WhatsApp, owned by Facebook, recently rolled out a mandatory update to its privacy policy, requiring users worldwide to accept the new terms by February 8, 2021, or face account deletion. This policy change, communicated via an in-app notification, stipulates that continued use of WhatsApp chats after this date necessitates agreement to the revised terms and privacy policy. The update significantly expands the scope of user data collected by WhatsApp and details increased sharing of personal information with Facebook companies and other third-party service providers, raising widespread concerns among its global user base.

A notable distinction in the new policy is its geographical application. Users located in the European region are explicitly exempt from these updated privacy rules. However, the mandatory data-sharing controls and enhanced collection practices apply to users in other regions, including Africa, Asia, and the Middle East. This selective implementation has intensified questions regarding the security and privacy of personal data for the billions of users affected by the changes.

Since its acquisition by Mark Zuckerberg's Facebook, WhatsApp has faced persistent criticism regarding its approach to user data privacy. Internal disagreements over data privacy issues reportedly brewed between WhatsApp founders and Zuckerberg, ultimately leading to the departures of co-founder Brian Acton in 2017 and former CEO Jan Koum a year later. Acton notably confessed in an interview with Forbes, "I sold my users’ privacy to a larger benefit. I made a choice and a compromise. And I live with that every day." Despite being the most widely used messaging app globally with over 2 billion users across 180 countries and more than 5 billion Google Play Store downloads, critics argue that user privacy appears to be secondary to financial objectives for Zuckerberg and his team.

The new privacy rules involve the collection of additional user data points, including battery level, hardware model, signal strength, and operating system information. Furthermore, WhatsApp will share various user data with other Facebook companies, such as Instagram, Oculus, and Threadsy. This shared data encompasses account registration details like phone number and mobile operator, transaction data, IP address, and mobile device information. A screenshot from WhatsApp’s policy explicitly illustrates this data-sharing agreement.

Given Facebook’s controversial history with alleged data misappropriation, the collection and sharing of such sensitive personal information present considerable risks. If this data falls into malicious hands, users could be exposed to dangers like data breaches. WhatsApp itself has experienced vulnerabilities; a cybersecurity breach last year reportedly put over 1 billion users at risk of data infringement by spyware. Sharing sensitive user details with Facebook companies, which are not entirely immune to security threats, increases the probability of data leaks to cybercriminals who could exploit this information for nefarious activities such as bank fraud and blackmail.

Regarding location data, users must grant permission for the app to collect location data from their device to utilize location-sharing features. However, the new policy indicates that even if users do not actively use the location-sharing feature, WhatsApp will still use IP addresses and other information, such as phone number area codes, to estimate a user’s general location. Security analysts have noted that WhatsApp can be susceptible to hacking via spyware apps. Consequently, many users are concerned about this mandatory passive collection of location data, fearing that malware could track it to WhatsApp’s database and harvest sensitive information about their residences or workplaces.

Moreover, the policy states that any information users share on WhatsApp Business may become available to all associated third-party service providers engaged by that business. In the event of a data breach, leaked confidential company information could severely damage a business's reputation and lead to significant financial losses.

In response to these privacy policy changes, many WhatsApp users, both individuals and businesses, are considering migrating to alternative messaging applications like Signal and Telegram. Signal, endorsed by Elon Musk and chaired by WhatsApp co-founder Brian Acton, is increasingly regarded as the most secure messaging app concerning user data privacy. Signal's privacy rules explicitly state that it does not collect or store any sensitive user information. The growing user exodus and public scrutiny may potentially prompt WhatsApp to re-evaluate and revise its new privacy policy to retain its vast user base.