EncryptionPrivacySocial Media and Cyber LawsTechnology Law / Cyber Law
Analysing Privacy Policies- WhatsApp, Telegram, and Signal
Introduction
Every day, people around the world, give their personal information away to various governmental and non-governmental organizations, in order to access basic services that are essential to meaningfully participate in society. Communication is one such basic necessity. In the modern world, communication is dominated by technology. This technology is susceptible to misuse and thereby, necessitates regulation. By making privacy policies a legal requirement, countries endeavor to safeguard the right to privacy of their citizens. A privacy policy is a binding legal agreement between a service provider and its users that the data provided by a user will only be used for the purposes for which the user gives his consent. While this sounds brilliant, it must be noted that privacy policies function as click-wrap agreements that are non-negotiable. Hence, it is necessary to understand the market offerings and make the right privacy-related choice. This article analyzes the newly released policy of WhatsApp and the current policies of Telegram and Signal so as to facilitate the making of the right choice or at the least, an informed one.
Data Storage
WhatsApp collects users’ account information. It is required that users provide their cell phone number and basic data (including a profile name of the user’s choice) to make a WhatsApp profile.
WhatsApp also stores users’ connections, status information, and stores transactions and payments information. “If you use our payments services, or use our services meant for purchases or other financial transactions, we process additional information about you, including payment account and transaction information,” states WhatsApp’s privacy policy.
The messaging service does not retain users’ messages in the “ordinary course” of providing its services to users.
Its Privacy Policy states, “Your messages are stored on your device and not typically stored on our servers. Once your messages are delivered, they are deleted from our servers.”
WhatsApp provides end-to-end encryption. This means that users’ messages are encoded to shield them from being read by WhatsApp and other third parties.
Automatically Collected Information contains usage and log Information, device and connection information, location information, and cookies.
WhatsApp said it utilizes Facebook’s global data centers to store data, adding that even if you don’t use location-related features, it will gather “IP addresses and other information like phone number area codes to estimate your general location (city, country).”
Advertising
Presently, WhatsApp still does not allow third-party banner ads on its services, yet. But they have stated, “We have no intention to introduce them, but if we ever do, we will update this Privacy Policy.” This effectively means that perhaps they can monetize the platform further and introduce third-party banner ads sometime later.
It is worth observing that as part of the Facebook Companies, WhatsApp obtains data from, and shares information with other Facebook Companies and uses this data to make suggestions for users, personalising features and content as well as showing relevant offers and ads across the Facebook Company Products.
Third Parties and Payments
WhatsApp collects information about users from other users – and contrariwise. For instance, when other users you know use its services, they may give your mobile number, name, and other data just as you may give theirs.
It also collects user reports. Users can report other users for various purposes. So when a report is made, data on both the reporting user and reported user are collected.
Lastly, businesses you interact with using WhatsApp may provide the company with information about their interactions with you.
“When you message with a business on WhatsApp, keep in mind that the content you share may be visible to several people in that business. In addition, some businesses might be working with third-party service providers (which may include Facebook) to help manage their communications with their customers.”
WhatsApp also works with third-party service providers and other Facebook Companies to help them operate, provide, improve, understand, customize, support, and market their services.
Data Sharing
By consenting to the Terms and Conditions, users agree to the part where WhatsApp shares information with its parent company Facebook and other companies of the Facebook group.
The company also said it will access, preserve and share users’ data with authorities to reply to legal process or government requests, enforce Terms and any other appropriate policies, including for investigations of potential contraventions; detect, investigate, prevent, or address fraud and other unlawful activity or security and technical issues; or protect the rights, property, and safety of their users, WhatsApp, the other Facebook Companies, or others, including to prevent death or imminent bodily injury.
Click here to read WhatsApp’s privacy policy. The comparison of the previous and the proposed policy can be found here.
Telegram
Data Storage
With Telegram, users provide their cell phone number and basic account data (which may include profile name, profile picture and about information) to create a Telegram account.
Users are also required to provide their e-mail address when they enable 2-step-verification for their account or store documents using the Telegram Passport feature.
There is also a function named secret chats that uses end-to-end encryption. This means that all data is encoded with a key that just you and the recipient know. Telegram does not store secret chats on its servers. It must be, however, noted that on the ordinary course, messages sent in regular chats and group chats are encrypted using MTProto, which is a custom protocol designed by Telegram itself.
Telegram uses and stores phone number and connections to inform users as soon as one of their contacts sign up for Telegram.
The company also provides options to users, and they can always stop syncing contacts or remove them from the servers in Data Settings.
If users signed up from the UK or the EEA, the information is stored in data centres in the Netherlands. According to its privacy policy, “These are third-party provided data centres in which Telegram rents a designated space. However, the servers and networks that sit inside these data centres and on which your personal data is stored are owned by Telegram. As such, we do not share your personal data with such data centres. All data is stored heavily encrypted so that local Telegram engineers or physical intruders cannot get access.”
Advertising
Telegram uses cookies but says in its privacy policy, that it only uses cookies to operate and provide its services on the web. It does not use cookies for profiling or advertising. Its privacy policy states, “The cookies we use are small text files that allow us to provide and customize our services, and in doing so provide you with an enhanced user experience.”
Third Parties and Payments
Telegram does not handle payments from users and depends on different payment providers around the world. In this case, the payment providers process and store your credit card information. Neither Telegram nor the merchants on the platform (bot developers) have access to this data.
Users’ credit card information never reaches Telegram’s servers, and it does not access nor stores your credit card information.
Shipping Information is transmitted directly to the merchant bot developer. However, Telegram can store a user’s shipping information for you if you choose to save it for future purchases.
Data Sharing
As mentioned in the privacy policy, Telegram may share information with other Telegram users. Its privacy policy states, “Note that by entering into the Terms of Service and choosing to communicate with such other users of Telegram, you are instructing us to transfer your personal data, on your behalf, to those users in accordance with this Privacy Policy.”
Telegram might also share users’ personal data with its parent company Telegram Group Inc, situated at the British Virgin Islands and Telegram FZ-LLC, a group member situated in Dubai. This is to help offer, improve, and support its services.
Telegram might also share users’ information with law enforcement authorities. However, no such data has been shared until now.
Click here to read Telegram’s privacy policy.
Signal
Account information, such as mobile number, profile name and profile picture as well as messages comprises the data a user provides to Signal. Users’ message history is stored on their own devices.
Additional technical information is stored on Signal’s servers, including randomly generated authentication tokens, keys, push tokens, and other material essential to establish calls and transmit messages. Signal restricts this extra technical information to the minimum needed to run the services.
Users also provide their contacts details and user support. Like WhatsApp, Signal works with third parties to deliver some of its services.
Its Privacy Policy States: “For example, our Third-Party Providers send a verification code to your phone number when you register for our services. If you use other Third-Party Services like YouTube, Spotify, Giphy, etc. in connection with our services, their Terms and Privacy Policies govern your use of those services.”
Signal will also share your information to meet any applicable law, regulation, legal process or enforceable governmental request or to identify, prevent, or otherwise address fraud, security, or technical issues.
Click here to read Signal’s privacy policy.
Tabular Comparison of Data Collection and Privacy Features Between WhatsApp, Telegram and Signal:
Basis | Telegram | Signal | |
Data Collection | Device ID User ID Advertising Data Purchase History Coarse Location Phone Number Email Address Contacts Product Interaction Crash Data Performance Data Other Diagnostic Data Payment Info Customer Support Other User Content | Contact Info Contacts User ID | None. It only stores your phone number. |
Privacy Features | WhatsApp has end to end encryption (E2E) for messages, video calls, voice calls, photos, etc. WhatsApp uses E2E protocol developed by Open Whisper Systems, same as Signal. | Supports Self-destructing messages, where the message will get deleted after a point of time. Telegram supports E2E only secret chats feature. The company confirmed it shares 0 bytes of data with third-parties or any governments to date. | Supports Self-destructing messages. Signal allows relay voice calls to its servers, identity is not shared, the same as using a VPN. Signal uses back-end user-facing encryption service. It uses the open-source Signal Protocol to implement end-to-end encryption. Signal also encrypts your metadata offering multiple levels of security. |
*This Tabular Comparison is based on the privacy policies of Telegram and Signal as they stand on January 2021 and WhatsApp’s new policy to be made effective from May 15, 2021.
Closing Remarks:
As someone who has personally used all three apps, I find that each app has its pros and cons. WhatsApp and Telegram have a variety of features that make it incredibly fun to use the platform. Signal, on the other hand, has the most to offer if privacy is the primary concern. Keeping this in mind will help you prioritize and make the right choice for yourself.
This article can be cited as:
Melita Tessy, Analysing Privacy Policies- WhatsApp, Telegram, and Signal, Metacept | InfoTech and IPR, accessible at https://metacept.com/analysing-privacy-policies–whatsapp,-telegram,-and-signal
References:
- Yasmine Jacobs, WhatsApp vs Telegram vs Signal: Comparing privacy policies, IOL, Jan 11, 2021, https://www.iol.co.za/technology/mobile/whatsapp-vs-telegram-vs-signal-comparing-privacy-policies–82fcb7b7-fe8d-496a-846c-3baaba58eef2
- Zak Doffman, Signal Vs Telegram – 3 Things You Need To Know Before You Quit WhatsApp, Forbes, Jan 14, 2021, https://www.forbes.com/sites/zakdoffman/2021/01/14/3-things-to-know-before-quitting-whatsapp-for-signal-or-telegram-or-apple-imessage-after-backlash/?sh=5275086264f6
- Vishal Aaditya Kundu, WhatsApp vs. Signal vs. Telegram, Trak.in, Jan 20, 2021, https://trak.in/tags/business/2021/01/10/whatsapp-vs-signal-vs-telegram