Privacy experts on Friday called for the Federal Trade Commission (FTC) to examine social media app Whisper’s tracking of “anonymous users”.



The US consumer watchdog has broad powers to sanction companies it believes have breached their promises to consumers and has become increasingly interested in claims made by tech companies, sanctioning Facebook, Google and Snapchat in recent years.

On Thursday the Guardian revealed that Whisper, an app that promises to “anonymously share your thoughts and secrets”, is tracking its users including some who have asked not to be followed and storing their posts indefinitely while it trawls their messages to identify interesting stories to promote itself in the media.

“That’s exactly the kind of deceptive practice that the FTC should crack down on because consumers do rely on those representations,” said Marc Rotenberg, executive director of the Electronic Privacy Information Center (EPIC), which filed a complaint with the FTC last year asking it to investigate Snapchat.

“It’s very important but there has to be more transparency and accountability. Companies that offer anonymity services should deliver them,” he said.

Chris Calabrese, legislative counsel of the American Civil Liberties Union (ACLU), said: “There is no question that the FTC almost has to investigate. Beyond the fact that they seem to have violated the promises they make to users by telling them they can opt out of location and then tracking them, the entire way Whisper seems to be working behind the scenes to identify people is just so diametrically opposite to the promise of the site, which is anonymous, not identifiable speech. When the FTC sees something like that I don’t see how it can’t investigate it.”

Whisper vehemently denied that it collects identifiable information from its users and and described the Guardian’s report as a “a pack of vicious lies”. “Whisper does not collect nor store any personally identifiable information (PII) from users and is anonymous. To be clear, Whisper does not collect nor store: name, physical address, phone number, email address, or any other form of PII. The privacy of our users is not violated in any of the circumstances suggested in the Guardian story,” the company said in a statement.

The Guardian had posted a response detailing with the substance of what was reported.

Calabrese disputed Whisper’s claims that it was not collecting identifiable information. “Whether or not they call that personally identifiable information, if I know where someone sleeps at night, goes to work every day, I have a pretty good idea who they are whether or not I have collected their name,” he said.

Whisper’s senior vice-president, Eric Yellin, confirmed to the Guardian that Whisper does “occasionally look at user IP addresses internally to determine very approximate locations” after people have opted out of geolocation.

Mobile IP locations are far less precise than GPS locations, however Calabrese said it still meant Whisper was following people who had asked not to be followed.

“Whisper is offering people the option to opt out of location tracking in a very straightforward way and then continuing to track them. That is something the FTC almost has to look at. If that’s OK then almost the entire opt out regime on the web gets called into question,” he said.

The FTC was not immediately available for comment.

Privacy expert Woodrow Hartzog, a visiting professor of law at the University of Notre Dame, said the only likely bar to an investigation was time. The cash-strapped FTC takes about 10 to 12 cases per year, meaning it must focus on issues it feels have a wider resonance.

“That said, the FTC has clearly signalled it is very concerned about software companies making promises and not delivering on them,” he said. He added that he felt “anonymity” was a hot issue that the regulator would want to define as more companies make promises about protecting a user’s identity.

“Whisper can say that no personal identifying information is collected. I don’t think that’s what consumers would see as ‘anonymous’. The public perception of anonymous is that you can’t tell who I am.”

Hartzog said Whisper’s terms and conditions were unlikely to constitute a strong defence if the FTC mounts a case. The agency considers marketing material and public announcements to be more important than the legalese that constitutes most companies’ terms and that few people read.

Whisper updated its terms and conditions and added a new privacy policy this week, four days after being contacted by the Guardian about its forthcoming report. The new terms state “please bear in mind that, even if you have disabled location services, we may still determine your city, state, and country location based on your IP address”.

They also warn that “even if you do not include personal information in your whispers, your use of the Services may still allow others, over time, to make a determination as to your identity based on the content of your whispers as well as your general location.”

Hartzog said the FTC has generally given short shrift to such disclosures and would focus on promises made by the app and its executives. Chief executive Michael Heyward has called the app the “safest place on the internet”.

“It’s highly possible that when you go around calling yourself ‘the safest place on the internet’ to disclose information then that shapes consumer expectations,” said Hartzog. “Companies rely upon those types of representations to induce users to use them because otherwise they may as well use Twitter, Instagram or Facebook.”