In the present case, the National Company Law Appellate Tribunal (NCLAT) dealt with the Competition Commission of India’s (CCI) directives concerning WhatsApp’s 2021 privacy policy update and the penalties imposed for alleged violations of the Competition Act, 2002. The Tribunal granted partial relief to WhatsApp while staying certain aspects of the CCI’s order.
The dispute arose after WhatsApp’s updated privacy policy required users to accept terms allowing data sharing with Meta entities. The CCI held that the policy violated Section 4(2)(a)(i) by imposing unfair terms, Section 4(2)(c) by creating entry barriers in the online advertising market, and Section 4(2)(e) by leveraging WhatsApp’s dominant position to coerce user acceptance. The CCI imposed a ₹213.14 crore penalty on WhatsApp, prohibited data sharing with Meta for five years, and directed WhatsApp to provide Indian users with an opt-out mechanism starting in 2029. The order further required WhatsApp to detail its data-sharing practices and allow users to change their choices via app settings.
WhatsApp challenged the CCI’s order before the NCLAT, arguing that data protection and privacy concerns fall under the purview of the Digital Personal Data Protection (DPDP) Act, which has been enacted but is yet to be enforced. WhatsApp contended that the five-year ban jeopardized its business model, which relies on data sharing to support personalized advertising and small businesses. It also highlighted that similar issues are under judicial review in the Supreme Court and Delhi High Court.
The NCLAT bench noted that WhatsApp’s business model depends on data sharing for advertising and a prolonged ban could disrupt its operations in India, where it has over 500 million users. The Tribunal observed that the DPDP Act is expected to provide a regulatory framework for data-sharing practices and acknowledged that the Supreme Court had not stayed WhatsApp’s 2021 privacy policy.
While the NCLAT stayed the five-year ban on data sharing, it directed WhatsApp to deposit 50% of the ₹213.14 crore penalty within two weeks. Other aspects of the CCI’s directives, including the opt-out mechanism and greater transparency in data-sharing practices, were left intact. The Tribunal clarified that both parties could seek modifications to the order if the DPDP Act or other data protection laws are implemented.
This ruling balances the enforcement of competition law with the practical realities of WhatsApp’s business model. It highlights the need for clear legislative frameworks governing data protection while ensuring that market dominance is not exploited unfairly.