Ask HN: How can I meaningfully object to WhatsApp processing of my information?
When following the form, I receive an e-mail saying:
> Hi,
> Thanks for your message.
> In order for us to review your objection, please reply to this email with > the following information:
> - What information processing you are objecting to. Your right to object applies where we rely on legitimate interest to process your information.
> - How WhatsApp’s processing of this information impacts you (example: what rights and freedoms you believe are impacted by the processing and why)
> - Any additional information you believe will help us review your objection (optional)
> We may ask you for more information if your request is incomplete.
> Thanks, WhatsApp Privacy Operations
Of course, I did not manage to get further than that: whatever I say, they answer that "We've reviewed your request and found that it doesn't meet the requirements for an objection to the processing of your personal information under the applicable data protection regulation.". They claim that they need all the information they collect, but since Signal does not collect any of that, it seems like they don't really need it. They also mention "Business intelligence and Analytics", it feels like it should be relatively easy to prove that they don't actually need to do that in order to provide WhatsApp to me, right?
Here they give more details about the information they collect, and the concept of "legitimate interest": https://www.whatsapp.com/legal/privacy-policy-eea/revisions/20211122#privacy-policy-information-we-collect.
My question: what should I answer to that e-mail in order to force WhatsApp to collect as few metadata as possible coming from my activity?
56 comments
[ 2.0 ms ] story [ 121 ms ] threadhttps://veilid.com/
It's nice being able to message from my phone and Linux desktop without any trouble
Nah, let's just use the platform owned by the war criminal because everyone is there with our tech-ignorant relatives as our excuse. I hope you all meet a Rohingya one day.
We do have to practice tolerance of certain things, but genocide is not one of em. I'm sorry it makes you uncomfortable to know that you're using the same platform that was used by state-supported mass murderers and the executives knew about it and took the money, but allowing others to tend to their own discomfort is the deepest of compliments.
We're discussing WhatsApp in this post. Read the subject line.
I mentioned war crimes, and the [word] Rohingya, and that is enough for any curious mind to google and learn what I am talking about.
But since you're determined to do a thorough demonstration of willful incuriosity, what I am talking about is, Facebook, owned by Meta, which owns WhatsApp, was used as a platform to foment and execute a genocide in the country of Mynanmar, against the Rohingya muslim minority. Meta executives knew about it and did nothing, cause hey, brown people in that part of the world, who cares.
Enjoy talking to your grandpa or whatever.
Also it's spelled Myanmar. You can't even spell the name right of the country that you're all upset about. Were you personally affected by what happened there? I bet you just like to cherry-pick tragedies and use them to virtue signal your depressed world view on Hacker News.
There are just some people that still keep WhatsApp, meaning I need it.
Unless you force everybody to use the exact same protocol, with the exact same features, and to never add or change a feature.
> Thank you for your message. Please read this article to learn more about objecting to the processing of your personal information: https://faq.whatsapp.com/1285115568956956/?helpref=uf_share
The page says:
``` How can I submit an objection?
If you're living in the European Region or in the UK, you can submit an objection to such processing of your personal information with this form and select "How can I make an objection to the processing of my information." Please provide your email address and WhatsApp phone number so we can process your request.
You will then be asked for the following information by email:
- What information processing you are objecting to: the processing activities carried out by WhatsApp on the basis of legitimate interests are listed above
- How this processing impacts you; under the GDPR and the UK GDPR, you have a right to object on grounds relating to your particular situation. This is important for us to be able to review and assess your objection. This is why we ask you to explain how the processing affects you (such as what rights and freedoms you believe are impacted by the processing and why)
- Any additional information you believe will help us review your objection (optional)
We may ask you for more information if your request is incomplete. ```
So yeah, obviously they don't want to tell me what would be a valid request from my end.
Simple answer – you aren't going to be able to. Do you think they are going to release a new version of the app just for you? Their current policy has undoubtedly been approved by legal teams in the EU and across the world and unless you can find better lawyers than theirs or sympathetic government officials to back your cause you aren't really moving the needle.
https://commission.europa.eu/law/law-topic/data-protection/r...
(1): Its incorrect to say they have the authority to hand out fines, but I dont know the word it, and its perhaps not the most important part of this.
They are essentially telling me: "You need to put the right words in your e-mail if you want us to take you seriously, but we are counting on the fact that you don't, and therefore we work around your right to object".
Hence my question here. If somebody found a way to send the right words to WhatsApp and shared them, I could send the exact same e-mail. Or differently, if we could find a "good e-mail" to send and WhatsApp still refused to acknowledge it, then EU-based users could complain to the EU and possibly get the law with them.
I think it can move the needle.
There are a bit more to it than that, lile ligitimate interests etc, but on the other hand gdpr has many more priciples and fundamental rights for companies to break
WhatsApp showed me a popup telling me that!
They would probably do this server-side, something like (if the metadata comes from/is related to the user with the phone number $FOO, flush it, don't store it)
They don't need to prove that they NEED it, just that they have a legitimate interest in collecting it which outweighs your right to privacy and your objection to it.
Just because Signal does not collect it does not mean that WhatsApp don't have a legitimate interest in collecting it. In particular, a for-profit company has a fairly compelling argument that 'business intelligence and analytics' is a strong legitimate interest, especially if, as their privacy policy suggests, they only process personal data to produce summary statistics.
You're better off just finding out what data they collect, and then trying to work out what you object to specifically.
If profit were sufficient justification, the regulation would be toothless.
Looks like that very question is with the EU courts at the moment.
But confusingly, yes, there are other court cases you can find online that have said that profit alone is not a legitimate interest.
WhatsApp saying 'we need this information for business intelligence purposes so we can grow our core business' is an argument that they have a legitimate interest in processing that data, and should be considered during their balancing test.
Signal, on the other hand, would struggle to rely on this argument, as their core business is to provide a service for free, funded by donations.
If you can demonstrate by questioning that they are obstructing what information is used for, specifically, then that will fall foul of EU intention for objecting to use of information. Run it by https://mastodon.social/@neil@mastodon.neilzone.co.uk
I switched to Telegram 2 years ago, haven't installed WhatsApp ever since and all my contacts got comfortable with Telegram that I don't miss out on anything important anymore.
But the idea here is really to see how far I can go about asking WhatsApp to not collect my data :-).
You're using obfuscated closed source binaries from the biggest behaviour manipulation corporation on the planet.
Telegram is none of that. The security is robust and the features and services are much better.
Fair point. Though last time I checked Telegram, nothing except the secret chats was end-to-end encrypted. So there I know that the features people like on Telegram are definitely not E2EE.
> The security is robust and the features and services are much better.
Features and services, I can accept that. Security... well again, only the secret chats are E2EE, and last time I checked, the secret chats didn't have more features than Signal.
That doesn't mean they're in plain text. MTProto 2.0 is an audited and robust algorithm.
E2EE's cloud sync support is not very good, which is why Telegram doesn't use it because Cloud Sync is one of the best features of Telegram.
You can read more about the algorithm here: https://core.telegram.org/mtproto
Nope, but it means that they are not E2EE. Meaning that the Telegram server (and whoever has access to it) has plaintext access to the messages.
No, that's not really true. They use a distributed key generation system. The keys are stored in multiple jurisdictions. No telegram employee or government can decrypt the messages. All the servers would have to be compromised to reach that 'plaintext access' that you mentioned.
Dear WhatsApp Privacy Operations,
Thank you for your prompt response. I am writing to formally object to the processing of my personal information by WhatsApp based on my rights under the General Data Protection Regulation (GDPR).
What information processing you are objecting to: I object to the processing of my personal data, including but not limited to my contact list, messages, location data, device information, and any other data that WhatsApp collects for purposes that are not essential to the provision of the service. Specifically, I am concerned about the processing of my data for targeted advertising, data sharing with third-party entities, and any other processing activities that are based on WhatsApp's legitimate interest rather than my explicit consent.
How WhatsApp’s processing of this information impacts you: The processing of my personal data by WhatsApp impacts my fundamental rights and freedoms, including my right to privacy. I am concerned about the potential misuse of my data, the risk of data breaches, and the sharing of my data with entities that I have not provided consent to. The aggregation and analysis of my data for profiling and targeted advertising purposes infringe upon my right to a private life and can lead to unwanted and intrusive advertisements. Furthermore, the sharing of my data with third-party entities without my explicit knowledge or consent compromises my trust in the platform and my ability to control how my personal information is used.
Any additional information you believe will help us review your objection (optional): I understand that WhatsApp may have business reasons for processing user data, but as a user, I believe that my right to privacy and control over my personal data should be paramount. I urge WhatsApp to consider the concerns of its users and to prioritize transparency and user control in its data processing activities. I hope that my objection will be taken into consideration, and I look forward to hearing from you regarding the steps WhatsApp will take to address my concerns.
Thank you for your attention to this matter.
Sincerely,
[Your Name] [Your WhatsApp Phone Number]
> I object to the processing of my personal data, including but not limited to my contact list, messages, location data, device information, and any other data that WhatsApp collects for purposes that are not essential to the provision of the service
It's literally a messaging app! You literally need ALL of those things just to send messages. Else how do you send a message without processing (aka, routing) it? How do I share a live location without processing my location data?
> Specifically, I am concerned about the processing of my data for targeted advertising, data sharing with third-party entities, and any other processing activities that are based on WhatsApp's legitimate interest rather than my explicit consent.
OK, so what. Sending a message is literally sharing data with a third party. There's no way around it, there will always be AT LEAST 3 parties: the sender, whatsapp, and the recipient. Like come on. Are they supposed to ask you on every send: "do you consent with sharing your message with the recipient?" LOL
> I am concerned about the potential misuse of my data, the risk of data breaches, and the sharing of my data with entities that I have not provided consent to.
For some reason, I assume they're concerned with this too and go to great lengths to protect their infrastructure.
> The aggregation and analysis of my data for profiling and targeted advertising purposes infringe upon my right to a private life and can lead to unwanted and intrusive advertisements.
LOL. So counting the number of people who do X where the count is in the hundreds of thousands to a millions somehow endangers your right to privacy? I can't wait to hear about this one.
> the sharing of my data with third-party entities without my explicit knowledge or consent
Your habits of drunk dialing on Whatsapp (which is the only way I can really think of involving a third party without your consent, though I guess butt-dialing counts too) ... are not their problem.
> prioritize transparency and user control in its data processing activities.
Yeah, if they're sending messages without telling you, then I suppose you'd probably want to stop using that service.
This message was a good laugh, and all the more reason NOT to let AI do ANYTHING meaningful.