The Inside Story of the WhatsApp Acquisition: Why Facebook Paid $19 Billion

Introduction

Something’s really fishy about WhatsApp. It’s been 10 years since Facebook announced that it was buying the company for $22 billion. They spent $19 billion dollars to buy it. Why did they do it and what does it mean?

You would think that the reason behind this is obvious: more data to their algorithm, figuring out what you’re discussing with your friends and serving you ads about it. Then there’s the strategic value and what we can do together. But to this day, Facebook swears that all texts in WhatsApp are end-to-end encrypted and that they don’t use them for ads.

So, is that true?

I’m going to get back to that, don’t worry.

WhatsApp’s Revenue and ROI

According to Facebook’s public filings, WhatsApp made $382 million in 2023, mostly from their business messaging platform. So, that’s how WhatsApp makes money. End the video. No, wait. Of course, that’s pennies compared to the $19 billion that Zuckerberg paid to acquire WhatsApp.

Where’s the ROI?

ROI, return on investment, it would literally take 49 years to recover the investment at this rate. So, why would he buy this not very profitable platform instead of using that money, I don’t know, to buy either of these countries or fill 11,000 stadiums with 19 billion rubber chickens or make movies that people actually want to use?

What was the real angle for buying WhatsApp? Let’s go back to the infamous announcement because it did take everyone by surprise. This was, and still is, one of the largest tech acquisitions in history, just shy of a Slack or LinkedIn, but those companies had real business models.

At the time, WhatsApp had around 450 million active users. Only OG app users ever paid anything, their $1 yearly fee, but beyond that, most people have never paid a single dollar for WhatsApp.

WhatsApp’s Market Fit

Now, part of the reason for all this fuss about WhatsApp being overvalued is that much of WhatsApp’s success, their original product-market fit, was mainly outside of the US. America didn’t really need WhatsApp.

Blurry photos, weird likes, you know, if your group has different phones, just use WhatsApp. The Americans have had decent unlimited SMS and MMS with all other 300 million Americans, but that wasn’t a thing for the rest of the world.

WhatsApp’s Origins and Early Days

When you hail from a smaller country, you have friends abroad, you travel outside the country, so you would need something. Back then, you would need something like Skype to be able to be in touch with your friends. Even in larger countries like India, SMS kind of sucked back then, but this was solved in the States.

So much so that the founder of WhatsApp didn’t even build WhatsApp for texting. WhatsApp started in 2009, founded five years earlier by Jan Koum, a former Yahoo employee. Again, replacing SMS was not a problem that needed solving in the US, so Jan’s idea was more of a status update platform.

You would post public updates to your friends, and you would only see your friends’ updates if you opened the app.

So that thing wasn’t doing great, by the way. It was not easy finding OG WhatsApp screenshots. This version only really ran for a few months and only for a handful of people, and it didn’t do so well. Jan had enlisted his Russian friend Alex Fishman, and they were working with a freelancer called Igor Solomnikov.

In mid-2009, Apple started allowing push notifications with, wait for it, iOS 3. Now you could get status updates even when you weren’t using WhatsApp, and a handful of early users started posting updates that felt more like texts.

The company could read them because they were designed as public updates, and so the WhatsApp team figured that they’d chase that use case, ride the wave, and then they released the WhatsApp Messenger in August 2009. It blew up; it quickly grew to 250,000 users, and people were loving it.

This is when Brian Acton joined, who was another Yahoo employee, and he convinced a few friends to invest as well. As part of this deal, he got co-founder status. Wait, so why does he get to call himself a co-founder if he came in later with money? Kind of reminds me of another co-founder debacle we covered last week because WhatsApp was originally designed as a status update service.

The Encryption Journey

Encryption was not a concern at this point. Before 2011, WhatsApp just used a verification text to activate your phone number and text other people. So if New York me wants to send something to Costa Rica me, I’m basically writing a message on a piece of paper that travels the internet, and the server gets it to the destination as a public message.

People on the internet can see it, the router can see it, and WhatsApp’s server can definitely see it. So in this version of WhatsApp, any texts you exchanged were readable by the owner of the company, by the servers. The servers could see the text, and they could have potentially used that to target ads.

Also, in 2011, this company called WhatsApp Hack discovered an exploit that would allow them to intercept the verification SMS that you send to activate a device and potentially use that to hack into your account and read your text. So WhatsApp figured they needed to do something about it, and that something was encryption. But to understand encryption, we need an explainer time.

Their first attempt at encryption was to create an encrypted connection with the server so that the message would travel encrypted through the internet. The problem with this was that many people figured out how to hijack accounts—hackers, or often security researchers. And more crucially to our story, the message in WhatsApp servers could have been visible because the server had the key to see it, which means that the message in Facebook servers after the acquisition could also be visible. Senator, we run ads.

I’m oversimplifying here, but bear with me. The point is that even before the acquisition, WhatsApp had gotten too popular too quickly, and governments had started to raise flags against using WhatsApp because of these security issues. So they had to do something about it, and end-to-end encryption became the only solution.

Okay, so in end-to-end encryption, I have created a key. This is called a private key. It’s a much longer number than this one, but the point is it’s completely secret. Nobody should know what this is. Then create two public keys and send them over the internet. Everyone will be able to see them because they’re live on the internet, but that’s okay.

The receiver gets these keys; he has his own private key and uses it to create a mush combination of numbers that includes both the public keys and his private key. The receiver then sends all this gibberish back to the original sender, who now puts his own key into it and sends a message back. So anybody who intercepted any of these messages can see this, but all they have are the public keys, and they can’t decrypt the message.

The origin for this key exchange mechanism is called the Diffie-Hellman key exchange protocol, and this is old, 70s old-school cryptography. WhatsApp uses a newer version of this called the X3DH, which is the extended triple Diffie-Hellman mechanism, which is even more secure. But the point is that the only way to decode this is to know one of the two private keys.

So now you can send these messages through any server, public or private, and the only device that can see the original message is your friend’s device. This is the standard for most messaging apps these days. One of the reasons why iMessage became so popular early on was because it was one of the first ones to do it. And that actually got them in trouble with the police because there are no back doors with end-to-end encryption. So if the FBI wants to see someone’s texts, they can’t.

Apple can’t. So now, unless the Zuck has some reptile AI supercomputer hidden in his data centers, I’m going to have to go with no, I am not a lizard. Current computing power would take 3 * 10^59 to decrypt your message, which is a lot more than the age of the universe: 13.8 billion years.

The end-to-end encryption that I’ve just described to you is the same one that Signal uses. Signal is, of course, WhatsApp’s rival. It’s a nonprofit organization mostly funded by Brian Acton, one of the co-founders of WhatsApp, which makes this whole thing kind of poetic if you think about it. But that is really the last happy note in this video because Facebook has done everything it can to mine as much data as it can from WhatsApp, and it has kind of succeeded at that.

A privacy-focused messaging platform has to be encrypted. By all accounts, things were pretty rushed when the acquisition was negotiated. Facebook was desperate to buy WhatsApp, in part because the founders had also visited Google in Mountain View around that time, and they were worried that Google might beat them to the acquisition. And that’s in part what prompted the crazy number and some flexibility in the negotiations. If we can do a pretty good job of helping WhatsApp grow, this is just going to be a huge business.

Because as part of the sale, WhatsApp founders agreed to a few things with Mark. Some were kind of like verbal agreements, some on paper. There was an actual clause in the contract that said that they could collect all of their stock if Facebook started implementing monetization initiatives without their consent.

But soon after they joined, Brian recalls overhearing Facebook’s projections for WhatsApp revenue: $10 billion per year by 2019. I mean, you have to recover that ROI, and that $10 billion plan was by all means to put ads on WhatsApp, starting with status updates.

Businesses obviously need to make money, and even Brian understood this. But his proposal was a metered usage model for people who exceeded a certain number of messages in a month. You build it once; it runs everywhere in every country. You don’t need a sophisticated sales force; it’s a very simple business. But Sheryl Sandberg threw away the idea. Her words were, “It won’t scale.” I called her out one time. I was like, “No, you don’t mean that it won’t scale; you mean it won’t make as much money as,” and she kind of hemmed and hawed a little.

After only a couple of years, Brian and Jan understood that they were not going to win this battle. As altruistic as their original vision for WhatsApp might have been, they had given that away when they took Facebook’s check. And of course, let’s be real, who wouldn’t take the $19 billion check?

But these disagreements escalated to them eventually leaving the company. In the case of Brian, before his stock had fully vested, which meant leaving behind about $800 million. He’s still a billionaire, so don’t worry. He was like, “Okay, well, you want to do these things I don’t want to do, it’s better if I get out of your way,” and he did.

Facebook’s Broken Promises

Facebook’s first broken promise was linking your WhatsApp profile to their servers and to your Facebook account, and it did that just two years after the buy, after actually promising that they wouldn’t. It was an easy case for the EU Trade Commission, which slapped them with a measly 110 million EUR fine.

Over the years, they have implemented numerous privacy updates. While they still keep your information encrypted, they now have access to your phone number, contacts, logs of your usage of WhatsApp, information about your interactions with other users, device identifiers, and other device information such as IP address, operating system, browser details, battery health information, app version, mobile network, language, and time zone.

This may feel harmless, but combine that with Facebook or Meta’s already huge library of data—your Facebook profile, your Instagram profile, your friends’ profiles, your photos, the friends that you stalk, and most crucially, your online activity. Most people don’t know this, but the Facebook pixel is key to this.

I, as a website business, am encouraged to put a Facebook pixel on my page so that when you visit, I can then serve you retargeting ads back on Facebook. But with that, Facebook now knows which websites you visited, and at least 17.7% of all websites in the world have a Facebook pixel installed.

So even if an ad suddenly feels strangely related to what you were just texting about, chances are the Zuck knows what you’re talking about without even having to read that text.

WhatsApp’s Role in Business Communication

WhatsApp’s endgame is not widely known among Americans, but it has become the operating system for business communication in many countries around the world. From talking to your bank, ordering food, booking appointments, to customer support and sales, entire economies in the developing world genuinely and honestly operate on WhatsApp. Sadly, even governments use it.

For large businesses, online shopping has moved online. For a large department store, the way to maximize sales beyond the physical location is to build an e-commerce platform, hire a shipping company, establish call center chat support, and all the other things needed for decent e-commerce.

However, for a small mom-and-pop shop, the way to talk to their customers is through WhatsApp. They have no budget for websites or fancy chat support tools. They operate not only on what they know how to use but also on where their customers are and where it is easier for them to get in touch.

Because of this ease of use for customers, larger companies have now moved to WhatsApp, from banks to car dealerships. As a business, you can even set up your own Facebook and Instagram ads from your WhatsApp profile, unlocking millions of advertisers who are probably not very experienced at maintaining paid advertising campaigns on the usual platforms, and they are probably going to overspend.

Additionally, you have WhatsApp Shops and WhatsApp Payments, which require some information to leave the safe pathway of end-to-end encryption so that they can actually put a charge on your card. This is not the only exception to the rule because businesses can choose to store messages you send to them on Facebook servers.

Remember, encryption protects your messages during their journey, but after that, it’s really up to the recipient. So, if you’re sending sensitive pictures, you know the risks.

I absolutely hate this WhatsApp super app approach, by the way. I threw out two drafts of this script that were mostly just rants against WhatsApp because I like my apps separate—one for texting with friends and one for browsing store content.

Conclusion

I think it’s a lazy and terrible user experience to just put everything in the same place. That’s just me, but I genuinely don’t know if anyone foresaw this concept of WhatsApp becoming the operating system for small businesses. However, you have to give it to them—they are adapting to what people are using the platform for.

To Mark, this is the next chapter in his company. So, I guess it’s so long for the metaverse. But enough with the fun and games, it’s time for everyone’s favorite work.