All the data WhatsApp and Instagram send to Facebook

Under GDPR, Facebook and its companies should be meeting accountability requirements by providing comprehensive and well-explained information, says Fielding. She says because what is happening to data is in many cases not clear, “it’s impossible to say exactly where data is going, which is a problem”.

The WhatsApp privacy change, which despite an initial delay is still rolling out, covers the way you communicate with businesses that use its API. WhatsApp chats between people and businesses are end-to-end encrypted as they are transmitted, but following the recent privacy update, they can be stored once received by a business using a Facebook-hosted service.

“The privacy policy change enables businesses to store your WhatsApp chats once they receive them, on Facebook-hosted servers, and therefore outside end-to-end encryption,” says Zak Doffman, CEO of surveillance tech firm Digital Barriers. “WhatsApp says Facebook can’t use this data, but the business can mine chats for advertising.”

After an initial delay, the update to WhatsApp’s terms of service is starting to roll out globally, but it may still falter in the EU, where it is facing an investigation by authorities.

What data does Instagram share with Facebook?

Instagram shares a lot of data with Facebook. Its privacy policy outlines how the social network “connects information about your activities on different Facebook products and devices” to provide a “more tailored and consistent experience”. For example, it can suggest you join a group on Facebook that includes people you follow on Instagram or communicate with using Messenger.

Facebook and Instagram share infrastructure, systems and technology with other Facebook companies. This means information shared from WhatsApp about accounts sending spam can be used to take action on Facebook, Instagram or Messenger.

Instagram can also collect your location, where you live, the places you visit, and details about the businesses and people you’re near to “provide, personalise and improve Facebook Products”, including ads, for “you and others”.

Yet despite hefty data collection and sharing, Instagram has fewer privacy controls than its parent, says Jake Moore, cybersecurity specialist at security company ESET. “Instagram has fewer privacy controls than Facebook and you can’t stop most of your data being shared between the platforms, but you can adjust how certain information is used.”

For example, he says, Instagram shares your location data with Facebook but you can curb the app’s access to your whereabouts and limit the audience to your posts in your settings.

Limiting data sharing

Facebook companies are numerous, including Facebook itself and its Messenger service, as well as 91 acquisitions by the social network such as WhatsApp, Instagram and Oculus. Limiting data sharing between Facebook and these companies is challenging, especially given the tracking and profiling that happens between the social network and other sites across the web.

“Every website, most apps and retailers, entertainment outlets and service providers are feeding your data to Facebook,” Fielding says. At least five million websites are using Facebook Pixel trackers, and people give away more of their data via the Login With Facebook API, which allows you to carry over Facebook profile information to other apps and websites. “That adds up to a huge amount of power over your online experience, beliefs and interactions,” says Fielding.

Yet there are some steps you can take to stop Facebook data sharing in general, says Fielding. “Don’t use apps that snitch to Facebook, don’t buy Facebook-reliant products, use Facebook in your browser not the app, if you have to at all. Stay off Instagram, delete WhatsApp or separate contacts lists by context, and have a separate work phone. Never use anything with ‘Facebook-powered’ on it.”