August 29, 2023, 10:48 am | Read time: 5 minutes
WhatsApp is currently notifying its users about a new privacy policy. Personal data is being collected for purposes such as direct marketing. Those who wish to exercise their right to object face an odyssey of numerous steps and discouraging language.
Meta and the topic of data protection share a long, conflict-ridden history. Through Facebook, WhatsApp, and Instagram, the parent company gains access to a large amount of user data, which is supposed to be handled in compliance with the GDPR. Supposedly. However, due to recurring deficiencies, WhatsApp recently had to revise its privacy policies. This happened on July 17, and since then, users have been gradually informed. Those who do not wish to agree to WhatsApp’s new policies can now object. But it’s more complicated than expected. TECHBOOK explains what to consider when filing an objection–and why it’s still worthwhile.
Overview
WhatsApp versus GDPR
The General Data Protection Regulation (GDPR) is part of EU law and regulates, among other things, how companies handle their users’ personal data. TECHBOOK has already discussed the latest adjustment to WhatsApp’s privacy policy with media law expert Christian Solmecke. Solmecke expressed concerns about the current policy, as it requires users to actively object (Opt-Out) rather than give active permission (Opt-In) for data processing.
Specifically, WhatsApp wants to obtain users’ permission under the new policies to use their data within the framework of “legitimate interests.” This presents two pitfalls: Users give their permission passively by doing nothing. This may seem convenient at first, but it results in many users being unaware of the rights they are granting WhatsApp. The other issue lies in the vague term “legitimate interests.” In its help section, WhatsApp specifies the purposes for using personal data as follows:
- Business intelligence and analytics.
- Storing and sharing information with others, including law enforcement, and responding to legal requests.
- Storing and sharing information when seeking legal advice or protecting ourselves in the context of legal proceedings or other disputes.
- Promoting safety and integrity outside of fulfilling our contract with you.
- Improving WhatsApp customer support.
- Enhancing WhatsApp services by developing new features or updating existing ones.
This initially doesn’t sound unusual. However, somewhat hidden in a paragraph below this list is the truly interesting part: “You also have the option at any time to object to the processing of your personal data for the purpose of direct marketing–regardless of the legal basis for the processing.” WhatsApp itself emphasizes to TECHBOOK that the update to the privacy policy on July 17 did not change anything regarding direct marketing. This point has been part of the policy for some time.
Opt-Out Method in Data Processing Not Legal
Solmecke points out to TECHBOOK a ruling by the European Court of Justice (ECJ) from July 4, 2023, which does not recognize “the personalization of advertising as a legitimate interest [for] data processing” (Case C‑252/21). “Instead, Meta will have to obtain voluntary and active consent from its users,” says the media law expert. It is therefore likely only a matter of time before WhatsApp will have to adjust its current privacy policy to comply with the GDPR again. Until then, however, users can object to the processing of their data.
Lawyer Warns: Microsoft Teams Location Tracking May Be Illegal
Why Some Consumers Pay More Online Than Others
The Long Road to Objection
To object to WhatsApp’s privacy policy, you must either click on the notification banner or visit WhatsApp’s FAQ website. From there, you can access a form–after allowing or prohibiting the mandatory cookies. Here, you can choose from various options, including: “How can I delete my information?” or “How can I object to the processing of my information?”
Clicking on the latter opens a tab where the different areas of data processing are listed again. And here, too, the problematic aspect–data processing for personalized advertising–is hidden and separated from the other listings.
Before finally clicking on “I want to object,” WhatsApp tries to redirect you to the original FAQ page again. Here, you can review the individual steps for objection. WhatsApp also announces at this point that you should specify exactly which data processing you are objecting to. According to its own statements, WhatsApp can reject the objection if it does not relate to direct marketing but to one of the other mentioned aspects.
Furthermore, according to the guidelines, you should also justify your objection and explain “how the processing affects you (which rights and freedoms you believe are impaired by the processing and why).” WhatsApp has made a great effort to make the instructions as cumbersome and discouraging as possible. Those who wish to object to data processing for direct marketing do not need to justify it under Article 21, Paragraph 2 of the GDPR.
Don’t Be Discouraged
Finally clicking on “I want to object,” you must provide an email address and the phone number of the WhatsApp account in a form. You will then receive an email with the same request as on the website: You should specify which data processing you want to object to and justify the objection. Theoretically, the objection to data processing for direct marketing should be possible without justification. Those who want to be sure in their wording can refer to the sample letter from the Consumer Protection Center.
Once the email is sent, it’s a waiting game. WhatsApp will review the objection but reserves the right to skip the review if the user has not provided “sufficient information.” This wording should not be discouraging. If the objection to data processing for direct marketing is granted, WhatsApp will cease the data processing.