Facebook's history with Onavo resonates for privacy experts worried about Giphy purchase

23 Jun 2020 8:00 am by Mike Swift

Facebook icons

In the eyes of some privacy experts, there is no better parallel to Facebook’s acquisition of Giphy than a little known mobile analytics startup called Onavo, which offered virtual private network services to users while it simultaneously collected and sold data about how they used the other apps on their phones.

Facebook bought Onavo in 2013, and it used that stream of data about app traffic to see, before its competitors, that photo-sharing app Instagram and messaging platform WhatsApp were exploding in popularity. “It takes a certain amount of chutzpah to present people with a privacy tool whose purpose was to gain their data,” author Steven Levy observes in his new book “Facebook: The Inside Story.”

Facebook CEO Mark Zuckerberg aggressively moved to buy Instagram and WhatsApp, and the platforms have become two pillars of Facebook’s online empire, leaving the “what if” question of how the social media and digital advertising markets might have developed differently had Instagram and WhatsApp remained independent. There is another legacy of Facebook’s Onavo purchase: Guy Rosen, Onavo’s co-founder, is now Facebook’s vice president of Integrity, leading the company’s safety, integrity and data security efforts.

As much as any case, Giphy illustrates how inextricably bound together data protection and antitrust questions have become, in an economy that increasingly runs on personal data.

— Two Key Privacy Worries —

Because Giphy is integrated into the platforms of Twitter, TikTok, Signal, Slack and other prominent messaging, productivity and social services, Giphy’s data could provide Facebook with the kind of market intelligence that Onavo did for years. Onavo is already a focus of House Judiciary and Federal Trade Commission antitrust probes of Facebook, and may also be part of multi-state probes of the company. Onavo is also prominent in antitrust litigation filed against Facebook in federal court in San Jose, California.

Giphy data theoretically could allow Facebook to snap up the next big thing before it grows enough to protect its independence. The FTC and other regulators in the US and UK are investigating the competition issues around Facebook’s purchase of Giphy, including its use of data. But beyond antitrust concerns, privacy advocates see the story of Onavo as a cautionary tale on privacy for what could happen as Giphy is subsumed into the Facebook fold.

They see two key dangers. One is the standard online tracking concern. Say someone is feeling emotionally down and types “I’m depressed” into Giphy’s search box. They will instantly get back a choice of hundreds of GIFs they can share digitally with their friends, such as a bent over Charlie Brown saying, “I’m sick of myself.”

But will they also start seeing ads for counseling services or antidepressants in their Facebook or Instagram feeds?

That potential threat of the Giphy deal “taps into the foundational privacy concern that we have today, this perception that we’re constantly being tracked and surveilled and we don’t have any agency to escape that,” said Chris Riley of Mozilla, which recently said in a blog post that regulators should force Facebook to commit to never combine data collected by Giphy with other user data that Facebook products collect about users.

Mozilla, the nonprofit that makes the Firefox browser and whose mission is to preserve the openness of online platforms, is not alone in those concerns. Which brings up a second major privacy concern, a longer-term problem that can also be illuminated by returning to the story of Onavo and WhatsApp.

— WhatsApp evolution —

When the founders of WhatsApp accepted Facebook’s $22 billion bid to purchase their company in 2014, the messaging platform’s main source of revenue was not advertising, but a dollar-a-year annual subscription fee paid by users. The service didn’t collect data about users to target advertising, and WhatsApp co-founder Jan Koum told the platform’s users that it would “always” stay that way under Facebook.

“You can still count on absolutely no ads interrupting your communication. There would have been no partnership between our two companies if we had to compromise on the core principles that will always define our company, our vision and our product,” Koum wrote on WhatsApp blog post in February 2014 as news of the deal became public.

Then, in August 2016, WhatsApp announced it would change its privacy policy in order share users' phone numbers and other information with Facebook. Privacy advocates were not happy, and they questioned whether Facebook had violated its 2012 privacy consent decree with the FTC — the same settlement that the FTC said last year that Facebook violated after the Cambridge Analytica privacy breach.

EU regulators fined Facebook 110 million Euros (US $124 million) in 2017 for supplying misleading information during the merger review of WhatsApp after WhatsApp disclosed the possibility of linking users' phone numbers with Facebook user identities. EU regulators said Facebook told them it couldn't merge the list of users of the two services. Facebook finally moved forward with the integration of WhatsApp and Instagram in 2019.

Six years after WhatsApp joined Facebook, Koum and the other co-founder, Brian Acton, no longer work for WhatsApp. Acton said he left Facebook over a 2018 dispute over privacy values because Facebook wanted to lay the groundwork to show targeted ads on WhatsApp.

“At the end of the day, I sold my company,” Acton told a Forbes reporter in 2018. “I sold my users’ privacy to a larger benefit. I made a choice and a compromise. And I live with that every day.”

Facebook did not respond to requests from MLex to discuss whether Facebook plans to use Giphy data to target ads, or whether Facebook would be open to Mozilla’s suggestion that it not combine data collected by Giphy with other user data Facebook collects about users.

The story of the evolution of WhatsApp, however, is the slow-motion privacy problem cited by critics such as Mitch Stoltz of the Electronic Frontier Foundation. Consumers who turned to WhatsApp for the express purpose of protecting their privacy because of encryption and other privacy features cannot have been happy about the changes in WhatsApp, which “has pretty much established that there is no way out of Facebook’s data universe,” Stoltz said.

Other court cases and regulatory investigations are making the same connection. An antitrust suit filed today against Google accuses the Internet advertising giant of leveraging its analytics software to lock in advertisers. A privacy suit filed in the same court several weeks ago accuses the same software, Google Analytics, of “surreptitious tracking” that allows Google to continue to log online activity even while people use private modes in any browser, including “Incognito” mode in Google’s Chrome. A Google spokesman said “we strongly dispute” those privacy claims.

The future of the Giphy deal remains unclear. Stoltz said EFF has been talking with both the US Department of Justice and the FTC about ways regulators can combine both data protection and competition analyses in cases such as Giphy.

“What we’ve heard from regulators lately is they are working to bridge that divide, that they are looking at privacy in the context of merger reviews, that they are looking to be less siloed,” Stoltz said.

Related Articles