WhatsApp, the world’s leading messenger with 2 billion users who sends 100 billion messages every day, has made secure messaging popular. But if you’re one of the hundreds of millions who use WhatsApp on an iPhone, you will be in for an unwelcome surprise when you see Apple’s stunning new iMessage update.
Getty
WhatsApp has always been about security. “Privacy and security are in our DNA,” it says, and it deserves credit for bringing the privacy of encrypted messages to the masses. But data security is complex – peek at the spooky patterns on a researcher’s desktop and you’ll understand: sometimes it’s not what we say that matters, it’s when, where, and who.
“Metadata – data about your data,” says Cyjax CISO Ian Thornton-Trump, “is almost as powerful as the actually data. “Who you know, who you message, when and how often. Who they know and messages. What other activity can be traced back to your user ID. It is this metadata that drives Facebook’s information mining machine. And that’s why there is so much nervousness about its plans for WhatsApp as it boosts monetization among all those users and integrates it with its other platforms.
Concerns about the collection of metadata via WhatsApp are not new. Take a look at the privacy policy and you will see how much data it collects. “We use all the information we have to help us operate, provide, improve, understand, customize, support and market our services,” it says, adding that “we share your information to help us serve , provide, improve, understand, customize, support and market our services. “
And then there is the Facebook factor. “As part of the Facebook family of companies,” the privacy policy says, “WhatsApp receives information from and shares information with this family of companies. We may use the information we receive from them, and they may share the information we share with them. use to help operate, provide, improve, understand, adapt, support and market our services and their offerings. “
And while your end-to-end encrypted content is not accessible, “your WhatsApp messages will not be shared on Facebook for others to see,” it confirms, there are those metadata. “Facebook may use information from us to improve your experience on their services, such as making product suggestions (for example, from friends or connections, or interesting content) and displaying relevant offers and advertisements.”
Cue Apple and its campaign to curb Facebook’s insatiable hunger for its users’ data. Much of this was discussed last summer. As my colleague Kate O’Flaherty explained at the time, this is a real “game-changer” for user privacy – removing tracking IDs and location maps that advertisers rely on. Tracking and cross-referencing browsing and social media activity is one thing, but what you do within the confines of apps is different: you have a captive audience there. And the reason there is now a messaging war for users is that these are the stickiest apps.
If I can link you to different apps using your personal identification information, phone number, or device ID, then I can link your metadata to anything else I know. As WhatsApp says, the metadata includes’ information about your activity … device-specific information … such as hardware model, operating system information, browser information, IP address, mobile network information including phone number and device IDs … We receive information that other people provide us , which may contain information about you. For example, if other users you know use our services, they can provide your phone number from their mobile address book (just like you can provide theirs), or they can message you, send messages to groups you belong to, or call you . “
You get the point. Apple’s stunning response to this undercurrent of metadata collection is the privacy labels, now live on the App Store. “On each app’s product page,” explains Apple, “users can learn more about some of the data types that an app can collect, and whether that data is associated with it or used to track it.” These labels launched last month and caused a furor between Apple and app developers whose data collection practices were now heavily exposed. Facebook led this charge, removing full-page ads to argue against Apple’s move.
The problem for WhatsApp is that when you claim that security and privacy are in your DNA, you open yourself up to an increased level of control. Suddenly, those concerns about collecting WhatsApp metadata became more real. Now we could easily see that WhatsApp collects the contacts on your phone, commercial data where you use Facebook services, device-based identifiers, your IP address which gives your location unless you use a VPN, and your usage logs. All linked to you.
WhatsApp has issued a statement in response to Apple’s privacy labels. “We need to collect some information to provide a reliable global communications service,” he said, “we basically minimize the categories of data we collect… we take steps to limit access to that information. allow access to your contacts to help you deliver the messages you send, but we do not share contact lists with anyone, including Facebook for your own use. “
WhatsApp was particularly outraged at what it saw as Apple’s inconsistency, telling Axios that “labels should be consistent across proprietary and third-party apps, as well as reflect the strong measures apps can take to read people’s private information is a Good start, we think it’s important for people to be able to compare these ‘privacy food labels’ of apps they download with pre-installed apps like iMessage. “
In a pretty grim example of being careful about what you wish for, Apple has updated its website and that same level of privacy information for iMessage is now live, with an astonishing contrast between iMessage and WhatsApp.
Apple ‘App Privacy’ labels
Apple App Store
And while all of them WhatsApp metadata is classified as “data associated with you”. The only iMessage metadata associated with a user’s identity is their email address, phone number, device ID, and search history. According to Apple, ‘data associated with you’ means that ‘the data is collected in a way that is linked to your identity, such as your account, your device, or your data – to indicate that data is being collected but not yours linked. a developer must use privacy protections, such as removing direct identifying information. “
In simple terms, any additional data that iMessage collects to monitor its platform and usage cannot be linked to individuals, whereas WhatsApp links everything back.
How you feel about WhatsApp’s data collection depends on your personal opinion of data privacy. Whatever that may be, think about the changes coming to WhatsApp, particularly in business messaging and shopping, as well as closer integration with Messenger and Instagram – though that’s likely to be slowed down by the antitrust action against Facebook that just started. started in the US.
WhatsApp is reportedly concerned that users won’t be bothered to check the privacy label for iMessage as it comes pre-installed. I think their concern should be that users shall do exactly that. And while iMessage is better, it comes nowhere near the industry-leading Signal, which has only one item of metadata – your own phone number – and even that “isn’t tied to your identity.” As for Facebook Messenger, I have repeatedly advised users to switch to an alternative.
Apple ‘App Privacy’ labels
Apple App Store
Kudos to Apple for these privacy labels, it’s a big step forward against consent abuse, where apps use our data for no good reason. And if you are an Android user, the situation is much worse. Permission abuse is much more common in the Android ecosystem, despite Android 11 finally starting to do something about it.
WhatsApp’s security is perfectly sufficient for almost all users. But metadata is a gray area and as we do more and more on these messaging platforms, its value will increase. This is your data and you have the right to ask why it is being collected and processed. If you believe that your data should not be harvested for no reason, now you have the tools to compare the alternatives.