The US Federal Trade Commission (“FTC”) has a significant history of using its Section 5 authority to enforce promises that companies make to consumers in privacy policies. When one company acquires another, however, the companies’ existing privacy policies may be inconsistent. On April 10, 2014, the Director of the FTC’s Bureau of Consumer Protection threatened potential enforcement action where an acquiring company refused to honor promises made in the privacy policy of an acquired company.

In February, Facebook announced its plan to purchase WhatsApp, a mobile messaging company. Notably, WhatsApp’s privacy policy states that, absent a user’s consent, consumers’ information will not be used for advertising purposes or be sold to third parties for commercial or marketing purposes; Facebook, however, routinely uses consumer information for advertising and marketing. Privacy groups filed a complaint with the FTC regarding the inconsistency in the two privacy policies.

The FTC’s letter to Facebook and WhatsApp makes clear that the Bureau of Consumer Protection expects Facebook to continue to honor the commitments WhatsApp made to users in its privacy policy. The letter states that “Facebook’s purchase of WhatsApp would not nullify these promises … and Facebook would continue to be bound by them.” The letter goes on to note that Facebook’s use of data from WhatsApp users in violation of the current WhatsApp privacy policy could constitute a deceptive or unfair practice under Section 5 of the FTC Act.

The FTC’s letter also explains the steps Facebook would need to take if it intends to use data from WhatsApp users in ways that are inconsistent with WhatsApp’s current privacy policy. Most importantly, Facebook would need to obtain WhatsApp’s users’ affirmative consent before doing so. The letter cautioned that Facebook must avoid any misleading statements about how the data would be used or maintained. Finally, the letter recommends that Facebook offer users the opportunity to opt out of any such changes, instead of making such changes mandatory for all consumers by virtue of their continued use of WhatsApp.

Privacy policies continue to be an important aspect of any company’s online and offline presence, and the FTC’s letter stands as a reminder about the potential pitfalls associated with such policies. In particular, the letter makes clear that companies contemplating potential acquisitions must consider and address inconsistencies in privacy policies. To the extent that an acquiring company wants to change the privacy policy of a target company to conform to its own, it will likely need affirmative consumer consent to do so. Absent such considerations, Section 5 enforcement actions are possible.

For more information about the FTC’s letter, or any other matter raised in this Legal Update, please contact Howard W. Waltzman at +1 202 263 3848 or Joseph P. Minta at +1 202 263 3424.