WhatsApp: A case study in consumer trust

WhatsApp’s reputation as a secure messaging platform came crashing down earlier this year, when a new data-sharing policy not only drew the ire of its users, but broke their trust as well.

In January 2021, WhatsApp users received a push notification requiring them to accept new privacy terms in order to continue using the app. The terms introduced data sharing between WhatsApp and Facebook that would allow businesses to use shared resources across the two platforms to enable ecommerce and payment transactions.

But users interpreted the privacy update to mean that Facebook could now read their messages or listen to their calls. However mistaken users were about the update, their expectations for privacy protection were disrupted.

The challenge: WhatsApp had always positioned itself as a privacy-friendly, secure messaging service, stating on its website, “Privacy and security is in our DNA.” But a policy change was necessary if it wished to monetize its service.

When Facebook acquired WhatsApp for $19 billion in 2014, the service lacked a business model. During the acquisition, Facebook assured EU regulators that there would be no data sharing to match user accounts between the parent company and the encrypted messaging platform.

Two years later, however, WhatsApp policy updates suggested data would be shared for certain personalization and ad-targeting features, leading EU regulators to further investigate the terms of the merger and fine the company.

Further data integration plans were put on an “EU Pause” until data sharing between the two platforms complied with the General Data Protection Regulation (GDPR). Since 2016, the app has shared details like phone numbers with Facebook to improve its own recommendations and ads.

The strategy: WhatsApp bungled this policy rollout. Users misinterpreted the new terms because the messaging wasn’t clear. And the platform’s ultimatum—accept or stop using WhatsApp altogether by the deadline—was aggressive.

WhatsApp had to clarify that data sharing affected only content sent between users and businesses for the purposes of managing those transactions. It sent countless clarifying messages and post FAQs assuring users that neither it nor Facebook would have access to their encrypted messages.

It also delayed the rollout from February 8 to May 15 to address user backlash and allow more time for review. Instead of having their accounts deactivated or shut down, users who did not accept the new terms would gradually lose functionalities on the platform, WhatsApp announced.

Competitive impact: Downloads of competing messaging apps Signal and Telegram soared in the ensuing weeks. There were roughly 7.5 million downloads of Signal worldwide from January 6 to 10, over 40 times more than the preceding week, according to Sensor Tower data. During the same period, Telegram was downloaded 5.6 million times, per Apptopia.

In Brazil, where we estimate WhatsApp has 99.8% market penetration among mobile phone messaging app users, a quarter of internet users said the policy changes were an invasion of or disrespectful to their privacy, according to a February 2021 Toluna survey. The survey also found that 13.7% of respondents planned to stop using WhatsApp because of the changes.

WhatsApp’s policy rollout still faces great uncertainty, especially in its largest market, India. Courts there are evaluating whether the new policies violate India’s technology and privacy laws on several counts, because the policies allegedly fail to specify the nature of user data being collected or to notify users about that collection. The government stated it has “grave concerns” that WhatsApp has not given users in India the choice to opt out of this data sharing.

In Germany, regulators have declared that Facebook can no longer process WhatsApp user data, which decision will likely go on to be reviewed by the European Data Protection Board.

Network effects are strong. We have yet to see if WhatsApp’s market share has been materially affected in geographies where it dominates, but the spike in downloads for its competitors suggests that consumers are willing to take at least some of their secure messaging business elsewhere.

Our take: Communication is everything. WhatsApp’s privacy policy rollout was bungled because it was an affront to user expectations. When a company builds its name on trust, security, and privacy, it must continue to meet and exceed consumer expectations for those values.