A recent announcement by WhatsApp that a new privacy policy will become fully operative on 8 February 2021 (it has been extended to 15 May 2021), caused quite a stir about users’ data that may be shared. WhatsApp was purchased by Facebook and as with all other profit-driven companies, it allows for sharing of certain information of its users in order to provide them a better service. The following frequently asked questions may give some clarity.

Will personal data and messages be shared?

WhatsApp has made it clear that the privacy policy update does not affect the privacy of messages with family or friends. These messages (including photos, videos and so on) are protected by end-to-end-encryption that only allows the users in that conversation to see them.

The messages are stored on the devices of the users and not on the servers of WhatsApp. These messages will also not be shared with Facebook.

The only exceptions where messages will be stored on WhatsApp servers are in respect of:

• undelivered messages (which will then be removed from the WhatsApp servers once they delivered or after 30 days if undelivered); and
• media that is forwarded from other users to assist with more efficient additional forwards.

However, these messages and forwarded media remain encrypted to avoid WhatsApp and third parties from reading them.

Certain information may be shared by WhatsApp, such as a user’s username, profile photo, contact lists (if the contact upload feature is used), usage activity (such as last seen and other statistics), location (if the user allows this to be seen) and so on.

In respect of usage activity, WhatsApp does not store personal information of the users calling or messaging, but rather just the activities (how many calls or messages were received and so on).

Will private messages lead to more ads appearing on Facebook?

 WhatsApp is introducing more features specifically aimed at businesses, which include a service for businesses to host their messages on Facebook for marketing purposes. As such, when a client messages a business on WhatsApp, messages can be stored and managed through Facebook that allows conversations to be shared more generally with the business.

An example is that the business will advertise on Facebook and a client can click on a link to communicate with the business on WhatsApp. A client can also directly message a business on WhatsApp if they have the contact details of the business using these features.

Only if these features are used by a business, will information be shared with Facebook and that may influence the ads appearing on Facebook.

This means that discussions about a certain business or product through personal messages will not lead to ads appearing on Facebook.

When a client messages a business on WhatsApp that uses these features, they will be informed of this and can then make a decision to continue with the conversation or not.

Messages between a user and a business on WhatsApp will remain end-to-end encrypted and can only be seen by the user and the business.

What about a user’s payment details?

Facebook and WhatsApp are introducing features that allow for payments to be made through various methods. This will allow a user to upload credit card details (or other payment methods), which means that WhatsApp will have access to them (similar to any other online payment services).

It would appear that this type of information will only be shared with Facebook if a user decides to link the Facebook payment account with WhatsApp.

In South Africa, these features are not fully operational yet with only a few businesses using this.

For example, Telkom allows a user to add money to its account through the use of EFT/ATM and then it can be transferred to another user to be withdrawn at certain outlets (it does not require any credit card details). https://secure.telkom.co.za/today/shop/plan/telkom-pay-digital-wallet/

Is the Protection of Personal Information Act 4 of 2013 (“POPI”) taken into account?

WhatsApp and Facebook are based in the United States of America, which means that the laws of that country will apply.

POPI introduces strict measures to ensure the protection of personal information, however, only apply to information that is processed in South Africa.

Each user and business using WhatsApp in South Africa will have to ensure that they comply with POPI when processing a person’s personal information.

Are there any other apps similar to WhatsApp?

Signal and Telegram are the top two alternatives to WhatsApp.

Signal offers a number of security benefits compared to WhatsApp, such as end-to-end encryption, self-destructing messages, screen security and so on.

Telegram’s security does not seem to be as strong as WhatsApp’s in that there is no automatic end-to-end encryption (this means that apart from the users, Telegram can also view messages sent). A user can, however, decide to use a secret chat function that will have end-to-end encryption.

Similar to WhatsApp, Signal and Telegram may also work with third parties and share information with them (such as YouTube and Spotify), and they may also share information with their parent companies.

The respective Privacy Policies can be obtained at:

• Signal: https://signal.org/legal/ 
• Telegram: https://telegram.org/privacy 

In light of the above, WhatsApp does not store or share any private conversations between users due to end-to-end encryption. However, conversations may be kept and shared in respect of the business features and depending on whether the business uses them or not.

This sudden surge of users swapping between their main messaging apps can also have an impact on business. If businesses mainly relied on WhatsApp, they will need to take into account the usage preferences and means of their respective clients.

For further information, WhatsApp’s terms and conditions, privacy policy and so on can be obtained at https://www.whatsapp.com/legal/. 

The frequently asked questions on the privacy policy can be obtained at https://faq.whatsapp.com/general/security-and-privacy/answering-your-questions-about-whatsapps-privacy-policy/.