Understanding Apple Privacy Labels for WhatsApp

Apple requires since December that all apps published on the App Store have to display how their data may be used and associate to the user identity. Today we want to clarify why WhatsApp requires so much information and how your details are used.

If you’ve a device on iOS 14.3+, you can view privacy labels of all recently updated app (since december) on the App Store. Those labels explain which data the app collects and uses. In this case, WhatsApp has added these privacy labels:

WABetaInfo is happy today to provide detailed information about those privacy labels below:

Identifiers

1. Phone Number: your phone number is your WhatsApp main identifier. For example, if your phone number is +1 (123) 456-7890, your WhatsApp ID is 11234567890, and its full format is 11234567890@s.whatsapp.net. Your phone number will be also shared across your devices, when the multi device feature will be available. In this case devices have their own phone number identificators, from 0 (the main device) to 3. This value might change in the future.

2. Groups Identifier: if you create a group, your phone number appears as partial identifier of the group. For example, if your phone number is +1 (123) 456-7890, your new group identifier is 11234567890-1613694890 (where 1613694890 is the timestamp, since 1970, generated when you’ve created the group, in this case), and its full format is 11234567890-1613694890@g.us.

Usage Data

1. Protecting the company from abuse: automated and bulk messaging is not allowed on WhatsApp. This information is useful to WhatsApp to discover if someone is violating their Terms of Service and it’s nothing associated to your private identity. Some tools illegally use the WhatsApp Service, so the company must protect itself.

2. Sponsoring marketing campaigns, using the Apple ad platform, in order to reach people who don’t use WhatsApp.

3. Understanding feature usage and interaction: WhatsApp wants to know which features are frequently used, so they might review, in the development area, less useful features to improve your experience. WhatsApp doesn’t know which contacts you chat with frequently: this information is only saved in the app to quickly forward a message to a frequently contacted user or to sort the status update list in some cases.

WhatsApp CEO Will Cathcart have also shared a very important information, so we also know now that WhatsApp doesn’t keep and share logs of who everyone is messaging or calling:

We answer these questions here if you want more details: https://t.co/XRLxesbqah

We don't keep logs of who everyone is messaging or calling. We do see your phone numbers in your contacts, but don't share those with Facebook. You can also download your data in WA to see more.

— Will Cathcart (@wcathcart) February 18, 2021

Purchases

1. Facebook Shop: any purchase from the Facebook Shop may influence what you see in Shops on Facebook and Instagram and this is one of the two big changes of Terms of Service. If you don’t like to see your purchase list shared with Facebook, you can simply avoid to use Facebook Shop, because it’s optional.

2. WhatsApp Catalog: Facebook Shop and WhatsApp Catalog are two different places, so everything you do on the WhatsApp Catalog won’t be shared with Facebook and it’s private. For example, if you open the Catalog and you interact with a product (viewing its details or sharing it), this action is never logged and shared with Facebook.

3. Financial information: your card or bank details are needed to complete a transaction, but they aren’t shared with Facebook and they are kept in an encrypted form on WhatsApp Servers.

ADVERTISEMENT

---

---

Location

1. IP Address: you communicate through the WhatsApp Services, connecting to a WhatsApp server when you use the app, and you use the WhatsApp service to send and receive messages, so WhatsApp knows which is your IP address. Your IP address is never shared with Facebook and third-party services if you don’t use any third-party platform that requires those details. In this case their own terms and privacy policies are applied. If you don’t know what this is, it means you’re not probably using any similar third-party platform.

2. Location and Live Location: shared locations in your chats and groups are always end-to-end encrypted, so WhatsApp and Facebook cannot see them. In addition WhatsApp can calculate your location (and it’s sent to the recipient using the end-to-end protocol) when the app is closed, so you can still share your live location in this situation or when the app is in background.

3. Coarse location: seen that WhatsApp knows which is your IP address and the country code from your phone number identificator, they might know a coarse location. They don’t see your precise location and this information is not shared with Facebook. The coarse location may also be used to understand and block unauthorized access to your WhatsApp account, if it is too far from the “new” coarse location, for diagnostics and troubleshooting purposes.

Contact Info

1. Phone number: WhatsApp knows which is your phone number, seen that it’s the way to use the application. It’s also used from the server to understand if a phone number is linked to a WhatsApp account, using the WhatsApp API service or within the application, if you chose to revoke the permission to read your address book and you manually enter a phone number on WhatsApp > New Chat.

User content, in order to make some WhatsApp features working

1. Last Seen: WhatsApp knows which is your last seen, needed to show it to your contacts, as part of WhatsApp features.

2. About: WhatsApp knows which is your contact about, needed to show it to your contacts, as part of WhatsApp features.

3. Profile Picture: WhatsApp knows which is your profile picture, needed to show it to your contacts, as part of WhatsApp features.

4. Group names, group profile photo and group descriptions, in order to automatically ban all accounts that violate laws. For example, WhatsApp fights child exploitation: this is the only way they can use for this fight, seen that messages sent to private chats and groups are always end-to-end encrypted in any case.

5. Email address: WhatsApp knows your email address, if you have configured two step verification on WhatsApp. This information is optional but needed if you want to recover your WhatsApp account and you don’t remember your verification PIN. Your email address is also shared with WhatsApp if you decide to contact the Customer Support.

Identifiers

1. User ID: a unique string to identify you across all Facebook Company Products associated with the same device or WhatsApp account, in order to make some features working (influencing your experience on Facebook Shops if you choose to use Facebook Shops within WhatsApp — totally optional) and to ban a specific user across all Facebook services if he violated laws or the Terms of Service badly.

2. Device ID: it’s a random alphanumeric string to uniquely identify your device. It’s just used to ban the device from using WhatsApp from new phone numbers if the user did something very bad, for example spam and illegal groups. WhatsApp cannot see the content of your groups, such as messages and media but, as mentioned above, they can see which is the group name, that aren’t collected for any marketing purpose or shared with the parent company.

Diagnostics

1. Crash logs: WhatsApp, probably as any other instant messaging app, generates some logs, that often contains useful details of a crash or issue you experience in the app. These crash logs are shared with WhatsApp manually and automatically and they are used to fix your issues to improve their product with new updates.

2. Performance data: WhatsApp may collect, for development purposes only, how a feature is working on your device, for example if you chose to express an opinion about a quality of a voice of video call (from 1 to 5 stars), general performance of the app (lags, freeze and similar data).

3. Other diagnostic data: WhatsApp collects some information of your device, in order to improve their service, for example the level of your battery, shared with all participants in a voice or video call, so they know when you have a low battery.

Contacts

1. Contact list: WhatsApp knows your address book, if you choose to give the permission within iPhone Settings.
This information is optional but needed to show contact names within WhatsApp and to make other features working, for example:
A. All privacy settings in WhatsApp Settings > Account > Privacy when set to “My Contacts”, “My contacts except…” or “Nobody except…”.
B. Status updates: you cannot send or receive status updates if you don’t share your contact list.
C. Broadcast Lists: you cannot send a message using a broadcast list, and WhatsApp cannot send to you a message from a broadcast list without your contact list.
D. Creating new groups: you cannot create a new group if you chose to keep the permission to access to your contact list disabled.

Despite all these required data, WhatsApp doesn’t use any information for profiling your identity and the ones that may influence your experience on Facebook with targeted advertisements (Facebook Shops and Businesses using solution providers) are really optional.
Note that the same labels are valid on WhatsApp for Android.

Let us know on Twitter if you like this feature and read our next announcements on our Telegram Channel!
WABetaInfo has a Discord Server about WhatsApp, where you can chat, give advice, ask for help to other participants and read my announcements!