WhatsApp is facing a fine in France over its data sharing practices that see the instant messaging service provide its parent Facebook with a significant volume of information about its users, as revealed by the Commission nationale de l’informatique et des libertés (CNIL) on Monday. The data protection agency said WhatsApp has been given a month to comply with its order and stop sharing user data with Facebook without obtaining explicit consent from its customers to do so. Not doing so will likely result in a major fine but no specific figures have yet been provided by the regulator. Once a new EU privacy law enters into force early next year, the CNIL will be able to fine WhatsApp with up to four percent of its annual revenue for such transgressions.
The development is just the latest episode in the drawn-out saga involving Facebook’s $19 billion purchase of WhatsApp in 2014 — still the second largest acquisition in its history — that received regulatory approval from the European Union but later raised controversy when the two firms announced they’re to start sharing user data with each other in late summer of 2016. The controversy eventually ended with Facebook temporarily suspending the practice and numerous EU state members started sanctioning such activity individually, with France being the latest one that’s likely to do so after the likes of the United Kingdom and Germany already regulated what they deemed was illegal data sharing. Authorities on the Old Continent are primarily taking issue with the fact that consumers who previously installed WhatsApp didn’t agree to have their data shared with Facebook yet are now being compromised in this manner without providing any consent to do so, with their only option being to uninstall the popular mobile app. While such concerns usually wouldn’t warrant a strong or any regulatory response seeing how they pertain to a private company that’s free to change its product as it sees fit within the limits of applicable laws, the fact that Facebook and WhatsApp specifically dismissed the possibility of mass-sharing user data during the EU’s review of their proposed merger in 2014 prompted European authorities to step in once they began doing so last year. The two companies previously argued they weren’t aware such large-scale data sharing would even be technologically possible three years ago, an argument that some critics labeled as dishonest.
More than a year after originally warning WhatsApp to obtain permissions from individual users to share their data or cease such activities, the Facebook-owned service is understood to have done neither, as suggested by the CNIL. The messaging platform previously refused to provide the regulator with a sample of data from French users which it shares with Facebook, saying that it believes only its home country of the United States is able to make such requests.