NCLAT Rules on Meta–WhatsApp Data Sharing and CCI Penalty
In a landmark decision, the National Company Law Appellate Tribunal (NCLAT) partially upheld the Competition Commission of India’s (CCI) ₹213 crore penalty on Meta (formerly Facebook) over WhatsApp’s 2016 privacy policy but permitted data sharing under strict conditions.
Case Background: WhatsApp’s 2016 Privacy Policy
The legal battle began when WhatsApp updated its privacy policy in 2016, enabling data sharing with Meta. The CCI launched an investigation in 2017, alleging that the policy abused WhatsApp’s market dominance by forcing users into mandatory data-sharing arrangements.
In 2021, the CCI imposed a ₹213 crore penalty on Meta, terming WhatsApp’s actions as an “abuse of dominance” and mandating explicit user consent for data sharing.
NCLAT’s Key Takeaways
- Penalty Upheld – The tribunal agreed that WhatsApp’s policy was anti-competitive, keeping the ₹213 crore fine intact.
- Data Sharing Allowed with Conditions – Meta and WhatsApp can share data but must obtain explicit opt-in consent from users.
- CCI’s Jurisdiction Validated – The NCLAT dismissed Meta’s claim that the CCI exceeded its authority.
Industry and Privacy Experts React
Privacy advocates raised concerns over data-sharing permissions, while legal experts praised the balance between business needs and user rights. Meta has yet to respond but may consider appealing to the Supreme Court.
Impact on Indian Users
- Transparency Boost – WhatsApp must clearly disclose data-sharing terms.
- Opt-In Consent Required – Users must explicitly agree before data is shared with Meta.
- Legal Precedent Set – Strengthens India’s regulatory framework for Big Tech.
Broader Implications for Big Tech
The ruling aligns with India’s stricter oversight of tech giants, echoing actions against Google and Amazon. With the Digital Personal Data Protection (DPDP) Act, 2023, coming into force, compliance with consent and competition laws will be crucial.
Conclusion
The NCLAT’s verdict reinforces accountability for Big Tech while allowing data-driven business models—if user consent is prioritized. This ruling sets a benchmark for future cases under India’s evolving digital regulations.
