The European Commission and EU consumer protection authorities have further escalated their investigation into messaging app WhatsApp, giving them a month to prove that it has not breached EU consumer protection rules.
The investigation began with a complaint filed by the European Consumers Organization (BEUC) and eight of its members in July 2021 in relation to a recently established mechanism called the Consumer Protection Cooperation Network.
The consumer groups accused WhatsApp of unfairly urging its users to accept its new privacy policy and terms and conditions by persistently bombarding them with a consent pop-up that failed to adequately explain the impact on personal data processing.
The European Commission took up the complaint, and in January WhatsApp received an official letter asking for clarification on how the app’s new privacy policy is compatible with EU consumer law and the sharing of personal data with parent company Meta.
The letter marked the start of a regulatory dialogue, which lasted until the end of February, during which EU and national authorities could request WhatsApp for details on how it informed consumers about policy changes.
The dialogue did not settle matters, however, as the Commission and consumer advocates sent WhatsApp another letter on Wednesday (8 June) asking the tech company to clarify outstanding concerns.
More specifically, the messaging app is asked to show within a month how it intends to communicate future updates to its terms of service. Consumer law requires users to be informed of the impact of such updates and to be free to choose whether to continue using the app.
“WhatsApp needs to ensure that users understand what they accept and how their personal data will be used for commercial purposes, in particular to offer services to business partners,” Justice Commissioner Didier Reynders said in a statement.
“I reiterate that I expect WhatsApp to fully comply with EU rules protecting consumers and their fundamental rights,” Reynders added.
According to the Commission, WhatsApp has demonstrated that it provided users with the required information through in-app notifications and its helpdesk. However, the manner in which the update was carried out was seen as problematic, as the information was provided in an insistent, inadequate and confusing manner.
Although data protection falls within the purview of data protection authorities, its close connection to consumer law means that consumer protection authorities have taken an interest in WhatsApp’s data processing practices and the way users have been informed about them.
In particular, the tech company first had to clarify how it shared data with its parent company Meta and whether its business model included monetization of user data. For its part, WhatsApp emphasizes that its primary business model is focused on business messaging.
“Our 2021 update has not changed our commitment to user privacy or the way we operate our service, including how we process, use or share data with others, including Meta,” a WhatsApp said – Spokesman to EURACTIV.
[Edited by Alice Taylor]