The Federal Trade Commission published a letter on Thursday reminding Facebook(s fb) and WhatsApp about privacy obligations, an unusual move that reflects the agency’s ongoing concern about how tech companies use consumer data. The letter came the same day that Facebook confirmed that the agency had approved its $19 billion acquisition of the popular messaging service.
The letter, addressed to the chief lawyers at the respective companies, stated that Facebook must abide by the more stringent privacy promises that WhatsApp made to its users if the giant social network completes its acquisition of the popular messaging service.
In the letter, the FTC’s Director of Consumer Protection, Jennifer Rich, said:
WhatsApp has made a number of promises about the limited nature of the data it collects, maintains, and shares with third parties -promises that exceed the protections currently promised to Facebook users. We want to make clear that, regardless of the acquisition, WhatsApp must continue to honor these promises to consumers.
Facebook announced the planned acquisition in February, stunning the tech industry with the news that it was paying $19 billion for WhatsApp and its 450 million active users. Despite the conditional language in the FTC letter, Facebook confirmed that the agency will not block the deal.
“We’re pleased the FTC has completed its review and cleared our acquisition of WhatsApp. Naturally, both companies will continue to comply with all applicable laws after the transaction closes,” a Facebook spokeswoman, said by email.
In her letter, the FTC’s Rich also warned the companies that failure to comply with privacy promises would put them in violation of the FTC’s Section 5 rules against deceptive trade practices, and possibly violate an existing 20-year consent decree that Facebook signed after earlier privacy SNAFU’s.
In referring to WhatsApp’s earlier privacy promises, the FTC cites in particular the messaging service’s pledge not to collect location data or the contents of users’ address books, or share data about with them with third parties. The FTC letter suggests those promises should remain binding:
WhatsApp’s hundreds of millions ofusers have agreed to use the WhatsApp service, and to have WhatsApp collect and transmit their information, with the understanding that these promises will be honored
The letter also quoted a blog post from WhatsApp at the time of the acquisition that pledges that “nothing” will change for users, and also quotes Facebook CEO Mark Zuckerberg stating “We are absolutely not going to change plans around WhatsApp and the way it uses user data.”
The FTC’s decision to publish the letter, and its repeated warnings like “As you know, the FTC has brought many cases alleging that the failure to keep promises” represent a new assertiveness on the part of the agency in regard to the privacy implications of social media mergers — such as when Facebook acquired popular photo-sharing service Instagram, a move that triggered unsuccessful class action lawsuits, but little in the way of regulatory action.
Despite the stern language, the letter does not necessarily amount to a strategic problem for Facebook, which bought WhatsApp in large part to obtain access to its user data and, presumably, to eventually display Facebook’s advertising to those users.
The letter suggests that Facebook can make changes to WhatsApp’s privacy policies, but that the company must obtain “affirmative consent” before doing so. The agency also recommends that Facebook provide WhatsApp users with an opt-out option should the company changes its policies. Here’s the full letter:
This story was updated at 2:40pm ET to confirm the FTC approval.