WhatsApp is raising the minimum user age from 13 to 16, potentially locking out large numbers of teenagers as the messaging app looks to comply with the EU’s new data protection rules.
The Facebook-owned messaging service that has more than 1.5 billion users will ask people in the 28 EU states to confirm they are 16 or older as part of a prompt to accept a new terms of service and an updated privacy policy in the next few weeks.
Q&A What is GDPR?
The European Union's new stronger, unified data protection laws, the General Data Protection Regulation (GDPR), will come into force on 25 May 2018, after more than six years in the making.
GDPR will replace the current patchwork of national data protection laws, give data regulators greater powers to fine, make it easier for companies with a "one-stop-shop" for operating across the whole of the EU, and create a new pan-European data regulator called the European Data Protection Board.
The new laws govern the processing and storage of EU citizens' data, both that given to and observed by companies about people, whether or not the company has operations in the EU. They state that data protection should be both by design and default in any operation.
GDPR will refine and enshrine the "right to be forgotten" laws as the "right to erasure", and give EU citizens the right to data portability, meaning they can take data from one organisation and give it to another. It will also bolster the requirement for explicit and informed consent before data is processed, and ensure that it can be withdrawn at any time.
To ensure companies comply, GDPR also gives data regulators the power to fine up to €20m or 4% of annual global turnover, which is several orders of magnitude larger than previous possible fines. Data breaches must be reported within 72 hours to a data regulator, and affected individuals must be notified unless the data stolen is unreadable, ie strongly encrypted.
How WhatsApp will confirm age and enforce the new limit is unclear. The service does not currently verify identity beyond requirements for a working mobile phone number.
WhatsApp said it is not asking for any new rights to collect personal information in the agreement it has created for the European Union. It said: “Our goal is simply to explain how we use and protect the limited information we have about you.”
WhatsApp’s minimum age will remain 13 years outside of Europe, in line with its parent company. In order to comply with the European General Data Protection Regulation (GDPR), which comes into force on 25 May, Facebook has taken a different approach for its primary social network. As part of its separate data policy, the company requires those aged between 13 and 15 years old to nominate a parent or guardian to give permission for them to share information with the social network, or otherwise limit the personalisation of the site.
WhatsApp also announced on Tuesday that it would begin allowing users to download a report detailing the data it holds on them, such as the make and model of the device they used, their contacts and groups and any blocked numbers.
GDPR is the biggest overhaul of online privacy since the birth of the internet, giving Europeans the right to know what data is stored on them and the right to have it deleted. The new laws also give regulators the power to fine corporations up to 4% of their global turnover or €20m, whichever is larger, for failing to meet the tough new data protection requirements.
WhatsApp, founded in 2009 and bought by Facebook for $19bn in 2014, has come under pressure from some European governments in recent years because of its use of end-to-end encryption and its plan to share user data with its parent company.
In 2017 European regulators disrupted a move by WhatsApp to change its policies to allow it to share users’ phone numbers and other information with Facebook for ad targeting and other uses. WhatsApp suspended the change in Europe after widespread regulatory scrutiny, and signed an undertaking in March with the UK Information Commissioner’s Office to not share any EU citizen’s data with Facebook until GDPR comes into force.
But on Tuesday the messaging firm said it wanted to continue sharing data with Facebook at some point. It said: “As we have said in the past, we want to work closer with other Facebook companies in the future and we will keep you updated as we develop our plans.”