Promises to Keep: Lessons Learned from Facebook’s Recent Acquisitions of WhatsApp and Moves
Written by Jake Romero, CIPP/US
Mergers are never simple, but the acquisition of consumer products and technology requires the purchasing entity to consider a number of questions and issues beyond the standard concerns related to executive pay, corporate valuations and per share prices. Will we be able to integrate our corporate cultures? Will the service’s current users make angry reaction GIFs about us to demonstrate their disapproval? Is this something we can fix with a rapping monkey video? Are Beats by Dre headphones ‘extraordinarily bad’? Following a number of high profile tech acquisitions, Facebook, Inc. has learned that among the questions that must be asked, is “What promises has the target entity made to its users regarding data the target is collecting?”
We may share information, including personally identifying information, with our Affiliates (companies that are part of our corporate groups of companies, including but not limited to Facebook) to help provide, understand, and improve our Services.
The new language isn’t unusual; similar provisions can be found in most online privacy policies, but under the circumstances the change appeared to backtrack on a promise made to the service’s users. As a result, Facebook found itself on the defensive. Facebook released a statement clarifying that data from Moves would not be commingled with Facebook data, and that the purpose of sharing data was limited to providing support and services to the Moves app. Regardless of whether that statement conforms with Facebook’s initial goal for sharing information, there is no question that the language in Facebook’s statement intended to calm users is substantially narrower than the position it took in Moves’ updated policy.
In response to user concerns and rumors of policy changes, WhatsApp posted to its company blog to reassure its users that WhatsApp would continue to operate as a standalone app and had no plans to change its data collection practices. With Facebook on the defensive following the acquisition, Mark Zuckerberg also reassured the public that WhatsApp’s policies and data storage practices would not change.
So What Have We Learned?
What can potential acquirors and technology companies learn from Facebook’s experience with Moves and WhatsApp? Here are a few key take-aways:
- Understand Your Limitations Before You Buy. During the diligence phase of any acquisition, the policies of the target entity and public statements made by its representatives should be thoroughly reviewed for statements concerning use and sharing of data. As regulations on collection of data tighten, we have seen an increase in the number of acquisitions where the collected data is as valuable, of not more so, than the acquired product. This is particularly important in those cases where the acquisition price factors in assumptions regarding how that data will be monetized.
- Have a Plan and Consider Ongoing Costs. If an acquiror does want to change the use or collection practices of a target entity, it is important to understand that there will be costs associated with those changes. From an operations standpoint, a process will need to be put in place to solicit consumer consent. In almost every situation, express consent will not be given by 100% of current users, so a value judgment will need to be made between (a) limiting access for users who do not consent (which may not be an option at all depending on what the product or service is) and (b) segregating user data into separate pools. The latter option will require ongoing expense to maintain and coordinate logistics between separate systems and data pools. This process will need to be closely managed by your general counsel and/or your outside data privacy counsel.
- Understand the Culture of Your Target. Not every company has the kind of deeply ingrained user expectations that we’ve seen with companies like WhatsApp and Tumblr, but it is important to understand what kind of user base the target has before you purchase. In the case of WhatsApp, concerns erupted immediately, without an indication that Facebook intended to change WhatsApp’s data policies. Similarly, negative reactions to Yahoo’s acquisition of Tumblr began immediately on the basis of public perceptions of the companies involved. Acquiring entities should consider whether a consumer response plan should be put in place prior to announcing the acquisition and, in some cases, whether messaging control and public response management will be required on a preemptive basis.
As noted at the outset, mergers are never simple. Rare are the acquisitions that will be completed without a hitch. When it comes to user data, however, it is more important than ever for acquiring entities to take the necessary steps to ensure that they get what they pay for.