MetaSupplementary Written evidence (FDF0082)


Thank you again for inviting me to give evidence to the committee on 23rd May. During the hearing there were a couple of questions I promised to follow up on.


WhatsApp calls

During the hearing you asked whether we are able to tell if someone calling from overseas is pretending to be a UK number.

WhatsApp has a limited ability to identify when a call or message is originating from a location that differs from the country code assigned to the registered phone number, using identifiers like a user’s IP address for example. However, it is increasingly easy to mask your IP address using virtual private networks (VPNs) and other technologies.

Users may use +44 SIM cards (and numbers) while outside the United Kingdom for perfectly legitimate reasons - including travelers or individuals who have moved. However, in some cases, they can also be individuals seeking to deceive recipients of messages or calls. 

WhatsApp has a number of features to protect users from unwanted or deceptive calls or messages. WhatsApp’s registration process includes two-factor authentication, which requires a user to be able to receive calls or messages at the registered phone number in order to complete registration.  

When a WhatsApp user receives a call or message for the first time from another user who is not in their contact list WhatsApp will prominently display a warning of this fact, and ask the recipient if they want to block or report the person contacting them. WhatsApp employs advanced technology to identify users who are repeatedly blocked or reported by others, and may take action to ban such accounts from WhatsApp.

We are also aware that users may seek to use virtual numbers during registration. While the reasons for this can be legitimate, these phone number types are often attractive to bad actors, so WhatsApp seeks to block registration attempts from Voice Over IP providers. As new providers pop up trying to navigate around our blocking mechanism, we work to improve our integrity measures to meet these new challenges.


Direct messaging

You also asked whether Meta had considered introducing restrictions on who can contact you via direct message (DM) in Messenger and on Instagram.

All accounts on Instagram have the option to switch off DMs from people they don’t follow, which means you never have to receive a DM from anyone you don’t know if you don’t want to. Messenger also has granular privacy settings which give you the ability to turn off message requests from people you’re not friends with or haven’t chatted with.

If someone you don’t currently follow sends you a message, it will appear as a message request in your message requests inbox, which is separate from your main DM inbox. You then have the ability to decline or allow the request. Only when you accept, will future messages from that sender go directly to your DM inbox. Messenger also automatically filters potentially fraudulent or spammy messages direct to your spam folder, so they don't reach your inbox.

We’ve also made it harder for someone who you’ve already blocked from contacting you again through a new account. With this feature, whenever you decide to block someone on Instagram, you’ll have the option to both block their account and preemptively block new accounts that person may create.

We also deploy Safety Notices in chats to help educate people on ways to spot scams or imposters and help them take action to prevent a costly interaction like blocking the account. These Safety Notices help people avoid potentially harmful interactions and possible scams while empowering them with the information and controls needed to keep their chats private, safe and secure.

For Messenger Rooms, when someone you’ve blocked is logged into Facebook or Messenger, they won’t be able to join a room you’re in and you won’t be able to join theirs.


Additional protections for under 18s

In the UK, everyone who is under 18 years old is defaulted into a private account when they join Instagram and we provide enhanced safety features for people under 18 on Messenger.

To protect teens from unwanted contact from unconnected adults, including fraudsters, we prevent adults on both Instagram, Facebook and Messenger from sending messages to people under 18 who don’t follow them or they aren’t friends with.

We’ve also developed new technology that allows us to detect accounts that have shown potentially suspicious behavior and stop those accounts from following and interacting with young people’s accounts. By “potentially suspicious behavior”, we mean accounts belonging to adults that may have recently been blocked or reported by a young person, for example.


Fraud in our terms and conditions

Finally, Lord Browne asked if we included an explicit mention of Fraud in our terms and conditions. I confirmed that we did but Lord Browne noted that he had struggled to find any when he read them, so I wanted to take this opportunity to flag where they are.

We explicitly state in our Terms of Service that

“You may not use our Products to do or share anything:

        That breaches these Terms, our Community Standards and other terms and policies that apply to your use of our Products.

        That is unlawful, misleading, discriminatory or fraudulent.”

Our Community Standards then set out in detail what is and isn’t allowed on Facebook and Instagram. These include a dedicated “Fraud and Deception” policy which is developed in collaboration with independent experts and is frequently updated to reflect an ever changing landscape. This policy (including all previous versions) and the rest of our community standards are publicly available through our Transparency Center.


30 June 2022