Authors: Eduardo Magrani and Lucas van Hattem

The start of the new year might not have taken the turn WhatsApp was hoping for. At the beginning of January 2021 users of the messaging app started to get a pop-up notification informing users of an update to their ‘terms of service’ by which data would be shared with its parent company Facebook. The user had to accept the new terms in order to continue using the app after the 8th of February.

In retaliation, millions of users searched for alternative messaging apps, with Signal and Telegram being the most popular. The downloads of these alternatives, in the App Store and the Google Play Store, surged into the millions. In the week of January 6–12, Signal was downloaded 7.5 million times, a 4,200% increase from the week before, while Telegram downloads rose by 91% with 9 million downloads.

Although this chain of events captured the media’s attention, concrete numbers are still lacking about how many users officially stopped using WhatsApp. The surge into millions of downloads for Telegram and Signal, respectively, paints a fuzzy picture of the value users place on their data privacy, given that these numbers pale in comparison to the 2000 million monthly active users hosted by WhatsApp. Moreover, looking at the numbers of MAU of Telegram and Signal it is clear WhatsApp is still the biggest player and comfortably ahead of its ‘competition.’

Why the sudden change of heart?

One reason for this ‘migration’ can be understood by social media users’ increasing awareness of the value of their personal data and what happens to this data. The unassuming trust which users place in online platforms has declined in recent years. Nowadays, users are more concerned about sharing their data in the first place; when it is shared, they expect transparency. Moreover, when it’s personal data, users need assurance that their data is used in a fair and safe manner. Although many users are more ‘privacy aware’ than years ago, plenty are not. Or even if they are, it is hard for them to implement this awareness in their own lives for different reasons as will be discussed further. In addition to privacy concerns, recent Facebook scandals have surely impacted people’s added frustration and willingness to switch from the WhatsApp platform, which demonstrated its inability to prove its independence from the big tech giant.

Could this new privacy update by WhatsApp (Facebook) be the final stroke for millions of users to look for alternatives that offer more transparency and privacy? Likely not, but if this were the case, would Telegram and Signal be the best alternatives? Do they offer better privacy options than WhatsApp? And does increased privacy necessarily translate into a competitive advantage in the eyes of app users? As will be discussed, in the aftermath of the WhatsApp update, Telegram gained more users than Signal, though it offered a less privacy-centric technology to users. These parameters demonstrated that other factors beyond the respective technologies’ ‘privacy-by-design,’ such as users’ privacy awareness and whether a given app was able to garner a critical mass of users, played significantly into users’ decision as to whether to transition onto a new platform, and if so, what platform was preferred.

WhatsApp: How did we get here?

Founded in January 2009, WhatsApp, prior to its transition into a messaging app, was simply an app enabling users to update their status and be seen by others in their network. The messaging feature, which is now the main feature, was added in the 2.0 version. In 2012, WhatsApp stated that they were interested neither in integrating ads into their app, nor in the data of their users. Given that the company couldn’t sell user data, they opted for a freemium business model which meant giving the user one year of free use and then charging a small fee of $0.99 per year in the form of a subscription.

When Facebook bought WhatsApp in 2014, it was made clear to the users that nothing was going to change since it would remain autonomous and operate independently. Then, in 2016, after making the app free for its users, it implemented end-to-end encryption in April 2016. This increased their popularity since not even WhatsApp could read the content of users’ messages. In a sense, this was an early example of WhatsApp using data protection and user privacy as a unique selling point and competitive advantage over other services. However, in August 2016, Facebook announced a WhatsApp privacy policy update through which they informed users that some of their data would be shared with the new parent company.

In light of 2016 users’ lackluster concern for their data, the provision of end-to-end encryption, and limited alternatives, WhatsApp did not lose a large number of users. WhatsApp users proved underwhelmed by the encroachments on their personal data and did not find them sufficiently invasive to outweigh the convenience of a free service which already hosted most family, friends and colleagues. In keeping with considerations of achieving critical mass, leaving WhatsApp would mean leaving your core social circle, unless all users left together.

However, it was clear that with January’s privacy policy update, users felt Facebook took it too far. Many people decided that it may be worth changing to another messaging app to which they were willing to entrust their data, or to have the option not to share data at all. Rising frustrations with each Facebook scandal likely contributed to the users’ frustration. With the introduction of regulations such as the General Data Protection Regulation (GDPR), which set a global standard on data protection regulation, the California Consumer Protection Act of 2018 and many other data protection regulations around the world, there appears to be an increased public awareness of the value and magnitude of collection of user-data. A recent study has suggested that 80% of consumers are more concerned with their privacy than they used to be. The increasing privacy awareness together with the recent Facebook scandals was likely the final straw for some users.

A look at the alternatives: Telegram and Signal

Telegram is a messaging app that was founded in 2013 with a focus on speed and security. A significant factor that distinguishes it from WhatsApp and Signal is the possibility to create groups for up to 200,000 people and channels for broadcasting to unlimited audiences. In this sense it is clearly more than ‘just’ a messaging app. On the other hand, Signal was founded in 2014 as the combination of two messenger services, TextSecure and Redphone. As the youngest messaging app of the three in question, this partially explains the relatively small amount of MAU as shown in fig. 3. Signal, an independent non-profit organization which does not chase revenues and is funded by grants and private investors, was developed as a messaging platform, embedded with consideration for the highest privacy standards for its users.

The two privacy-motivated companies have openly expressed their non-interest in user’s data and propose to offer an alternative to the data collecting messaging service, WhatsApp. Telegram and Signal do not share data with other companies, which creates a competitive advantage over WhatsApp, particularly for those users who are more ‘privacy aware.’ In contrast, WhatsApp does provide end-to-end encryption, something which used to be one of the key selling points making it and attractive to its user base.

The advantage of privacy-by-design

Privacy-by-design can give a company in a certain market a “competitive advantage” since it provides users something they want that the competition does not offer. Privacy-by-design was first used to describe the notion of embedding privacy measures and privacy-enhancing technologies into the design of information technologies and systems. Now, privacy-by-design is seen as a multifaceted concept, involving different technological and organizational components that implement privacy and data protection principles in systems and services. Moreover, article 25 of the GDPR, addresses data protection by design as a legal obligation for data processors and controllers by making an explicit reference to data minimization and the option of pseudonymization. Since the GDPR only provides minimum requirements, a company can of course go further by collecting no data whatsoever from its consumers.

Companies should recognize the monetary value of prioritizing privacy-by-design since it attracts consumers that care about their data protection. Respecting a higher standard of privacy-by-design and incorporating it in software (more protection and less data gathering) can give a competitive market advantage. This is exactly what Signal and Telegram promise to do with their app and business model.

Telegram and Signal battle for the highest data protection

Although both Signal and Telegram claim to be more privacy-centric than their competition, it is Signal that stands strong. Telegram states that messages are “heavily encrypted,” insinuating that this is the default for all messages sent on the app, as is the case for WhatsApp and Signal. However, in looking at Telegram’s Privacy Policy, the end-to-end encryption is only applicable to the private chats that are “secret chats,” unlike Signal which features this by default. Signal is a messaging app with default end-to-end encryption, and even encrypts the metadata. Telegram gained the trust of millions of new users by promoting itself as a (highly) privacy-focused messaging app, but ultimately has not held true on this promise, an omission that makes it vulnerable to critique, given that users give high value to transparency when it comes to data and privacy.

This crucial difference that most users were/are not aware of was made public by a tech reporter at the New York Times. This news, however, came late, since initially, when WhatsApp announced its privacy update, people were quick to assume that changes were going to be implemented rendering their data no longer safe. They did not check the veracity of the news, which spread like wildfire, that Telegram and Signal were the best and most privacy-respecting alternatives to WhatsApp. As a result, it appears that users’ experienced a “privacy shock” when they learned that the real privacy implications of each respective messaging platform was not so easy to determine. At the end of the day, how many users read and analyze the privacy policy of an app, especially when the website’s front page makes a clear claim indicating a particular standard of data protection?

User considerations for switching to Telegram or Signal

It is important to mention that while users take privacy into account when choosing a messaging platform, perhaps even more, they are swayed by the actions of their peers. A user might not switch entirely to a messaging app that is not used by the people he or she is in contact with the most. Convincing all friends, colleagues and family to switch over to a new app is a mighty task. Considering that prior to the WhatsApp policy update Telegram had 400 million users in contrast to Signal’s 32 million users, there may have been a more clear question of convenience over technical considerations.

Telegram’s critical mass onboarded enough users to position them as the most visible competition and convenient switch for users. When people searched for an alternative platform, not only was it inconvenient to transfer to Signal but there were simply fewer people to connect to.

In addition, while privacy awareness and the experienced privacy shock was a significant factor the exodus from WhatsApp, it may not have sufficiently determined their destination app. How aware are users really about their privacy implications? Findings, in the context of use of two contact tracing apps in Israel show that privacy perceptions factor prominently into the decision to install a particular application; if people are convinced that the technology does not track them and threaten their privacy, they may be more inclined to install it. By way of analogy, it seems like Telegram used the gap between ‘real vs. perceived’ privacy implications to capitalize on privacy-by-design’s competitive advantage.

This event further demonstrates the extent to which users are often unaware of the differing privacy implications of various applications although the differences may be significant. This raises the issue of how a company communicates privacy considerations accurately and accessibly to a broad public. Further, while privacy specifications are important, they must be accompanied by an increasing privacy awareness from the users in order to ascertain differences, benefits and drawbacks. Although Signal has the strongest privacy considerations of the three apps, users remain largely unaware of the technical differences. Signal’s efforts to increase awareness of its superior privacy specifications notwithstanding, policymakers should also take responsibility in this realm by promoting the development of tools and digital literacy programs that better educate citizens regarding the technologies they download and how to ensure that they are actively in control and able to responsibly protect their individual data.

Conclusion

Arguably the WhatsApp update of its privacy terms of service was, for a relatively large number of users, the final straw in this context of the recent scandals regarding Facebook and the growing privacy awareness among users. However, WhatsApp remains the biggest platform, with Telegram and Signal still trailing behind.

For now, Signal, of the three platforms in question, appears to offer the highest protection of users’ data, offering the most adequate privacy-by-design. The real “competitive advantage” of privacy-by-design is achieved among users who care about their data and are aware of the differences between the messaging apps. This includes both people who researched the messaging apps and switched to Signal before the WhatsApp update as well as those who became more aware about their privacy after the update notification and decided to switch to Signal since they deemed it the best alternative. Given the numbers, privacy-by-design as a competitive advantage seems not that big of an advantage in the current market, but should gain much more importance with the current trend of data protection regulations and enforcement and as citizens become more aware and in command of their personal data, including understanding how it is used, for what purposes and by whom.

When scrambling for an alternative messaging app, in practice, users chose the app with less privacy protection with regard to end-to-end encryption of messages. Although awareness regarding privacy is increasing, there are clearly other factors that come into play other than the sole considerations of privacy and the protection of data. That being said, it seems that, despite increasing awareness of personal data and privacy emerging from regulations such as the GDPR, citizens struggle over how to properly ‘implement’ this in their daily life. One reason for this is the lack of information and/or transparency regarding their privacy as discussed in Telegram’s case. Regulators must play a more proactive role, and take greater responsibility in creating such awareness. Adequate data protection regulation and better enforcement can lead to more transparency and accountability from companies in regard to the collection and processing of user data.

————————————————————————————————————————————————–

The Israel Public Policy Institute (IPPI) serves as a platform for exchange of ideas, knowledge and research among policy experts, researchers, and scholars. The opinions expressed in the publications on the IPPI website are solely that of the authors and do not necessarily reflect the views of IPPI.