FTC Notifies Facebook, WhatsApp of Privacy Obligations in Light of Proposed Acquisition

The director of the Federal Trade Commission’s Bureau of Consumer Protection notified Facebook and WhatsApp about their obligations to protect the privacy of their users in light of Facebook’s proposed acquisition of WhatsApp.

In a letter to the two companies, Bureau Director Jessica Rich noted that WhatsApp has made clear privacy promises to consumers, and that both companies have told consumers that after any acquisition, WhatsApp will continue its current privacy practices.

“We want to make clear that, regardless of the acquisition, WhatsApp must continue to honor these promises to consumers. Further, if the acquisition is completed and WhatsApp fails to honor these promises, both companies could be in violation of Section 5 of the Federal Trade Commission (FTC) Act and, potentially, the FTC’s order against Facebook,” the letter states.

In 2011, Facebook settled FTC charges that it deceived consumers by failing to keep its privacy promises. Under the terms of the FTC’s order against the company, it must get consumers’ affirmative consent before making changes that override their privacy settings, among other requirements.

The letter notes that before making any material changes to how they use data already collected from WhatsApp subscribers, the companies must get affirmative consent. In addition, the letter notes that the companies must not misrepresent the extent to which they maintain the privacy or security of user data. The letter also recommends that consumers be given the opportunity to opt out of any future changes to how newly-collected data is used.