In its statement, the European Commission said that WhatsApp has committed to giving users the “possibility to reject the updated terms of service,” even if that means they forfeit its services. “Also, WhatsApp confirmed that users’ personal data are not shared with third-parties or other Meta companies — including Facebook — for advertising purposes,” the press release added. The EU Commissioner for Justice Didier Reynders welcomed WhatsApp’s promises, saying that “consumers have a right to understand what they agree to and what that choice entails concretely, so that they can decide whether they want to continue using the platform.” These changes are required by laws like the Digital Services Act, which complements the Unfair Commercial Practices Directive, and the overarching EU General Data Protection Regulation “ensuring that no regulatory gap is left for platforms to manipulate users.” WhatsApp experienced a mass user exodus in 2021 as a direct result of the changes in its Privacy Policy and Terms of Service. It had also been fined €225 million that year for failing to meet EU transparency requirements, i.e. incorrectly collecting and using user data.
The CPC Network’s Letters to WhatsApp
The CPC Network (Consumer Protection Cooperation) first reached out to WhatsApp in Jan. 2022 via a letter — before the dialogue with the EU — which the network wrote as a result of a July 2021 alert by the European Consumer Organisation (BEUC) and eight other member associations “on alleged unfair practices the context of WhatsApp’s updates to their terms of service and privacy policy.” “For several months now, WhatsApp has been unduly pressuring its users to accept its new terms of service and privacy policy. Yet these terms are neither transparent nor comprehensible for users,” the BEUC said in July 2021. The CPC Network was not satisfied with WhatsApp’s reply to its first letter in March 2022, saying it was “not convinced by the company’s clarifications on the concerns raised by the Network.” A second letter was sent out in June 2022, which echoed the first, reminding WhatsApp to be transparent about its business model and asking if it “derives revenues from commercial policies relating to users’ personal data.”
WhatsApp’s Commitments in Brief
For all future policy updates, WhatsApp told the CPC Network that it will commit to the following affecting its two billion users:
To precisely explain what is being changed and how this affects users’ right To allow users to reject any updated terms of service To allow update notifications to be dismissed or their review to be delayed To respect users’ choices and not send repetitive notifications
What Happens Next, Addressing ‘Dark Patterns’
The next steps include the CPC’s monitoring of how WhatsApp approaches its promises and the enforcement of compliance, which includes the possibility of imposing fines. Furthermore, the press release noted the appearance of “dark patterns,” in many company business models. Dark patterns are when companies make it “more difficult to unsubscribe from a service rather than to subscribe to it,” the press release said. “The CPC Network, with the support of the Commission, will continue to intensify their efforts to address such illegal practices when they occur.” WhatsApp is not the only company being scrutinized by European authorities. Since 2019, Big Tech companies like Google, TikTok, Facebook, and Twitter have all been pressured to ensure compliance with EU consumer rules. New EU legal frameworks like the Digital Markets Act (DMA), the Digital Services Act (DSA), the AI Act, and the Data Act promise to throttle Big Tech competition responsibilities as well as offer a fairer data ecosystem, Stanford University’s Cyber Policy Center international policy director Marietje Schaake remarked in April 2022 — a landmark year in the EU’s crackdown on Big Tech domination. For a deep dive into the world’s toughest data protection and regulation act, the GDPR, have a look at our 2023 GDPR compliance checklist.
