End-to-end encryption? Confusion over WhatsApp’s data collection

WhatsApp cannot share its old user data with Facebook or any other platform, the Delhi high court ruled on Friday while allowing the popular instant messaging app to roll out a new privacy policy on September 25.

The court order came on a petition challenging WhatsApp’s announcement in August that it would start sharing users’ account information such as phone number with parent company Facebook, marking a notable shift in its privacy policy.

But the real question is what data was the company planning to collect and in what way if all messages are end-to-end encrypted. More thought provoking is the argument that how is it supposed to help Facebook target better advertisements. Although WhatsApp is yet to come out with a clarification, analysts are given to believe that WhatsApp is more into profiling users rather than actually try and read what content people are sending.

“I think the confusion is in the fact that WhatsApp has not explained what kind of data it wants to collect which could range from anything like a phone number to a metadata. Simply put, metadata is a collection of data that presents a complete picture. In WhatsApp, metadata would mean something like the time, duration of usage, the kind of content shared and the amount of cellular or WiFi data used in a particular session,” Prosanto K Roy, an independent technology expert, said.

“I think WhatsApp wants to share metadata, phone number and other stuff which are not end-to-end encrypted to create a profile of a user to know certain behavioural patterns to target them with right advertisements or understand if they are a data heavy user or not. Metadata analysis can do all that easily,” he explained adding that “WhatsApp groups will be the key source of such information as most consumption or chats happen in a group.”

It is important to note that all WhatsApp users in a group have to have the latest version of the app to make the group communication eligible for end-to-end-encryption.

The messaging app, which Facebook acquired in 2014, gave users a 30-day period to choose if they wanted to share information with the social network or opt out before the old policy expires on September 25.

However, two Delhi-based users challenged the WhatsApp’s announcement in the high court, saying it severely compromises the rights of its users. Hearing their petitions, a bench headed by Chief Justice G Rohini directed WhatsApp not to share any user data collected till September 25, 2016, with Facebook or any other related company.

The court said WhatsApp must delete user data of anybody who chooses to opt out of the app before its new privacy policy kicks in.

“We are of the view that it is always open to the users of WhatsApp, who do not want their information to be shared with Facebook, to opt for deletion of their account,” the court said.

Also, the court directed the government to see if there is a need to bring instant messaging apps such as WhatsApp under the statutory regulatory framework.

(With inputs from Soibam Rocky Singh)