WhatsApp Will Start Sharing Data, Including Phone Numbers, With Facebook

Updated at 9:10 p.m. ET with detail on limiting spam

The messaging service WhatsApp is changing its privacy policy for the first time since being bought by Facebook in 2014. The app will begin sharing some of its data and phone numbers with the social network. It will also start testing how businesses, too, can talk to its users, for instance by offering flight or shipping or banking notifications.

More than 1 billion people use WhatsApp around the world to stay connected — it was exactly the kind of reach that prompted Facebook's eye-popping $19 billion acquisition of the service, the company's most expensive purchase. (Facebook's own user base is more than 1.7 billion people.)

At the time of the deal, CEO Jan Koum wrote in a blog: "Here's what will change for you, our users: nothing." And then in March: "We don't know your likes, what you search for on the internet or collect your GPS location. None of that data has ever been collected and stored by WhatsApp, and we really have no plans to change that."

On Thursday, however, the messaging company released details of new "terms of service." As analysts have long predicted, WhatsApp and Facebook are moving closer toward linking the two independent businesses and making money from the free messaging app.

"As we announced earlier this year, we want to explore ways for you to communicate with businesses that matter to you too, while still giving you an experience without third-party banner ads and spam," said WhatsApp's blog post announcing the changes. The company had teased this possibility in January when it did away with subscription fees.

WhatsApp says it will also begin sharing phone numbers and other data, such as the last time of log-in, with the "Facebook family of companies," whose largest members include the photo site Instagram and the virtual reality company Oculus VR.

WhatsApp, in the blog post, says all messages will remain encrypted, protecting their content, but argues the broader sharing will improve the experience on both platforms:

"We won't post or share your WhatsApp number with others, including on Facebook, and we still won't sell, share, or give your phone number to advertisers.

"But by coordinating more with Facebook, we'll be able to do things like track basic metrics about how often people use our services and better fight spam on WhatsApp. And by connecting your phone number with Facebook's systems, Facebook can offer better friend suggestions and show you more relevant ads if you have an account with them."

How exactly will shared knowledge of phone numbers limit spam? In response to such inquiry posed to WhatsApp's spokespeople, CEO Koum replied by email: "это элементарно, Ватсон" — Russian for "It's elementary, Watson." (Koum was born in Ukraine; your blogger, in Russia.) "If somebody is a spammer on Facebook, they are most likely also spamming on WhatsApp... and vice versa," Koum wrote in the email.

WhatsApp spokesman Matt Steinfeld says, "we're able to link accounts on Facebook and WhatsApp using a device identifier or phone number. If an account is disabled for spam or abuse on one service, we will now have the option to do it on multiple services."

Users can opt out of some of the data sharing — they have 30 days to go into settings and follow WhatsApp's instructions to limit the use of phone numbers and other data for ad targeting. (Settings - Account - Share my account info.) But the company notes that the info will still be shared with the Facebook family for spam-fighting, user analysis and other purposes.

The changes to privacy policies at WhatsApp, often hailed as one of the most private messaging apps, are already raising concerns among privacy advocacy groups.

Marc Rotenberg, president of the Electronic Privacy Information Center, told The New York Times that his privacy advocacy group will file a complaint on Monday with the Federal Trade Commission to stop WhatsApp from sharing users' data with Facebook.

The FTC in 2011 reached a settlement with Facebook after the government accused the social network of deceiving its users about privacy. The FTC ordered that Facebook had to "obtain consumers' affirmative express consent before enacting changes that override their privacy preferences" and receive periodic privacy assessments by third-party auditors for the following 20 years.