39 ms·

WhatsApp told to stop sharing user data with Facebook by French authorities

795 points by artsandsci 9y ago

gboudrias 9y ago
> “The only way to refuse the data transfer for “business intelligence” purpose is to uninstall the application,” the CNIL said in a statement. I mean, Facebook et al are a nightmare, but doesn't this statement apply to almost every app? Nevertheless, I'm sure Facebook is pretty annoyed right now, seeing as their main business goal seems to be "hoard all the data".
- soziawa 9y ago
  Well with WhatsApp being so popular in Europe it is almost impossible to uninstall it.
  - teekert 9y ago
    I'm taking baby steps towards Signal. I think 10% now of my regular "apping" is on Signal. There is still some on Telegram as well.
    - Brakenshire 9y ago
      I've been wondering about alternatives, do you find Signal to work well? Can non-technical people install and use it without problems?
      - tonyztan 9y ago
        My (non-technical) friends have found Signal to be mostly easy to use. You should give it a try yourself!
      - arkitaip 9y ago
        I gave Signal a try the other day and the installation and daily usage has been easy and straightforward, very similar to Viber, WhatsApp, etc. I just like the idea of a privacy first messaging app where I can send gifs through Gboard.
      - teekert 9y ago
        Indeed, Signal is nice, a bit lagging in features with respect to Telegram for example, and there are no Group admins which can lead to annoying situations (someone gets a new number, you keep getting error messages until the owner removes himself.) But it's minimal, fast and you have end-to-end encryption with no one storing you phone book (afaik). Self erasing messages can also be handy. I must admit I use that mainly to communicate to myself... for password or wallet public keys etc (desktop app to mobile and vice versa). I have also noticed that even phone calls to the other side of the world are crystal clear, really nice.
      - on_and_off 9y ago
        I have been pushing people towards Telegram (I have never tried Signal). It works a lot like WhatsApp so I don't think anybody has been confused by it.
      - mikehotel 9y ago
        They have made big improvements in their iOS app. One resolved issue that impacted usability was they used to send pics from the selector screen without confirmation, and this resulted in some funny/awkward situations in group chats. Winning people's confidence back is not easy to do, but they have done a remarkable job.
    - mancerayder 9y ago
      I love Signal but the reason why WhatsApp is so appealing is that there's a desktop client. I hate having to rely on my phone for texting people.
      - xwvvvvwx 9y ago
        Signal has a desktop client (mac / win / linux): https://signal.org/download/ https://signal.org/download/
      - mkmk 9y ago
        https://signal.org/blog/standalone-signal-desktop/ https://signal.org/blog/standalone-signal-desktop/ :-)
      - teekert 9y ago
        Well... read the reactions... It a cross platform electron app, works really well. I agree, it is a must have imo as well.
      - paimpozhil 9y ago
        Telegram is even better, has a nice desktop client which doesn't really depend on the mobile . Whatsapp's web client is just an UI to the mobile app meaning you also need to have phone connected to internet always for it to work. Telegram is much more responsive compared to the Whatsapp.
        pmlnr 9y ago
        Telegram is brilliant: small, fast, efficient client for virtually anything, including bitlbee. On the other side, it's probably hacked by most of the agencies, but to be honest: meh. Someone will spy on me anyway; at least I have an efficient, open source client, which isn't trying to spy on me every possible way.
        lucb1e 9y ago
        > it's probably hacked by most of the agencies umm... citation needed?
    - cJ0th 9y ago
      My advice would be Xmpp with OMEMO encryption. On mobile, you can get the Conversations App for Android via Fdroid (no google play!), for the iPhone there is Chatsecure and on the Desktop you can use Gajim. The advantage over Signal would be that 1.) you don't have to share your telephone number and 2.) you don't rely on a single service provider/accounts are decentralized (there are various services for free and paid accounts and you could also host your own server) e: Dear stranger, I'd be very interested in an explanation for your downvote. thanks!
      - StavrosK 9y ago
        I didn't downvote you, but I imagine the counterpoint goes something like "The advantage of Signal over your solution is that more than 3% of the population can set it up".
        JepZ 9y ago
        The 3% get a little larger when you give them this link (German) ;-) https://www.jabber.de/clients/android-ios/conversations-guide/ https://www.jabber.de/clients/android-ios/conversations-guid... But I agree: it should be even simpler to set up.
        StavrosK 9y ago
        Conversations does optimize for ease of use versus configurability, which is great, but most people have stuff to do, and figuring out what XMPP parameters to use etc isn't in that list. That's why making something that's as simple as possible is very important. Conversations could go even further and hide the XMPP details, connecting to (or creating an account on) a default server, and have the "advanced" settings behind a "I already have an XMPP account" link.
        fineng123 9y ago
        Lol he doesn't get it I think those types live in this world where everyone is savvy enough to do these things
      - 9y ago
    - mtgx 9y ago
      Get people to use Signal as a text messaging replacement app (the default Android one isn't that great anyway). Then, when they send you a message from it, the message will be E2E because you have Signal installed, too.
      - izacus 9y ago
        Signal severely breaks SMS handling on Android (it hijacks the store and stops reporting SMS to the OS, breaking backups, sync and other uses) so that's really not a good idea.
      - jorams 9y ago
        The problem with that approach is that in Europe (at least parts of it, I'm from the Netherlands and this probably doesn't apply to every single country), "text messaging" was largely replaced by WhatsApp. Getting someone to contact you over SMS instead of WhatsApp already requires a change in behavior. Once you have to explain to someone why you want them to contact you through something other than WhatsApp, the SMS angle is already irrelevant.
    - amelius 9y ago
      Who do you app with? Yourself? :)
  - rihegher 9y ago
    Once/If ethereum payment get popular message apps like toshi or status.im may get popular as well
  - lucb1e 9y ago
    I installed WhatsApp two months ago for the chat group of our class, and intend to uninstall it by June again when this study is over. On Telegram I have at least twenty chats active daily (people and several groups, and an HN bot). Everyone I want to talk to, except for that one class-wide group, is on Telegram. Even the people I do projects with in class have Telegram (I feel like there's a correlation to be drawn...), just not everybody had it so the class-wide group turned into a WhatsApp group and I had to acquiesce. It's not impossible to uninstall. I hear this sentiment from most people, and most people are surprised I can live without WhatsApp. I am surprised they're surprised: it's not a bother at all. Almost everybody that I wanted to talk to had Telegram already anyway, and the three or so others installed it (I mean, if you're selling your soul anyway, you might as well install another...). Even some of the IRC-based groups have bridges to Telegram (via bots that forward things in between), though I still run a bouncer so IRC would be no issue.
- deleted 9y ago
  [deleted]
- shakna 9y ago
  I believe with France's current laws, and the incoming EU GDPR, you must provide the opt-out as the same manner as the agreement was made. If that means you clicked an "I agree" button, then you must be able to easily find a page where you click, "I no longer agree".
  - bostik 9y ago
    More importantly, with GDPR you are not allowed to deny customers service even if they choose not to share their data.
    - e12e 9y ago
      ... Deny service if the customer no longer grants you access to personal data not essential for you to provide the service. A delivery address is essential in order to be able to deliver goods, shoe size is essential in order to deliver shoes - shoe size and address isn't essential in order to allow pseudonymous messaging. You are in general, not allowed to store personal data without "proper purpose" even with content - the GDPR has provisions against data mining.
kuschku 9y ago
» The CNIL said it had repeatedly asked WhatsApp to provide a sample of French users’ data transferred to Facebook but the company had explained it could not do so as it is located in the United States and “it considers that it is only subject to the legislation of this country.” « That's a very interesting quote from Facebook, and explains why the GDPR has a special section explaining that it also applies to foreign companies that process data of EU citizen. In general, Facebook is trying to set a dangerous precedent here. A company operating in our countries, taking our data, owning property in our countries, having employees in our countries, owning critical infrastructure in our countries (WhatsApp has basically replaced SMS and other messaging infrastructure), yet refusing to acknowledge the laws of the countries they operate in.
- marksomnian 9y ago
  > the GDPR has a special section explaining that it also applies to foreign companies that process data of EU citizen Is such a clause enforceable and/or valid? How could the EU punish a non-EU business for violating this? I guess they could block/get an injunction against them within the EU, but that seems like the sort of thing that would get challenged legally.
  - ainiriand 9y ago
    It looks to be the same situation with Apple's Irish Taxes, finally Apple had to comply.
  - germanier 9y ago
    There is nothing that would stop this legally (what authority should hinder them?). Things that can be enforced are only limited by practicality. Any non-EU business worth enforcing such a law against will very likely do business inside the EU (e.g. selling ads to local companies). Any money transferred can then be froozen to enforce this law. Facebook in particular does business as an Irish company for its EU users, so no problem at all here.
    - hartator 9y ago
lakechfoma 9y ago
Does anyone know what they do share besides phone number? And what could they share? I know end to end message encryption is a thing, but can the app still supply your messages or analysis of them to FB?
- skj 9y ago
  The who-spoke-to-whom-and-when data is... well certainly not nothing. Quite powerful, I'd think.
- soziawa 9y ago
  They say that they collect the following: "We collect device-specific information when you install, access, or use our Services. This includes information such as hardware model, operating system information, browser information, IP address, mobile network information including phone number, and device identifiers. We collect device location information if you use our location features, such as when you choose to share your location with your contacts, view locations nearby or those others have shared with you, and the like, and for diagnostics and troubleshooting purposes such as if you are having trouble with our app’s location features." The IP-Adress together with the facebook plugins on many websites allow lots of tracking.
  - lucb1e 9y ago
    You should also have a look at the logcat messages WhatsApp outputs. I got a forensics case two years ago in class where someone had WhatsApp installed and it was crazy: every time you unlock your phone or start charging or do anything at all, it is logged by that thing. I don't know whether they upload it, but if they aren't using it, why the hell are they monitoring and logging it otherwise?
- deleted 9y ago
  [deleted]
- drdrey 9y ago
  They can presumably not share the content of the messages, but they could share the metadata around them. Who you are connected to, how often you contact them, what time of day, potentially some location information, how long you spend in the app...
mikeokner 9y ago
I wonder what the legal argument is behind this ruling. If one newspaper acquired another, couldn't the parent then market to the subsidiary's subscribers even if they continued to operate separately? The parent now owns everything anyway.
- teekert 9y ago
  The argument is that WA always told us that they wouldn't share our data. This was a reason people signed up, you can't just "Oops we did it anyway" on so many people. At least not on People who have a government with their best interest in mind.
  - mikeokner 9y ago
    Is there legal precedent for "sharing" when the only entity you're providing the data to is your owner? Presumably if I bought WhatsApp, I would legally be allowed to query some database for someone's phone number if I so chose because I now own the database.
    - teekert 9y ago
      This piece is a nice argument for what FB/WA did wrong: https://www.engadget.com/2016/08/27/privacy-groups-call-foul-on-whatsapp-sharing-data-with-facebook/ https://www.engadget.com/2016/08/27/privacy-groups-call-foul...
    - Brakenshire 9y ago
      You do have to get specific permission to use data for a specific purpose under the GDPR. For instance, there are approved forms to ask customers for permission to add them to a mailing list. In that case, whether or not the company has the data stored somewhere is immaterial if it does not have the correct permission to use it for mailing.
    - soziawa 9y ago
      You could but you'd have to tell the users in the terms of service. If you tell them that you won't query the database and then go on and decide to do so anyways you'd get sued. With WhatsApp having a quasi monopoly on messaging it's difficult for the to change the terms of service without giving their opponents the argument that the change was forced.
Vosporos 9y ago
Yeah, finally :)
gourou 9y ago
> European data protection authorities can only impose small fines at the moment, but a new EU privacy law entering into force next year will increase fines to up to 4 percent of a company’s global turnover. Would it be 4% of Whatsapp's or FB's revenue?
- 1_2__4 9y ago
  FB's.
- notimetorelax 9y ago
  This is company’s global turnover, not product’s. So, up to 4% of the turnover in the entire company, since WhatsApp is wholly owned by FB, then it’s 4% of FB turnover. FB revenue for 2016 is 27B * 4% ~= 1B.
Kenji 9y ago
I uninstalled WhatsApp the moment it was bought by facebook. Foresight is 20/20.
abritinthebay 9y ago
The French system for protecting personal information should be a model for the rest of the world imo. (As an Englishman it pains me to say that) A company can never really “own” your data there. It merely can be lent it for very specific purposes. Using it outside of those purposes is punishable by law and that permission can be revoked. It’s very pro-citizen.
- rihegher 9y ago
  Well here this is the CNIL threatening to fine Facebook. The CNIL does not have much power though, and the worst that may happens for Facebook will be to be fine a few thousands euros.
  - laurent123456 9y ago
    Since 2004 they can fine up to 3 000 000 € [0]. Still not much for Facebook but better than a few thousands. More importantly, assuming the CNIL has a case, I assume Facebook has an obligation to comply (I guess they can't just pay the fine and keep doing whatever they were doing). [0] https://www.legifrance.gouv.fr/affichTexte.do?cidTexte=JORFTEXT000000441676&dateTexte=20040807 https://www.legifrance.gouv.fr/affichTexte.do?cidTexte=JORFT...
    - WJW 9y ago
      New EU privacy law has some rather more potent fines though: for intentionally violating some of the articles in the new regulations, the fine is 20m€ or 4% of revenue, whichever is the higher number.
      - mastax 9y ago
        the fine is up to 20m€ or 4% of revenue, whichever is the higher number.
- coliveira 9y ago
  This should be the law everywhere. The US, on the other hand, believes it is OK to provide ALL your personal information to big companies, see the debacle of Equifax that exposed data from most Americans to hackers throughout the world.
gourou 9y ago
the CNIL brief: https://www.cnil.fr/en/facebook-sanctioned-several-breaches-french-data-protection-act https://www.cnil.fr/en/facebook-sanctioned-several-breaches-...
- shakna 9y ago
  That seems to be an earlier case of Facebook being caught doing the wrong thing. This [0] seems to be the CNIL announcement. [0] https://www.cnil.fr/en/data-transfer-whatsapp-facebook-cnil-publicly-serves-formal-notice-lack-legal-basis https://www.cnil.fr/en/data-transfer-whatsapp-facebook-cnil-...
crb002 9y ago
No big deal. Just get an affirmative checkoff.
phjesusthatguy3 9y ago
Can corporations have "friends"? They're people, right? Can corporations have interpersonal relationships?
- erikpukinskis 9y ago
  Yes, but your friends don’t get automatic sublicenses to all of your IP licenses.
RestlessMind 9y ago
EU is one of my best hopes when it comes to privacy and really wish they start going after tech behemoths. I have given up on US authorities doing anything to reign them in. And policies in other significant countries (eg. China) would be even worse for user privacy.
- endisukaj 9y ago
  Not much they can do against tech behemoths based in the US though. They can stop them from gathering EU citizen data, or at least approve laws that try to stop them but who knows what is really happening behind the scenes.
  - RestlessMind 9y ago
    I believe if EU's laws are widely publicized and proved to be useful in EU countries, then there can be enough political pressure in the US. A tangential, but political relevant point: tech companies are in a particularly bad spot in the US because they are hated by both sides; republicans hate them because they are perceived as having liberal bias while democrats hate them because of tax avoidance, worsening inequality, job losses due to automation etc. So a political action against them would be easier to pull off compared to some other sectors like energy or finance.
    - dragonwriter 9y ago
      > I believe if EU's laws are widely publicized and proved to be useful in EU countries, then there can be enough political pressure in the US. Worked for universal healthcare, right?
      - deleted 9y ago
        [deleted]
      - RestlessMind 9y ago
        If universal healthcare had not worked in other countries, US wouldn't even have received Obamacare. The fact that other OECD countries have good healthcare systems means you have a significant chunk of population who clamors for a better system here and who stops politicians from gutting what we already have. I say wait for 10-15 more years and we will get universal healthcare in the US.
debt 9y ago
It's funny because the share price isn't reflecting these trends. As privacy laws become more strict, which seems inevitable given what's happening all across Europe, the data itself loses it's value. If the data loses it's value, having more of it, won't translate to having more value. Facebook/Google will just have more stuff they can't use, or more stuff they'll need to try and stretch further than they did before.
kahlonel 9y ago
I wonder what kind of data WhatsApp could be sharing with FB, given the fact that actual conversations are end-to-end encrypted. I imagine it could be something like 1) When do you sleep/wake-up, 2) Enumerating people in your social circle, 3) Guess what you're upto if you use the "Status" feature, and similar things. Now FB knows a LOT more than that about you. If you are an active FB user, it doesn't make sense to worry about what WhatsApp does to you.
- redial 9y ago
  Contacts. Now Facebook not only knows who you speak to online, but they also have access to the people and businesses you deal with in the 'real world' too.
  - acqq 9y ago
    Exactly. To use WhatsApp you have to let them copy all the contacts from the phone to their servers, and they do it all the time. Pity that e.g. Apple doesn't implement some special configuration for the privacy conscious users, which would allow me to: "give to the app1 only contacts a, b, c" and "give to the app2 only contacts e, f, g." At the moment all the apps that I use and which insist on access to the contacts get all the contacts you ever stored on your mobile phone. The apps should also not get my notes to the contacts, the birthdays of the contacts etc. Ideally Whatsapp should get only phone numbers, and only these that I want to give. In Android, Google should (it it hasn't) also implement this as a security feature, the benefit for them is: limit the access of the user's contacts to their competitors, by those users who'd use the feature (I don't use Android, is there something like that?). Anyway, by using WhatsApp, since lats year you give Facebook all the phone contacts which they will store and match even if you didn't want to give these to Facebook for Facebook.com or whatever. "“Privacy is incredibly important to WhatsApp. It’s why we collect very little data, and encrypt every message,” a spokeswoman for WhatsApp said." When "a little" is all your contacts in the phone, it's more than a little for Facebook.
  - makecheck 9y ago
    It’s far worse than that. If you and any two people in your list have done the same, then the app has just been given permission to a whole graph, and on and on. Connections are easy to link up. After awhile, it almost doesn’t matter if you give permission as long as they can infer a long list of possible connections based on everything else they know.
hkon 9y ago
I am thinking the EU don't want any companies to know more about it's citizens than they do themselves. Knowledge can after all be transferred to power.
code_duck 9y ago
I’ve noticed the data sharing between Instagram and Facebook, and purely as a user, it has been an annoyance so far. I had been cultivating the two as separate networks, to avoid the algorithm’s tunnel vision and interact with a wider circle of people. I never linked my IG and FB accounts together. I use both of them for my business as an artist, and have thousands of people that I’ve never met on both. On instagram, they started emphasizing the posts of people I had recently interacted with on Facebook, and vice versa. Presumably, the algo does this because it deduced I’m particularly interested in those people. It’s an incorrect guess and is actually the opposite of what I’m trying to achieve by using the two apps. When Instagram was purchased, I presumed that Facebook was going to slowly turning into Facebook and ruin it. It’s a typical story – a new product comes up that is successful or special for reasons that a large company can’t understand, and since they didn’t understand it enough to create it, once they own it, they can’t continue the recipe. Filtering the feed, ads, video, the snapchat copy, messaging... Turning Instagram into an extension of the Facebook network actually makes it a lot less useful. Once my parents are posting on there, I’m done.
- makecheck 9y ago
  A similar thing happened when Google+ tried to link accounts with YouTube, etc. When will companies figure out that a brand has value by itself and should not be auto-merged with the rest of the universe? It just makes me want to avoid doing pretty much anything, for fear of the next purchase out of my control just mixing things together.
smprk 9y ago
I believe a better policy is to have a completely transparent system between apps/services, where a user can check what is being shared, and when.
gimmeminusnow3 9y ago
Finally some country even can say anything about facebook!! Please, stop using this multinational human mind programming service. Check interviews of former bosses, what they say about facebooks mind terror!
kuceram 9y ago
Recently, I spoke to a guy who was working in IT department of one telco company and he told me that they did analysis on which platform (Facebook Messenger, Viber, WhatsApp) is mostly used based on number of data which flew through their infrastructure. I think regulations of big players is what small businesses and end users can profit of, definitely.
jerianasmith 9y ago
If French authorities have issued stringent guidelines about sharing of users data, that's a welcome step. If WhatsApp didn't have the legal basis to share data as claimed by CNIL, why were they doing it in the first place.

795 points by artsandsci 9y ago

> “The only way to refuse the data transfer for “business intelligence” purpose is to uninstall the application,” the CNIL said in a statement. I mean, Facebook et al are a nightmare, but doesn't this statement apply to almost every app? Nevertheless, I'm sure Facebook is pretty annoyed right now, seeing as their main business goal seems to be "hoard all the data".

soziawa 9y ago
Well with WhatsApp being so popular in Europe it is almost impossible to uninstall it.
- teekert 9y ago
  I'm taking baby steps towards Signal. I think 10% now of my regular "apping" is on Signal. There is still some on Telegram as well.
  - Brakenshire 9y ago
    I've been wondering about alternatives, do you find Signal to work well? Can non-technical people install and use it without problems?
    - tonyztan 9y ago
      My (non-technical) friends have found Signal to be mostly easy to use. You should give it a try yourself!
    - arkitaip 9y ago
      I gave Signal a try the other day and the installation and daily usage has been easy and straightforward, very similar to Viber, WhatsApp, etc. I just like the idea of a privacy first messaging app where I can send gifs through Gboard.
    - teekert 9y ago
      Indeed, Signal is nice, a bit lagging in features with respect to Telegram for example, and there are no Group admins which can lead to annoying situations (someone gets a new number, you keep getting error messages until the owner removes himself.) But it's minimal, fast and you have end-to-end encryption with no one storing you phone book (afaik). Self erasing messages can also be handy. I must admit I use that mainly to communicate to myself... for password or wallet public keys etc (desktop app to mobile and vice versa). I have also noticed that even phone calls to the other side of the world are crystal clear, really nice.
    - on_and_off 9y ago
      I have been pushing people towards Telegram (I have never tried Signal). It works a lot like WhatsApp so I don't think anybody has been confused by it.
    - mikehotel 9y ago
      They have made big improvements in their iOS app. One resolved issue that impacted usability was they used to send pics from the selector screen without confirmation, and this resulted in some funny/awkward situations in group chats. Winning people's confidence back is not easy to do, but they have done a remarkable job.
  - mancerayder 9y ago
    I love Signal but the reason why WhatsApp is so appealing is that there's a desktop client. I hate having to rely on my phone for texting people.
    - xwvvvvwx 9y ago
      Signal has a desktop client (mac / win / linux): https://signal.org/download/ https://signal.org/download/
    - mkmk 9y ago
      https://signal.org/blog/standalone-signal-desktop/ https://signal.org/blog/standalone-signal-desktop/ :-)
    - teekert 9y ago
      Well... read the reactions... It a cross platform electron app, works really well. I agree, it is a must have imo as well.
    - paimpozhil 9y ago
      Telegram is even better, has a nice desktop client which doesn't really depend on the mobile . Whatsapp's web client is just an UI to the mobile app meaning you also need to have phone connected to internet always for it to work. Telegram is much more responsive compared to the Whatsapp.
      - pmlnr 9y ago
        Telegram is brilliant: small, fast, efficient client for virtually anything, including bitlbee. On the other side, it's probably hacked by most of the agencies, but to be honest: meh. Someone will spy on me anyway; at least I have an efficient, open source client, which isn't trying to spy on me every possible way.
        lucb1e 9y ago
        > it's probably hacked by most of the agencies umm... citation needed?
  - cJ0th 9y ago
    My advice would be Xmpp with OMEMO encryption. On mobile, you can get the Conversations App for Android via Fdroid (no google play!), for the iPhone there is Chatsecure and on the Desktop you can use Gajim. The advantage over Signal would be that 1.) you don't have to share your telephone number and 2.) you don't rely on a single service provider/accounts are decentralized (there are various services for free and paid accounts and you could also host your own server) e: Dear stranger, I'd be very interested in an explanation for your downvote. thanks!
    - StavrosK 9y ago
      I didn't downvote you, but I imagine the counterpoint goes something like "The advantage of Signal over your solution is that more than 3% of the population can set it up".
      - JepZ 9y ago
        The 3% get a little larger when you give them this link (German) ;-) https://www.jabber.de/clients/android-ios/conversations-guide/ https://www.jabber.de/clients/android-ios/conversations-guid... But I agree: it should be even simpler to set up.
        StavrosK 9y ago
        Conversations does optimize for ease of use versus configurability, which is great, but most people have stuff to do, and figuring out what XMPP parameters to use etc isn't in that list. That's why making something that's as simple as possible is very important. Conversations could go even further and hide the XMPP details, connecting to (or creating an account on) a default server, and have the "advanced" settings behind a "I already have an XMPP account" link.
      - fineng123 9y ago
        Lol he doesn't get it I think those types live in this world where everyone is savvy enough to do these things
    - 9y ago
  - mtgx 9y ago
    Get people to use Signal as a text messaging replacement app (the default Android one isn't that great anyway). Then, when they send you a message from it, the message will be E2E because you have Signal installed, too.
    - izacus 9y ago
      Signal severely breaks SMS handling on Android (it hijacks the store and stops reporting SMS to the OS, breaking backups, sync and other uses) so that's really not a good idea.
    - jorams 9y ago
      The problem with that approach is that in Europe (at least parts of it, I'm from the Netherlands and this probably doesn't apply to every single country), "text messaging" was largely replaced by WhatsApp. Getting someone to contact you over SMS instead of WhatsApp already requires a change in behavior. Once you have to explain to someone why you want them to contact you through something other than WhatsApp, the SMS angle is already irrelevant.
  - amelius 9y ago
    Who do you app with? Yourself? :)
- rihegher 9y ago
  Once/If ethereum payment get popular message apps like toshi or status.im may get popular as well
- lucb1e 9y ago
  I installed WhatsApp two months ago for the chat group of our class, and intend to uninstall it by June again when this study is over. On Telegram I have at least twenty chats active daily (people and several groups, and an HN bot). Everyone I want to talk to, except for that one class-wide group, is on Telegram. Even the people I do projects with in class have Telegram (I feel like there's a correlation to be drawn...), just not everybody had it so the class-wide group turned into a WhatsApp group and I had to acquiesce. It's not impossible to uninstall. I hear this sentiment from most people, and most people are surprised I can live without WhatsApp. I am surprised they're surprised: it's not a bother at all. Almost everybody that I wanted to talk to had Telegram already anyway, and the three or so others installed it (I mean, if you're selling your soul anyway, you might as well install another...). Even some of the IRC-based groups have bridges to Telegram (via bots that forward things in between), though I still run a bouncer so IRC would be no issue.
deleted 9y ago
[deleted]
shakna 9y ago
I believe with France's current laws, and the incoming EU GDPR, you must provide the opt-out as the same manner as the agreement was made. If that means you clicked an "I agree" button, then you must be able to easily find a page where you click, "I no longer agree".
- bostik 9y ago
  More importantly, with GDPR you are not allowed to deny customers service even if they choose not to share their data.
  - e12e 9y ago
    ... Deny service if the customer no longer grants you access to personal data not essential for you to provide the service. A delivery address is essential in order to be able to deliver goods, shoe size is essential in order to deliver shoes - shoe size and address isn't essential in order to allow pseudonymous messaging. You are in general, not allowed to store personal data without "proper purpose" even with content - the GDPR has provisions against data mining.

kuschku 9y ago

» The CNIL said it had repeatedly asked WhatsApp to provide a sample of French users’ data transferred to Facebook but the company had explained it could not do so as it is located in the United States and “it considers that it is only subject to the legislation of this country.” « That's a very interesting quote from Facebook, and explains why the GDPR has a special section explaining that it also applies to foreign companies that process data of EU citizen. In general, Facebook is trying to set a dangerous precedent here. A company operating in our countries, taking our data, owning property in our countries, having employees in our countries, owning critical infrastructure in our countries (WhatsApp has basically replaced SMS and other messaging infrastructure), yet refusing to acknowledge the laws of the countries they operate in.

marksomnian 9y ago
> the GDPR has a special section explaining that it also applies to foreign companies that process data of EU citizen Is such a clause enforceable and/or valid? How could the EU punish a non-EU business for violating this? I guess they could block/get an injunction against them within the EU, but that seems like the sort of thing that would get challenged legally.
- ainiriand 9y ago
  It looks to be the same situation with Apple's Irish Taxes, finally Apple had to comply.
- germanier 9y ago
  There is nothing that would stop this legally (what authority should hinder them?). Things that can be enforced are only limited by practicality. Any non-EU business worth enforcing such a law against will very likely do business inside the EU (e.g. selling ads to local companies). Any money transferred can then be froozen to enforce this law. Facebook in particular does business as an Irish company for its EU users, so no problem at all here.
  - hartator 9y ago

lakechfoma 9y ago

Does anyone know what they do share besides phone number? And what could they share? I know end to end message encryption is a thing, but can the app still supply your messages or analysis of them to FB?

skj 9y ago
The who-spoke-to-whom-and-when data is... well certainly not nothing. Quite powerful, I'd think.
soziawa 9y ago
They say that they collect the following: "We collect device-specific information when you install, access, or use our Services. This includes information such as hardware model, operating system information, browser information, IP address, mobile network information including phone number, and device identifiers. We collect device location information if you use our location features, such as when you choose to share your location with your contacts, view locations nearby or those others have shared with you, and the like, and for diagnostics and troubleshooting purposes such as if you are having trouble with our app’s location features." The IP-Adress together with the facebook plugins on many websites allow lots of tracking.
- lucb1e 9y ago
  You should also have a look at the logcat messages WhatsApp outputs. I got a forensics case two years ago in class where someone had WhatsApp installed and it was crazy: every time you unlock your phone or start charging or do anything at all, it is logged by that thing. I don't know whether they upload it, but if they aren't using it, why the hell are they monitoring and logging it otherwise?
deleted 9y ago
[deleted]
drdrey 9y ago
They can presumably not share the content of the messages, but they could share the metadata around them. Who you are connected to, how often you contact them, what time of day, potentially some location information, how long you spend in the app...

mikeokner 9y ago

I wonder what the legal argument is behind this ruling. If one newspaper acquired another, couldn't the parent then market to the subsidiary's subscribers even if they continued to operate separately? The parent now owns everything anyway.

teekert 9y ago
The argument is that WA always told us that they wouldn't share our data. This was a reason people signed up, you can't just "Oops we did it anyway" on so many people. At least not on People who have a government with their best interest in mind.
- mikeokner 9y ago
  Is there legal precedent for "sharing" when the only entity you're providing the data to is your owner? Presumably if I bought WhatsApp, I would legally be allowed to query some database for someone's phone number if I so chose because I now own the database.
  - teekert 9y ago
    This piece is a nice argument for what FB/WA did wrong: https://www.engadget.com/2016/08/27/privacy-groups-call-foul-on-whatsapp-sharing-data-with-facebook/ https://www.engadget.com/2016/08/27/privacy-groups-call-foul...
  - Brakenshire 9y ago
    You do have to get specific permission to use data for a specific purpose under the GDPR. For instance, there are approved forms to ask customers for permission to add them to a mailing list. In that case, whether or not the company has the data stored somewhere is immaterial if it does not have the correct permission to use it for mailing.
  - soziawa 9y ago
    You could but you'd have to tell the users in the terms of service. If you tell them that you won't query the database and then go on and decide to do so anyways you'd get sued. With WhatsApp having a quasi monopoly on messaging it's difficult for the to change the terms of service without giving their opponents the argument that the change was forced.

Vosporos 9y ago

Yeah, finally :)

gourou 9y ago

> European data protection authorities can only impose small fines at the moment, but a new EU privacy law entering into force next year will increase fines to up to 4 percent of a company’s global turnover. Would it be 4% of Whatsapp's or FB's revenue?

1_2__4 9y ago
FB's.
notimetorelax 9y ago
This is company’s global turnover, not product’s. So, up to 4% of the turnover in the entire company, since WhatsApp is wholly owned by FB, then it’s 4% of FB turnover. FB revenue for 2016 is 27B * 4% ~= 1B.

Kenji 9y ago

I uninstalled WhatsApp the moment it was bought by facebook. Foresight is 20/20.

abritinthebay 9y ago

The French system for protecting personal information should be a model for the rest of the world imo. (As an Englishman it pains me to say that) A company can never really “own” your data there. It merely can be lent it for very specific purposes. Using it outside of those purposes is punishable by law and that permission can be revoked. It’s very pro-citizen.

rihegher 9y ago
Well here this is the CNIL threatening to fine Facebook. The CNIL does not have much power though, and the worst that may happens for Facebook will be to be fine a few thousands euros.
- laurent123456 9y ago
  Since 2004 they can fine up to 3 000 000 € [0]. Still not much for Facebook but better than a few thousands. More importantly, assuming the CNIL has a case, I assume Facebook has an obligation to comply (I guess they can't just pay the fine and keep doing whatever they were doing). [0] https://www.legifrance.gouv.fr/affichTexte.do?cidTexte=JORFTEXT000000441676&dateTexte=20040807 https://www.legifrance.gouv.fr/affichTexte.do?cidTexte=JORFT...
  - WJW 9y ago
    New EU privacy law has some rather more potent fines though: for intentionally violating some of the articles in the new regulations, the fine is 20m€ or 4% of revenue, whichever is the higher number.
    - mastax 9y ago
      the fine is up to 20m€ or 4% of revenue, whichever is the higher number.
coliveira 9y ago
This should be the law everywhere. The US, on the other hand, believes it is OK to provide ALL your personal information to big companies, see the debacle of Equifax that exposed data from most Americans to hackers throughout the world.

gourou 9y ago

the CNIL brief: https://www.cnil.fr/en/facebook-sanctioned-several-breaches-french-data-protection-act https://www.cnil.fr/en/facebook-sanctioned-several-breaches-...

shakna 9y ago
That seems to be an earlier case of Facebook being caught doing the wrong thing. This [0] seems to be the CNIL announcement. [0] https://www.cnil.fr/en/data-transfer-whatsapp-facebook-cnil-publicly-serves-formal-notice-lack-legal-basis https://www.cnil.fr/en/data-transfer-whatsapp-facebook-cnil-...

crb002 9y ago

No big deal. Just get an affirmative checkoff.

phjesusthatguy3 9y ago

Can corporations have "friends"? They're people, right? Can corporations have interpersonal relationships?

erikpukinskis 9y ago
Yes, but your friends don’t get automatic sublicenses to all of your IP licenses.

RestlessMind 9y ago

EU is one of my best hopes when it comes to privacy and really wish they start going after tech behemoths. I have given up on US authorities doing anything to reign them in. And policies in other significant countries (eg. China) would be even worse for user privacy.

endisukaj 9y ago
Not much they can do against tech behemoths based in the US though. They can stop them from gathering EU citizen data, or at least approve laws that try to stop them but who knows what is really happening behind the scenes.
- RestlessMind 9y ago
  I believe if EU's laws are widely publicized and proved to be useful in EU countries, then there can be enough political pressure in the US. A tangential, but political relevant point: tech companies are in a particularly bad spot in the US because they are hated by both sides; republicans hate them because they are perceived as having liberal bias while democrats hate them because of tax avoidance, worsening inequality, job losses due to automation etc. So a political action against them would be easier to pull off compared to some other sectors like energy or finance.
  - dragonwriter 9y ago
    > I believe if EU's laws are widely publicized and proved to be useful in EU countries, then there can be enough political pressure in the US. Worked for universal healthcare, right?
    - deleted 9y ago
      [deleted]
    - RestlessMind 9y ago
      If universal healthcare had not worked in other countries, US wouldn't even have received Obamacare. The fact that other OECD countries have good healthcare systems means you have a significant chunk of population who clamors for a better system here and who stops politicians from gutting what we already have. I say wait for 10-15 more years and we will get universal healthcare in the US.

debt 9y ago

It's funny because the share price isn't reflecting these trends. As privacy laws become more strict, which seems inevitable given what's happening all across Europe, the data itself loses it's value. If the data loses it's value, having more of it, won't translate to having more value. Facebook/Google will just have more stuff they can't use, or more stuff they'll need to try and stretch further than they did before.

kahlonel 9y ago

I wonder what kind of data WhatsApp could be sharing with FB, given the fact that actual conversations are end-to-end encrypted. I imagine it could be something like 1) When do you sleep/wake-up, 2) Enumerating people in your social circle, 3) Guess what you're upto if you use the "Status" feature, and similar things. Now FB knows a LOT more than that about you. If you are an active FB user, it doesn't make sense to worry about what WhatsApp does to you.

redial 9y ago
Contacts. Now Facebook not only knows who you speak to online, but they also have access to the people and businesses you deal with in the 'real world' too.
- acqq 9y ago
  Exactly. To use WhatsApp you have to let them copy all the contacts from the phone to their servers, and they do it all the time. Pity that e.g. Apple doesn't implement some special configuration for the privacy conscious users, which would allow me to: "give to the app1 only contacts a, b, c" and "give to the app2 only contacts e, f, g." At the moment all the apps that I use and which insist on access to the contacts get all the contacts you ever stored on your mobile phone. The apps should also not get my notes to the contacts, the birthdays of the contacts etc. Ideally Whatsapp should get only phone numbers, and only these that I want to give. In Android, Google should (it it hasn't) also implement this as a security feature, the benefit for them is: limit the access of the user's contacts to their competitors, by those users who'd use the feature (I don't use Android, is there something like that?). Anyway, by using WhatsApp, since lats year you give Facebook all the phone contacts which they will store and match even if you didn't want to give these to Facebook for Facebook.com or whatever. "“Privacy is incredibly important to WhatsApp. It’s why we collect very little data, and encrypt every message,” a spokeswoman for WhatsApp said." When "a little" is all your contacts in the phone, it's more than a little for Facebook.
- makecheck 9y ago
  It’s far worse than that. If you and any two people in your list have done the same, then the app has just been given permission to a whole graph, and on and on. Connections are easy to link up. After awhile, it almost doesn’t matter if you give permission as long as they can infer a long list of possible connections based on everything else they know.

hkon 9y ago

I am thinking the EU don't want any companies to know more about it's citizens than they do themselves. Knowledge can after all be transferred to power.

code_duck 9y ago

I’ve noticed the data sharing between Instagram and Facebook, and purely as a user, it has been an annoyance so far. I had been cultivating the two as separate networks, to avoid the algorithm’s tunnel vision and interact with a wider circle of people. I never linked my IG and FB accounts together. I use both of them for my business as an artist, and have thousands of people that I’ve never met on both. On instagram, they started emphasizing the posts of people I had recently interacted with on Facebook, and vice versa. Presumably, the algo does this because it deduced I’m particularly interested in those people. It’s an incorrect guess and is actually the opposite of what I’m trying to achieve by using the two apps. When Instagram was purchased, I presumed that Facebook was going to slowly turning into Facebook and ruin it. It’s a typical story – a new product comes up that is successful or special for reasons that a large company can’t understand, and since they didn’t understand it enough to create it, once they own it, they can’t continue the recipe. Filtering the feed, ads, video, the snapchat copy, messaging... Turning Instagram into an extension of the Facebook network actually makes it a lot less useful. Once my parents are posting on there, I’m done.

makecheck 9y ago
A similar thing happened when Google+ tried to link accounts with YouTube, etc. When will companies figure out that a brand has value by itself and should not be auto-merged with the rest of the universe? It just makes me want to avoid doing pretty much anything, for fear of the next purchase out of my control just mixing things together.

smprk 9y ago

I believe a better policy is to have a completely transparent system between apps/services, where a user can check what is being shared, and when.

gimmeminusnow3 9y ago

Finally some country even can say anything about facebook!! Please, stop using this multinational human mind programming service. Check interviews of former bosses, what they say about facebooks mind terror!

kuceram 9y ago

Recently, I spoke to a guy who was working in IT department of one telco company and he told me that they did analysis on which platform (Facebook Messenger, Viber, WhatsApp) is mostly used based on number of data which flew through their infrastructure. I think regulations of big players is what small businesses and end users can profit of, definitely.

jerianasmith 9y ago

If French authorities have issued stringent guidelines about sharing of users data, that's a welcome step. If WhatsApp didn't have the legal basis to share data as claimed by CNIL, why were they doing it in the first place.