Skip to main content

Legal Update

FTC Requires Companies to Honor Privacy Policies of Acquired Companies

11 April 2014
Mayer Brown Legal Update

The US Federal Trade Commission (“FTC”) has a significant history of using its Section 5 authority to enforce promises that companies make to consumers in privacy policies. When one company acquires another, however, the companies’ existing privacy policies may be inconsistent. On April 10, 2014, the Director of the FTC’s Bureau of Consumer Protection threatened potential enforcement action where an acquiring company refused to honor promises made in the privacy policy of an acquired company.

In February, Facebook announced its plan to purchase WhatsApp, a mobile messaging company. Notably, WhatsApp’s privacy policy states that, absent a user’s consent, consumers’ information will not be used for advertising purposes or be sold to third parties for commercial or marketing purposes; Facebook, however, routinely uses consumer information for advertising and marketing. Privacy groups filed a complaint with the FTC regarding the inconsistency in the two privacy policies.

The FTC’s letter to Facebook and WhatsApp makes clear that the Bureau of Consumer Protection expects Facebook to continue to honor the commitments WhatsApp made to users in its privacy policy. The letter states that “Facebook’s purchase of WhatsApp would not nullify these promises … and Facebook would continue to be bound by them.” The letter goes on to note that Facebook’s use of data from WhatsApp users in violation of the current WhatsApp privacy policy could constitute a deceptive or unfair practice under Section 5 of the FTC Act.

The FTC’s letter also explains the steps Facebook would need to take if it intends to use data from WhatsApp users in ways that are inconsistent with WhatsApp’s current privacy policy. Most importantly, Facebook would need to obtain WhatsApp’s users’ affirmative consent before doing so. The letter cautioned that Facebook must avoid any misleading statements about how the data would be used or maintained. Finally, the letter recommends that Facebook offer users the opportunity to opt out of any such changes, instead of making such changes mandatory for all consumers by virtue of their continued use of WhatsApp.

Privacy policies continue to be an important aspect of any company’s online and offline presence, and the FTC’s letter stands as a reminder about the potential pitfalls associated with such policies. In particular, the letter makes clear that companies contemplating potential acquisitions must consider and address inconsistencies in privacy policies. To the extent that an acquiring company wants to change the privacy policy of a target company to conform to its own, it will likely need affirmative consumer consent to do so. Absent such considerations, Section 5 enforcement actions are possible.

For more information about the FTC’s letter, or any other matter raised in this Legal Update, please contact at +1 202 263 3848 or at +1 202 263 3424.

The Build a Report feature requires the use of cookies to function properly. Cookies are small text files that are placed on your computer by websites that you visit. They are widely used in order to make websites work, or work more efficiently. If you do not accept cookies, this function will not work. For more information please see our Privacy Policy

You have no pages selected. Please select pages to email then resubmit.