HomeArts & EntertainmentBooksExcerpt: What Privacy Means by Siddharth Sonkar

Excerpt: What Privacy Means by Siddharth Sonkar

Network Effects

On 4 January 2021, when WhatsApp announced an update of its privacy policy, it experienced a storm when millions of Indian users shifted to Telegram and Signal. The misinformation aside, the update, in fact, was primarily related to user interactions with businesses on WhatsApp. Yet, news publications wrongly assumed that WhatsApp had finally ‘crossed a line’, requiring users to share their personal data with Facebook Group companies with no alternative. WhatsApp was quick to clarify that the privacy policy did not significantly impact how individual users typically interact with each other, and this privacy policy update did not mean that Facebook could gain access to the users’ private WhatsApp chats.

However, the more significant update of WhatsApp’s privacy policy was released much earlier on 25 August 2016 when the app enabled the sharing of certain types of user account data (such as phone numbers, transaction information, IP address and so on) with Facebook. When the 2016 update was announced, WhatsApp users were asked to accept the terms by 25 September 2016 (cut-off date) in order to continue using WhatsApp, although pre-existing users (prior to this cut-off date) could opt out of this change. However, for over a billion users who joined WhatsApp after the cut-off date, the choice to opt out was not available.

In fact, in 2016, a petition was filed before the Delhi High Court challenging this update as a violation of the fundamental right to privacy of WhatsApp users in Karmanya Singh Sareen v. Union of India. In its order, the Delhi High Court directed WhatsApp to delete the complete information of users who exercised the option to opt out before the cut-off date. For existing users who did not opt out, the Delhi High Court directed that WhatsApp should not share their pre-existing information with Facebook or any other group company.

372pp, ₹599; Hachette

If pre-existing users decided to delete their WhatsApp account before the cut-off date, the complete information relating to such users was required by the Court to be deleted from WhatsApp’s servers, with the directions that it shall not be shared with Facebook or any other group company. Fast-forwarding to 2021, the new privacy policy (announced in 2021) omitted the following paragraph, which had previously allowed existing users to opt out:

The choices you have. If you are an existing user, you can choose not to have your WhatsApp account information shared with Facebook to improve your Facebook ads and products experiences. Existing users who accept our updated Terms and Privacy Policy will have an additional 30 days to make this choice by going to Settings > Account.

What perhaps added to the discomfort was an increased privacy consciousness in India since its recognition as a fundamental right. In the latest update, every WhatsApp user had to mandatorily agree to sharing their data with Facebook.

Noting the change in the privacy policy update in 2021, the Competition Commission of India (CCI) – which regulates anti-competitive practices (such as abuse of dominance) in the market – examined a complaint challenging WhatsApp’s 2021 update as ‘abuse of dominance’. The Commission took a prima facie (based on first impressions) view that this change in the privacy policy seemed to be an act of abuse of its dominant position in the market, and ordered a further probe into WhatsApp’s privacy policy, based on the following observations:

Whatsapp and the lockin effect (Shutterstock)
Whatsapp and the lockin effect (Shutterstock)

WhatsApp is the most widely used app for instant messaging in India. A communication network/platform gets more valuable as more users join it, thereby benefiting from network effects. The OTT messaging platforms not being interoperable, communication between two users is enabled only when both are registered on the same network. Thus, the value of a messaging app/platform increases for users with an increasing number of their friends and acquaintances joining the network. …This, in turn, causes a strong lockin effect for users, switching to another platform for whom gets difficult and meaningless until all or most of their social contacts also switch to the same other platform. Users wishing to switch would have to convince their contacts to switch and these contacts would have to persuade their other contacts to switch. Thus, while it may be technically feasible to switch, the pronounced network effects of WhatsApp significantly circumscribe the usefulness of the same. The network effects have been reflected when despite increase in downloads of the competing apps like Signal and Telegram, user base of WhatsApp apparently did not suffer any significant loss. …The second largest player in terms of market share in the relevant market of instant messaging and thus the next sizeable alternative available to users is Facebook Messenger, which too is a Facebook Group company. Thus, the conduct of WhatsApp/Facebook under consideration merits detailed scrutiny. (emphasis added)

In fact, in Europe, WhatsApp had to modify its privacy policy after the Irish Data Protection Authority imposed a fine of €225 million (Rs19,11,62,25,000) for sharing user data with Facebook.

Of course, the fears that WhatsApp would be sharing chats of users or encrypted information with Facebook were indeed unfounded and baseless. However, the metadata that was still being shared, according to experts, could also be quite revealing about a user. Sharing metadata with Facebook provides it with an enhanced view of the online communication activities and habits of users, running the risk of, for instance, private WhatsApp contacts to become more public Facebook connections. Given the sharing of such information across other Facebook group companies, which are likely to already have swathes of data of existing WhatsApp users available, pre-existing users should at least have had an option to opt out of the change in a privacy policy in 2021. Further, there are increased risks of how metadata and such information can be used to harm individuals, even if it is not personal data per se, as discussed later in the book. In fact, in France, where WhatsApp also sought to share user data with Facebook group companies, the French data protection agency – the Commission Nationale de l’Informatique et des Libertés (CNIL) – ruled that WhatsApp did not have a legal basis for such sharing and must cease the same within one month. In a press statement, the Article 29 Data Protection Working Party, an independent European expert advisory body on data protection, noted that though WhatsApp seeks to share information within the Facebook family of companies for a range of purposes, including marketing and advertising, these were not originally included within the privacy policy and terms of service when existing users signed up to use the service.

After the issuance of the CCI’s order, the Delhi High Court was subsequently approached by WhatsApp for a stay of the order. But the Court refused to stay further CCI investigations into WhatsApp’s privacy policy (which were ongoing at the time of writing this book).

Siddharth Sonkar, tech lawyer and author of What Privacy Means (Courtesy the publisher)
Siddharth Sonkar, tech lawyer and author of What Privacy Means (Courtesy the publisher)

Even if the 2021 update did not significantly alter WhatsApp’s privacy conditions, it is important to note that it lost, at least temporarily, millions of users as a consequence of the privacy policy update. News reports relating to the update led millions of people to shift to other platforms, such as Telegram and Signal. At the same time, however, while many users were disgruntled because of the ‘take it or leave it’ nature of the update, the mass migration was short-lived – by February 2021, downloads of Signal began to drop. While the decision to do away with the update in the privacy policy may have contributed to people wanting to remain on WhatsApp, what may have further prevented users from jumping ship was the absence of interoperability across instant messaging platforms – or the ability of users to communicate across different messaging platforms.

Today, imagining life without WhatsApp is indeed difficult. What makes it more so? Unlike how email clients work, wherein a Gmail user can send an email to an Outlook account, instant messaging platforms largely continue to lack interoperability, an idea significantly recognized by one of India’s most prominent regulatory bodies (such as the CCI, as discussed above) as well. When a messaging platform such as WhatsApp has a large volumes of users, and one’s family, friends and colleagues are all on the same platform, switching platforms would come at the cost of communicating with everyone else – unless one’s entire network also decides to switch platforms along with them. This is called ‘network effects’. The migration of users from WhatsApp to Signal may also have been caused by the same forces which brought users to WhatsApp in the first place – the desire to follow others, while also being uniquely interested in protecting one’s privacy. The absence of a law which mandates interoperability across platforms undermines the ability of users to exercise more privacy-friendly choices, since they are tied down by their networks.

Network effects give big technology platforms the ability to dominate the market, and equips them with enormous amounts of power over a person’s ability to refuse to consent to their terms, particularly if there are changes in the manner in which they are operating, or who they decide to share information with, as they continue to evolve, adapt and expand. But since with great power comes great responsibility, platforms should not be able to abuse their dominance by unilaterally introducing changes to their privacy policies, when users have no option but to consent.

“If you are not paying for the product, then you are the product” - common saying quoted in What Privacy Means (Shutterstock)
“If you are not paying for the product, then you are the product” – common saying quoted in What Privacy Means (Shutterstock)

Admittedly, Facebook has also supported and operationalized interoperability in messaging platforms. For instance, it recently launched cross-platform messaging between Instagram and Facebook Messenger users. There is also evidence that Facebook is working towards integrating Facebook Messenger and WhatsApp, enabling users to communicate across platforms. However, these endeavours seem to be limited to apps which belong to the Facebook group of companies, and are a part of the Facebook ecosystem itself. The absence of a law requiring that platforms remain interoperable even across competitors reduces any incentive for platforms that already enjoy network effects to enable users to communicate directly with competing platforms, so that there is a level playing field between both, from taking advantage of its network to preventing its competitors from existing.

Data Monopolies?

In April 2020, news that Facebook was about to acquire a stake of 9.99 per cent in Jio Platforms became public knowledge. Mukesh Ambani, chairperson of Reliance Industries Limited, highlighted the fact that one of the advantages of this deal would be the ability to integrate WhatsApp with JioMart. While the eventual collaboration seemed unclear, one could envision how JioMart would seek to leverage WhatsApp’s communication network to facilitate bringing potential customers on its platform. While both Facebook and Jio have access to incredible amounts of data through their respective customer databases, the extent to which they would share information with each other remained unclear. Facebook products, like Facebook and Instagram, share significant amounts of information with each other. While data sharing agreements exist with third parties for limited purposes, in the absence of a data protection law significantly limiting the extent of datasharing between entities, or a data protection authority to oversee the privacy implications of this deal, there is nothing beyond the good conscience of Reliance and Facebook preventing them from sharing data with each other.

Access this premium story for Free on the HT app

Enjoy unlimited digital access with HT Premium

Read unlimited premium stories for free on the All new and revamped HT App

Subscribe Now to continue reading

Stay Connected
Must Read
You might also like


Please enter your comment!
Please enter your name here