Privacy by Design and Competitive Advantage: a Whatsapp Exodus?
Authors: Eduardo Magrani and Lucas van Hattem
The start of the new year might not have taken the turn WhatsApp was hoping for. At the beginning of January 2021 users of the messaging app started to get a pop-up notification informing users of an update to their ‘terms of service’ by which data would be shared with its parent company Facebook. The user had to accept the new terms in order to continue using the app after the 8th of February.
In retaliation, millions of users searched for alternative messaging apps, with Signal and Telegram being the most popular. The downloads of these alternatives, in the App Store and the Google Play Store, surged into the millions. In the week of January 6–12, Signal was downloaded 7.5 million times, a 4,200% increase from the week before, while Telegram downloads rose by 91% with 9 million downloads.
Although this chain of events captured the media’s attention, concrete numbers are still lacking about how many users officially stopped using WhatsApp. The surge into millions of downloads for Telegram and Signal, respectively, paints a fuzzy picture of the value users place on their data privacy, given that these numbers pale in comparison to the 2000 million monthly active users hosted by WhatsApp. Moreover, looking at the numbers of MAU of Telegram and Signal it is clear WhatsApp is still the biggest player and comfortably ahead of its ‘competition.’
Why the sudden change of heart?
One reason for this ‘migration’ can be understood by social media users’ increasing awareness of the value of their personal data and what happens to this data. The unassuming trust which users place in online platforms has declined in recent years. Nowadays, users are more concerned about sharing their data in the first place; when it is shared, they expect transparency. Moreover, when it’s personal data, users need assurance that their data is used in a fair and safe manner. Although many users are more ‘privacy aware’ than years ago, plenty are not. Or even if they are, it is hard for them to implement this awareness in their own lives for different reasons as will be discussed further. In addition to privacy concerns, recent Facebook scandals have surely impacted people’s added frustration and willingness to switch from the WhatsApp platform, which demonstrated its inability to prove its independence from the big tech giant.
Could this new privacy update by WhatsApp (Facebook) be the final stroke for millions of users to look for alternatives that offer more transparency and privacy? Likely not, but if this were the case, would Telegram and Signal be the best alternatives? Do they offer better privacy options than WhatsApp? And does increased privacy necessarily translate into a competitive advantage in the eyes of app users? As will be discussed, in the aftermath of the WhatsApp update, Telegram gained more users than Signal, though it offered a less privacy-centric technology to users. These parameters demonstrated that other factors beyond the respective technologies’ ‘privacy-by-design,’ such as users’ privacy awareness and whether a given app was able to garner a critical mass of users, played significantly into users’ decision as to whether to transition onto a new platform, and if so, what platform was preferred.
WhatsApp: How did we get here?
Founded in January 2009, WhatsApp, prior to its transition into a messaging app, was simply an app enabling users to update their status and be seen by others in their network. The messaging feature, which is now the main feature, was added in the 2.0 version. In 2012, WhatsApp stated that they were interested neither in integrating ads into their app, nor in the data of their users. Given that the company couldn’t sell user data, they opted for a freemium business model which meant giving the user one year of free use and then charging a small fee of $0.99 per year in the form of a subscription.
In light of 2016 users’ lackluster concern for their data, the provision of end-to-end encryption, and limited alternatives, WhatsApp did not lose a large number of users. WhatsApp users proved underwhelmed by the encroachments on their personal data and did not find them sufficiently invasive to outweigh the convenience of a free service which already hosted most family, friends and colleagues. In keeping with considerations of achieving critical mass, leaving WhatsApp would mean leaving your core social circle, unless all users left together.
A look at the alternatives: Telegram and Signal
Telegram is a messaging app that was founded in 2013 with a focus on speed and security. A significant factor that distinguishes it from WhatsApp and Signal is the possibility to create groups for up to 200,000 people and channels for broadcasting to unlimited audiences. In this sense it is clearly more than ‘just’ a messaging app. On the other hand, Signal was founded in 2014 as the combination of two messenger services, TextSecure and Redphone. As the youngest messaging app of the three in question, this partially explains the relatively small amount of MAU as shown in fig. 3. Signal, an independent non-profit organization which does not chase revenues and is funded by grants and private investors, was developed as a messaging platform, embedded with consideration for the highest privacy standards for its users.
The two privacy-motivated companies have openly expressed their non-interest in user’s data and propose to offer an alternative to the data collecting messaging service, WhatsApp. Telegram and Signal do not share data with other companies, which creates a competitive advantage over WhatsApp, particularly for those users who are more ‘privacy aware.’ In contrast, WhatsApp does provide end-to-end encryption, something which used to be one of the key selling points making it and attractive to its user base.
The advantage of privacy-by-design
Privacy-by-design can give a company in a certain market a “competitive advantage” since it provides users something they want that the competition does not offer. Privacy-by-design was first used to describe the notion of embedding privacy measures and privacy-enhancing technologies into the design of information technologies and systems. Now, privacy-by-design is seen as a multifaceted concept, involving different technological and organizational components that implement privacy and data protection principles in systems and services. Moreover, article 25 of the GDPR, addresses data protection by design as a legal obligation for data processors and controllers by making an explicit reference to data minimization and the option of pseudonymization. Since the GDPR only provides minimum requirements, a company can of course go further by collecting no data whatsoever from its consumers.
Companies should recognize the monetary value of prioritizing privacy-by-design since it attracts consumers that care about their data protection. Respecting a higher standard of privacy-by-design and incorporating it in software (more protection and less data gathering) can give a competitive market advantage. This is exactly what Signal and Telegram promise to do with their app and business model.
Telegram and Signal battle for the highest data protection
User considerations for switching to Telegram or Signal
It is important to mention that while users take privacy into account when choosing a messaging platform, perhaps even more, they are swayed by the actions of their peers. A user might not switch entirely to a messaging app that is not used by the people he or she is in contact with the most. Convincing all friends, colleagues and family to switch over to a new app is a mighty task. Considering that prior to the WhatsApp policy update Telegram had 400 million users in contrast to Signal’s 32 million users, there may have been a more clear question of convenience over technical considerations.
Telegram’s critical mass onboarded enough users to position them as the most visible competition and convenient switch for users. When people searched for an alternative platform, not only was it inconvenient to transfer to Signal but there were simply fewer people to connect to.
In addition, while privacy awareness and the experienced privacy shock was a significant factor the exodus from WhatsApp, it may not have sufficiently determined their destination app. How aware are users really about their privacy implications? Findings, in the context of use of two contact tracing apps in Israel show that privacy perceptions factor prominently into the decision to install a particular application; if people are convinced that the technology does not track them and threaten their privacy, they may be more inclined to install it. By way of analogy, it seems like Telegram used the gap between ‘real vs. perceived’ privacy implications to capitalize on privacy-by-design’s competitive advantage.
This event further demonstrates the extent to which users are often unaware of the differing privacy implications of various applications although the differences may be significant. This raises the issue of how a company communicates privacy considerations accurately and accessibly to a broad public. Further, while privacy specifications are important, they must be accompanied by an increasing privacy awareness from the users in order to ascertain differences, benefits and drawbacks. Although Signal has the strongest privacy considerations of the three apps, users remain largely unaware of the technical differences. Signal’s efforts to increase awareness of its superior privacy specifications notwithstanding, policymakers should also take responsibility in this realm by promoting the development of tools and digital literacy programs that better educate citizens regarding the technologies they download and how to ensure that they are actively in control and able to responsibly protect their individual data.
Arguably the WhatsApp update of its privacy terms of service was, for a relatively large number of users, the final straw in this context of the recent scandals regarding Facebook and the growing privacy awareness among users. However, WhatsApp remains the biggest platform, with Telegram and Signal still trailing behind.
For now, Signal, of the three platforms in question, appears to offer the highest protection of users’ data, offering the most adequate privacy-by-design. The real “competitive advantage” of privacy-by-design is achieved among users who care about their data and are aware of the differences between the messaging apps. This includes both people who researched the messaging apps and switched to Signal before the WhatsApp update as well as those who became more aware about their privacy after the update notification and decided to switch to Signal since they deemed it the best alternative. Given the numbers, privacy-by-design as a competitive advantage seems not that big of an advantage in the current market, but should gain much more importance with the current trend of data protection regulations and enforcement and as citizens become more aware and in command of their personal data, including understanding how it is used, for what purposes and by whom.
When scrambling for an alternative messaging app, in practice, users chose the app with less privacy protection with regard to end-to-end encryption of messages. Although awareness regarding privacy is increasing, there are clearly other factors that come into play other than the sole considerations of privacy and the protection of data. That being said, it seems that, despite increasing awareness of personal data and privacy emerging from regulations such as the GDPR, citizens struggle over how to properly ‘implement’ this in their daily life. One reason for this is the lack of information and/or transparency regarding their privacy as discussed in Telegram’s case. Regulators must play a more proactive role, and take greater responsibility in creating such awareness. Adequate data protection regulation and better enforcement can lead to more transparency and accountability from companies in regard to the collection and processing of user data.
The Israel Public Policy Institute (IPPI) serves as a platform for exchange of ideas, knowledge and research among policy experts, researchers, and scholars. The opinions expressed in the publications on the IPPI website are solely that of the authors and do not necessarily reflect the views of IPPI.
Towards Democratic Innovation in Israel: The Case for Citizens' Assemblies
Citizens’ Assemblies as Instigators for Climate Action The erosion of liberal democracies is arguably a sign of our…