WhatsApp faces penalty for violating French data protection act
The social messaging platform is given a month to stop sharing user information with its parent company, Facebook.
French privacy authorities aren't liking how WhatsApp is sharing your data with Facebook.
WhatsApp may be finding itself in hot water again, but this time it's not over encryption issues.
French privacy watchdog CNIL issued a formal notice to WhatsApp on Monday, telling it to stop sharing user data with its parent company, Facebook , without first getting the necessary consent. That data sharing doesn't comply with France's data protection act, and failing its cessation, WhatsApp could face a sanction in the country.
The popular social messaging platform had amended its terms and conditions last year after Facebook took over the reins in 2014, so it now shares data belonging to its users -- including phone numbers and user habits -- with its new parent even if they are not Facebook users.
As the data is not "validly collected" -- CNIL says user consent is only valid if users have the freedom to accept or reject terms without having to uninstall the application, but WhatsApp doesn't provide its users such freedom -- it violates France's data protection act.
CNIL wrote in its notice that it had previously asked WhatsApp to share a sample of the data belonging to French users which it shares with Facebook, but its request was rejected by the company, who says it's only bound by US laws. Hence, CNIL has been unable to evaluate the extent of the violation of the French data protection act, according to the notice.
The warning comes nearly a year after privacy regulators at the European Union expressed concerns over Facebook's ability to access WhatsApp users' data. WhatsApp was also sued in a German court over privacy concerns in January over the same issue.
"Privacy is incredibly important to WhatsApp. It's why we collect very little data, and encrypt every message," a WhatsApp spokesperson told CNET via email. "We will continue to work with the CNIL and are committed to resolving the different, and at times conflicting concerns, we've heard from European Data Protection Authorities with a common EU approach before the General Data Protection Regulation comes into force in May 2018."
First published Dec. 19, 2:35 a.m. PT
Update, 10:50 p.m.: Adds comment from WhatsApp.
'Alexa, be more human': Inside Amazon's effort to make its voice assistant smarter, chattier and more like you.
Virtual reality 101: CNET tells you everything you need to know about VR .