfairness Policy, supra. 64 Id. 65 Id. 66 Id. 67 Id. 68 Id. 69 FTC Deception Policy, supra. 70 FTC Deception Policy, supra ; see, e.g., Fed Trade Comm’n v. Pantron I Corp., 33 F.3d 1088 (9th Cir. 1994) (holding that Pantron’s representation to consumers that a product was effective at reducing hair loss was materially misleading, because according to studies, the success of the product could only be attributed to a placebo effect, rather than on scientific grounds). 71 FTC Deception Policy, supra. 72 Id. 73 Id. 74 Id.
In re: WhatsApp, Inc.
11
Federal Trade Commission March 6, 2014
52. Finally, the representation, omission, or practice must be material.75 Essentially, the information must be important to consumers. The relevant question is whether consumers would have chosen another product if the deception had not occurred.76 Express claims will be presumed material.77 Materiality is presumed for claims and omissions involving “health, safety, or other areas with which the reasonable consumer would be concerned.”78 53. The FTC presumes that an omission is material where “the seller knew, or should have known, that an ordinary consumer would need omitted information to evaluate the product or service, or that the claim was false . . . because the manufacturer intended the information or omission to have an effect.”79 54. The Commission has previously found that a company may not alter the privacy settings of its users.80 55. The Commission has previously found that a company may not repurpose user data for a use other than the one for which the user’s data was collected without first obtaining the user’s “express affirmative consent.”81 56. In the FTC’s consideration of the Google acquisition of Doubleclick, where similar issues were raised about the impact on user privacy, the Commission allowed the merger to go forward, but only because the Commission found that the scope of its antitrust review did not encompass issues related to consumer privacy.82 57. In the Google acquisition of Doubleclick, Commissioner Harbor dissented and warned, “The truth is, we really do not know what Google/DoubleClick can or will do with its trove of information about consumers’ Internet habits. The merger creates a firm with vast knowledge of consumer preferences, subject to very little accountability.”83
75 76
Id. Id. 77 Id. 78 Id. 79 Cliffdale Associates, Inc., 103 F.T.C. 110, 110 (1984). 80 In the Matter of Facebook, Inc., a corporation; FTC File No. 092 3184, FTC.gov (Dec. 30, 2011), http://www.ftc.gov/enforcement/cases-proceedings/092-3184/facebook-inc. 81 In the Matter of Google, Inc.; FTC File No. 102 3136 (Oct. 13, 2011) (Decision and Order), http://www.ftc.gov/sites/default/files/documents/cases/2011/10/111024googlebuzzdo.pdf. 82 In the Matter of DoubleClick, Inc., FTC File No. 071-0170 (2000) (Statement of the Commission), http://www.ftc.gov/sites/default/files/documents/cases/2007/12/071220statement.pdf. 83 In the Matter of DoubleClick, Inc., FTC File No. 071-0170 (2000) (Dissenting Statement of Commissioner Pamela Jones Harbour), http://www.ftc.gov/os/caselist/0710170/071220harbour.pdf.
In re: WhatsApp, Inc.
12
Federal Trade Commission March 6, 2014
B. Count I: Deceptive Failure to Represent that WhatsApp’s Governing Principles of Anonymity and Privacy Were Subject to Reversal 58. As described above, WhatsApp represented to consumers that the company will not retain or repurpose information collected from their mobile phones. 59. As described in detail above, facts about WhatsApp’s philosophy of privacy and anonymity were material to users in their decision to install and use WhatsApp. 60. As described above, some users selected WhatsApp as a pro-privacy alternative to other messaging services. 61. Therefore, WhatsApp’s failure to adequately disclose that this commitment to privacy was subject to reversal constitutes a deceptive act or practice in violation of Section 5(a) of the FTC Act, 15 U.S.C. § 45(a). 62. Users could not reasonably avoid being aware of the inadequate disclosures regarding the potential for reversal of the privacy policy. 63. The inadequate disclosures are not outweighed by countervailing benefits to consumers or to competition. 64. WhatsApp’s inadequate disclosures constitute deceptive acts or practices in violation of Section 5 of the FTC Act, 15 U.S.C. § 45(a). C. Count II: Unfair Failure to Adequately Protect User Data In the Event of an Acquisition 65. As described in detail above, WhatsApp users reasonably expected that selecting WhatsApp would provide them with a privacy-protective messaging service. 66. As described in detail above, industry experts have identified that Facebook’s acquisition of WhatsApp will dramatically expand Facebook’s ability to gather user data. 67. As described in detail above, Facebook regularly collects and stores virtually all user information that it can extract. 68. By failing to make special provisions to protect user data in the event of an acquisition, WhatsApp “unreasonably creates or takes advantage of an obstacle to the free exercise of consumer decisionmaking.” 69. Specifically, WhatsApp users could not reasonably have anticipated that by selecting a pro-privacy messaging service, they would subject their data to Facebook’s data collection practices. In re: WhatsApp, Inc. 13 Federal Trade Commission March 6, 2014
70. The inadequate protections are not outweighed by countervailing benefits to consumers or to competition. 71. Therefore, WhatsApp’s inadequate disclosures constitute unfair acts or practices in violation of Section 5 of the FTC Act, 15 U.S.C. § 45(n). V. Prayer for Investigation and Relief 1. EPIC urges the Commission to investigate WhatsApp, Inc., and enjoin its unfair and deceptive data collection practices for any future changes to its privacy policy. 2. Specifically, EPIC requests the Commission to: a. Initiate an investigation of the proposed acquisition of WhatsApp by Facebook specifically with regard to the ability of Facebook to access WhatsApp’s store of user mobile phone numbers and metadata; b. Until the issues identified in this Complaint are adequately resolved, use the Commission’s authority to review mergers to halt Facebook’s proposed acquisition of WhatsApp; c. In the event that the acquisition proceeds, order Facebook to insulate WhatsApp users’ information from access by Facebook’s data collection practices; and d. Provide such other relief as the Commission finds necessary and appropriate.
In re: WhatsApp, Inc.
14
Federal Trade Commission March 6, 2014
Respectfully Submitted, Marc Rotenberg, EPIC Executive Director Julia Horwitz, EPIC Consumer Protection Counsel Ginger McCall, EPIC Associate Director Khaliah Barnes, EPIC Administrative Law Counsel Electronic Privacy Information Center 1718 Connecticut Ave. NW Suite 200 Washington, DC 20009 202-483-1140 (tel) 202-483-1248 (fax) Jeff Chester, CDD Executive Director Hudson Kingston, CDD Legal Director Center for Digital Democracy 1621 Connecticut Ave. NW Suite 550 Washington, DC 20009 (202) 332-2670 (tel)
In re: WhatsApp, Inc.
15
Federal Trade Commission March 6, 2014
