Home > Legal Library > Article

Join Matindale-Hubbell Connected

FTC Requires Companies to Honor Privacy Policies of Acquired Companies

Joseph P. Minta
Howard W. Waltzman
Mayer Brown LLP - Washington Office

April 16, 2014

Previously published on April 11, 2014

The US Federal Trade Commission (“FTC”) has a significant history of using its Section 5 authority to enforce promises that companies make to consumers in privacy policies. When one company acquires another, however, the companies’ existing privacy policies may be inconsistent. On April 10, 2014, the Director of the FTC’s Bureau of Consumer Protection threatened potential enforcement action where an acquiring company refused to honor promises made in the privacy policy of an acquired company.

In February, Facebook announced its plan to purchase WhatsApp, a mobile messaging company. Notably, WhatsApp’s privacy policy states that, absent a user’s consent, consumers’ information will not be used for advertising purposes or be sold to third parties for commercial or marketing purposes; Facebook, however, routinely uses consumer information for advertising and marketing. Privacy groups filed a complaint with the FTC regarding the inconsistency in the two privacy policies.

The FTC’s letter to Facebook and WhatsApp makes clear that the Bureau of Consumer Protection expects Facebook to continue to honor the commitments WhatsApp made to users in its privacy policy. The letter states that “Facebook’s purchase of WhatsApp would not nullify these promises ... and Facebook would continue to be bound by them.” The letter goes on to note that Facebook’s use of data from WhatsApp users in violation of the current WhatsApp privacy policy could constitute a deceptive or unfair practice under Section 5 of the FTC Act.

The FTC’s letter also explains the steps Facebook would need to take if it intends to use data from WhatsApp users in ways that are inconsistent with WhatsApp’s current privacy policy. Most importantly, Facebook would need to obtain WhatsApp’s users’ affirmative consent before doing so. The letter cautioned that Facebook must avoid any misleading statements about how the data would be used or maintained. Finally, the letter recommends that Facebook offer users the opportunity to opt out of any such changes, instead of making such changes mandatory for all consumers by virtue of their continued use of WhatsApp.

Privacy policies continue to be an important aspect of any company’s online and offline presence, and the FTC’s letter stands as a reminder about the potential pitfalls associated with such policies. In particular, the letter makes clear that companies contemplating potential acquisitions must consider and address inconsistencies in privacy policies. To the extent that an acquiring company wants to change the privacy policy of a target company to conform to its own, it will likely need affirmative consumer consent to do so. Absent such considerations, Section 5 enforcement actions are possible.


The views expressed in this document are solely the views of the author and not Martindale-Hubbell. This document is intended for informational purposes only and is not legal advice or a substitute for consultation with a licensed legal professional in a particular case or circumstance.

View More Library Documents By...

Mayer Brown LLP Overview