Blog

WhatsApp is reportedly secretly monitoring chat contents, despite publicly stating that there’s no content moderation policy in place

WhatsApp complies with requests from India and other governments for information about a user’s prospective message pairs or PMPs

PMP information, along with metadata of other chats, can be used to create a profile of a particular user based on their interactions with others

While WhatsApp was hit by a steep fine in the EU this week for not stating the extent of its user data sharing with Facebook, the messaging giant could be in for a whole lot more trouble after an investigative report into alleged chat content moderation being conducted secretly in the US and other parts of the world.

An extensive report by ProPublica highlighted that WhatsApp has been secretly monitoring chat contents, despite publicly stating that there’s no content moderation policy in place for WhatsApp. To be clear, WhatsApp’s moderators — employed by contractor Accenture — do not tamper with individual messages but can take action including banning accounts, deleting chat groups, if the company deems it necessary.

Is WhatsApp Spying On Users In India?

The data being collected and moderated by WhatsApp is said to include unencrypted chat data besides metadata of the conversation. As per the investigation, the information available to WhatsApp moderators includes the names and profile images of a user’s WhatsApp groups, their phone number, profile photo, status message, phone battery level, language and time zone, unique mobile phone ID and IP address, wireless signal strength, smartphone operating system, as well a list of all electronic devices that are connected to the smartphone. It also includes data related to linked or associated Facebook and Instagram accounts, as well as their WhatsApp usage history and any record of violations.

As per the report, WhatsApp complies with requests from some national governments for information about a WhatsApp user’s prospective message pairs or PMPs. This helps form a pattern or profile of the user’s messaging activity, which is shared with the US, the United Kingdom, Brazil and India. However, other countries might only receive “basic subscriber profile information” after requesting WhatsApp for user information.

The PMP information along with metadata of other chats can be used to connect users to each other and create a profile of a WhatsApp user based on their interactions with others.

This indicates that WhatsApp has differing standards of responding to government requests in various geographies. It also adds credibility to the claims that WhatsApp has deliberately offered users in India, a ‘weaker’ privacy policy than their European counterparts. This disparity in the privacy terms is a central point in the various lawsuits against the messaging app’s controversial privacy policy introduced in early 2021, but which is yet to be implemented due to various legal challenges.

Inc42’s questions to WhatsApp and Facebook regarding the content moderation remain unanswered.

What About End-To-End Encryption?

The company told ProPublica that it has teams of contractors around the world that review WhatsApp messages to identify and remove “the worst” abusers. These complaints to the moderators are raised by users by reporting messages in the app, or when the company’s automated artificial intelligence-based monitoring system flags content related to group chats, which are not end-to-end encrypted. “The decisions we make around how we build our app are focused around the privacy of our users, maintaining a high degree of reliability and preventing abuse,” a WhatsApp spokesperson said.

In response to the report, Indian tech industry lobbying group Atmanirbhar Digital India Foundation (ADIF) said that Facebook and WhatsApp have misled users on various issues pertaining to privacy, with this being the latest example.

ADIF’s executive director Sijo Kuruvilla George said that WhatsApp’s promise of end-to-end encryption and its recent marketing campaigns promoting this feature have been proven to be false. He added that the investigation shows that the company has an extensive monitoring operation and regularly shares personal information with prosecutors and law enforcement. The ADIF has called on the company to reveal its internal processes publicly, and inform users when chats are accessed for moderation.

“As a practice, companies ought to communicate their policies clearly to their users, and omitting a critical portion of it – like the fact that Facebook can access the users’ chats if it wishes to – is a clear case of subterfuge,” he added.

While Facebook has maintained that WhatsApp messages are only shared with its moderation team when users use the spam or abuse button feature in the app, it still weakens the argument that no one can see the chats between individuals. It also diminishes the validity of Facebook’s claims that only communication between users and businesses would be accessible under its new privacy policy.

WhatsApp Vs Indian Government

WhatsApp has sued the Indian government over the new IT rules and social media intermediary guidelines, which it claims hamper user privacy. WhatsApp has noted that the new policies will force the company to break its encryption, potentially revealing the identities of people that have sent messages through the platform.

“Civil society and technical experts around the world have consistently argued that a requirement to ‘trace’ private messages would break end-to-end encryption and lead to real abuse. WhatsApp is committed to protecting the privacy of people’s personal messages and we will continue to do all we can within the laws of India to do so,” WhatsApp had said in May this year, while taking the government to the Delhi high court.

India is WhatsApp’s largest market, with more than 400 Mn (reported in 2019) active users on the platform. The company added end-to-end encryption for private one-on-one chats in 2016, but lately governments, including India, have asked the company to allow for a provision to trace the origin of messages, even in an encrypted system.