Facebook has agreed to stop using WhatsApp data to target users with advertising in the U.K. and has been warned could face legal action if it resumes the practice.
The agreement is an initial victory for Information Commissioner Elizabeth Denham, who launched an inquiry into the data sharing earlier this year after expressing concern that user data was not being properly protected.
“I don’t think users have been given enough information about what Facebook plans to do with their information, and I don’t think WhatsApp has got valid consent from users to share the information,” she said in a statement on Monday.
Facebook acquired WhatsApp for US$22 billion in 2014 and has been using information from the service to help target advertising on its main social network.
In response to the Information Commissioner’s statement, Facebook said it believed its latest terms and conditions, updated in August, comply with the law and follow guidance from Denham’s office.
Denham said she secured the agreement with Facebook after her team “set out the law clearly” to the social network.
WhatsApp users can disable data sharing with Facebook, but they either have to do it by either scrolling through the terms and conditions to find a check box or by switching off data sharing in account settings. The latter is only available during the first 30 days of use.
“I also believe users should be given ongoing control over how their information is used, not just a 30-day window,” said Denham.
However, the “pause” could be temporary.
Denham wants Facebook and WhatsApp to agree to better explain data sharing to their customers and give them ongoing control over the sharing, but the two companies have not so far agreed.
“If Facebook starts using the data without valid consent, it may face enforcement action from my office,” she said.
The social network indicated it plans to continue discussions with U.K. authorities.
“We hope to continue our detailed conversations with the ICO and other data protection officials, and we remain open to working collaboratively to address their questions,” it said in a statement.
The agreement only covers the U.K. at present, but Denham said she will continue to pursue the issue with privacy commissioners across Europe.