WhatsApp Privacy Policy Faces Scrutiny in India’s Supreme Court
India’s Supreme Court is questioning the validity of WhatsApp’s 2021 privacy policy, a move that could reshape how digital monopolies operate within the country and redefine user consent in the digital age. The core of the dispute centers on whether users truly have a “choice” when the alternative to sharing data is forfeiting access to the messaging app entirely.
The legal battle, spanning five years, began with WhatsApp’s January 2021 update, which mandated expanded data-sharing with other Meta companies – Facebook and Instagram – for Indian users. This differed significantly from the 2016 policy, which allowed users to opt out of such data sharing. The 2021 policy eliminated that opt-out option, presenting users with a ‘take-it-or-leave-it’ ultimatum.
The data in question includes sensitive information such as phone numbers, transaction details, business interactions, and data collected from websites utilizing WhatsApp features. The Competition Commission of India (CCI) found this policy to be coercive, even after WhatsApp announced users wouldn’t lose functionality for refusing the update. The CCI determined that the announcement didn’t retract the new terms of service and privacy policy, which still granted WhatsApp the unilateral right to expand data sharing without user consent – creating what the regulator termed a “precarious situation.”
CCI’s Investigation and Findings
The CCI initiated its investigation in March 2021, citing WhatsApp’s dominance – holding approximately 80% of the Indian messaging market – as providing unfair leverage. After an extensive investigation, the CCI, in November 2024, identified both “exploitative” and “exclusionary” abuses of market position, a rare instance of simultaneous liability for both types of violations.
A key aspect of the CCI’s analysis was recognizing “privacy as a critical non-price parameter of competition.” This aligns with precedents set by international bodies like the European Commission and Germany’s Bundeskartellamt, which have also considered privacy within the context of competition law. The CCI concluded that “there is a consensus behind the idea that competition on privacy can constitute an element of competition.”
The CCI’s investigation highlighted the powerful “direct network effects” inherent in messaging apps – the more users on a platform, the more valuable it becomes to each individual user. This creates a “lock-in effect,” making it difficult for users to switch to alternative platforms, even if those platforms offer superior technical capabilities. This dynamic contributes to “high entry barriers” for competitors.
NCLAT’s Nuanced Ruling
Meta and WhatsApp appealed the CCI’s decision to the National Company Law Appellate Tribunal (NCLAT). The NCLAT, in November 2025, upheld the Rs 213.14 crore penalty but overturned the finding that Meta leveraged WhatsApp’s messaging dominance into advertising advantages. It also lifted the five-year ban on data sharing, reasoning that such a restriction could jeopardize WhatsApp’s free-to-user model. However, the NCLAT maintained the requirements for transparency and user-choice mechanisms.
A subsequent clarification from the NCLAT in December 2025 ensured that the CCI’s safeguards – disclosure, opt-out rights, and purpose limitation – applied uniformly to both advertising and non-advertising data sharing, closing a potential loophole.
Supreme Court’s Intervention
During hearings earlier this month, Chief Justice Surya Kant sharply criticized WhatsApp’s privacy policy, describing it as “a decent way of committing theft of private information.” The court questioned how the average Indian citizen – “a fruit seller or domestic worker” – could comprehend the complex legal terms governing data sharing. “What is the choice? You have a complete monopoly and you are saying I am giving a choice. We see either you walk out or we will share the data,” the Chief Justice stated.
The Supreme Court immediately dictated an order preventing any further data sharing and requested affidavits from WhatsApp and Meta. Justice Joymalya Bagchi raised a critical point: India’s current data protection framework, the Digital Personal Data Protection Act, 2023, does not recognize the economic value of personal data, unlike regulations in the European Union.
The court also added the Ministry of Electronics and Information Technology (MeitY) as a party to the case, scheduling a final hearing for .
International Precedents and the Economics of Data
Both the CCI and the NCLAT heavily relied on precedents established in foreign jurisdictions, particularly in Europe. The Bundeskartellamt’s 2019 decision regarding Facebook, and the 2023 Court of Justice of the European Union (CJEU) ruling in Meta Platforms & Ors. V. Bundeskartellamt (Case C-252/21) were particularly influential. The CJEU ruling affirmed that violating data privacy rules or reducing privacy through excessive data sharing can be considered an abuse of a dominant market position, even without demonstrating concrete anticompetitive effects.
The NCLAT also referenced a 2016 joint report by the Autorité de la concurrence (France) and the Bundeskartellamt, which stated that privacy issues cannot be excluded from competition law considerations, especially when implemented by a dominant undertaking where data serves as a primary input.
The EU’s 2023 Digital Markets Act (DMA) further reinforces this approach by designating several “gatekeepers” and prohibiting the combination of personal data across services without explicit, freely given user consent. Meta’s previous “Consent or Pay” model was found to violate the DMA, resulting in a Euro 200 million fine and a requirement to offer a less data-intensive alternative.
The CCI’s economic analysis underscores the unique characteristics of digital markets. Network effects create natural monopolies, data serves as a competitive advantage, and the “free” service model often relies on users providing their data as consideration. The CCI challenged the notion of “zero-price markets,” arguing that users provide non-monetary consideration through their personal data. As Justice Bagchi noted, European law recognizes the economic value of this data, a concept not yet fully integrated into India’s legal framework.
The CCI’s approach, termed the “integrative approach,” recognizes the inseparable link between privacy and competition. When a platform reduces privacy protections, it’s not merely a privacy violation but a reduction in service quality, akin to a manufacturer using inferior materials. This perspective is gaining traction globally, challenging the traditional focus on price in competition law.
Looking Ahead
The Supreme Court will consider interim relief on , potentially restricting data use pending a final judgment scheduled for . The court’s strong stance suggests a willingness to go further than previous rulings. The outcome of this case will have significant implications for WhatsApp’s operations in India and could set a precedent for regulating digital monopolies and protecting user privacy globally. The central question remains: in an era of concentrated digital power, who ultimately controls the rules governing our data?
