When WhatsApp announced on Thursday that it would start sharing data with its corporate parent, Facebook, some of its fans howled that the popular messaging service was betraying long-held promises to protect their privacy. But for the companies, angry users may pose less of a problem than the Federal Trade Commission, which serves as the country’s top privacy regulator.
Recall that in 2014, after Facebook (FB) announced it would acquire WhatsApp, the FTC’s Bureau of Consumer Protection sent a stern letter to the companies warning them to honor their promises to consumers or face an investigation into unfair trade practices.
That letter also pointed to specific pledges from the companies including one by Facebook CEO Mark Zuckerberg who insisted that, “We are absolutely not going to change plans around WhatsApp and the way it uses user data.”
The result is that WhatsApp, which has over 1 billion users, will have to tread very carefully as it implements its plan to share information such as phone numbers and analytics data with Facebook. (While WhatsApp users will have an option to block Facebook from using certain data for advertising, they will be unable to block Facebook from linking the accounts internally to get a better picture about who its users are and, possibly, an even better idea about who they know).
For Facebook, the task of carrying out all this in a lawful manner is more challenging still since the company is under a 20-year consent decree related to earlier complaints about its privacy policies:
If @facebook & @WhatsApp didn't consult @FTC before making this privacy policy change, they could be in hot water. https://t.co/VsMo2YWQtp
— William McGeveran (@BillMcGev) August 25, 2016
The FTC, as is its custom, declined to comment on how or if it will scrutinize Facebook’s plan to integrate the WhatsApp data.
Get Data Sheet, Fortune’s technology newsletter.
Since the FTC acts as a law enforcement agency, it does not actively tell companies what is or is not acceptable, but instead requires them to be familiar with its rules and act accordingly. In this case, the answer to whether the Facebook data plan is legal is likely turn on just how WhatsApp goes about obtaining permission to implement the changes. As the 2014 letter from the agency noted:
Finally, if you choose to change how you collect, use, and share newly-collected WhatsApp data, we recommend that you offer consumers an opportunity to opt out of such changes or, at least, that you make clear to consumers that they have an opportunity to stop using the WhatsApp service
In practice, this means Facebook could face extra scrutiny if it puts the new WhatsApp changes deep in a pile of legal mumbo-jumbo. As for the opt-out, here is what WhatsApp says it would look like:
In response to a question about the FTC rules, Facebook provided the following statement from a WhatsApp spokesperson:
“WhatsApp complies with applicable laws. As always, we consider our obligations when designing updates like this … We’ve made our terms and privacy policy easily accessible, provided an overview of the key updates, and empowered people to make decisions that are right for them, including offering a control for existing users over how their data can be used.”
For Facebook, the data integration plan is important since WhatsApp, which it acquired for $22 billion, has yet to generate any real revenue for the company.
