tldr;
Meta and WhatsApp filed appeals before the Hon’ble NCLAT challenging the CCI order dated 18 November 2024. IFF was an informant in the case initiated by the CCI and is now Respondent No. 3 in the Appeals filed by the Appellants.The Appeal was heard on 16 January 2025 by the Hon’ble Chairperson, where Meta and WhatsApp sought an interim stay on the entire CCI order. The NCLAT granted a stay only on the ban regarding data sharing for advertising purposes. All other directives from the CCI remain in effect, with the companies directed to pay 50% of the penalty within two weeks of the order for the stay to remain in effect.
Meta’s journey to NCLAT
WhatsApp’s Terms of Service and Privacy Policy, first published in 2012, evolved significantly over time, including the introduction of end-to-end encryption in 2016 and subsequent updates in 2018 and 2021. The 2021 update, which applied to users in India and other countries, triggered a suo moto investigation by the Competition Commission of India (“CCI”) on 19 January 2021, citing potential abuse of dominance under Section 4(2) of the Competition Act, 2002. Despite legal challenges by WhatsApp and Meta in the Delhi High Court and the Supreme Court, the CCI’s proceedings continued. On 18 November 2024, the CCI found WhatsApp and Meta guilty. It imposed a penalty of Rs. 213.14 crore on Meta, and directed policy revisions within three months. For more information on this order, please visit this link as it has been previously analysed by us. Aggrieved by the order, WhatsApp and Meta filed appeals with NCLAT, accompanied by an interim application seeking a stay on the CCI’s decision. The interim application was heard on January 16, 2025, the first day of the appeal’s admission, following which the Hon’ble NCLAT issued its order on interim relief on 23 January 2025, which is analysed below.
Appellants Contested CCI’s Data Sharing Prohibition, Opt-Out Requirement, and Penalty on Meta-WhatsApp
In their interim application, the appellants prayed for a stay on the impugned order to the extent challenged in the appeal.
The appeals primarily seek a complete stay on the directions issued in the CCI order dated 18 November 2024 and a reversal of the imposed penalty. The appellants argued that the CCI’s prohibition on sharing user data with Meta for advertising purposes, aimed at reducing barriers to entry in the display advertising market, was unnecessary and disproportionate to any hypothetical harm. They also contested the requirement to disclose detailed information about user data sharing with Meta for purposes other than providing WhatsApp services, stating that such issues fall under privacy and data protection laws like the Privacy Rules and the Digital Personal Data Protection Act 2023 (“DPDP Act”). This disclosure obligation, according to the Appellants, unfairly disadvantaged Meta by providing competitors with greater insight into its practices without reciprocal transparency.
Further, the appellants objected to the mandate for an opt-out option for user data sharing beyond WhatsApp services, arguing that it would cause irreparable harm to WhatsApp and that the Commission had failed to identify any actual anti-competitive effects to justify this requirement. They also contended that the prohibition on user data sharing was redundant, given the requirement to implement an opt-out option. Additionally, the directive for all future policy updates to comply indefinitely with these remedies was deemed disproportionate, as it would irreparably harm Meta, WhatsApp, Indian users, and businesses, particularly small and medium enterprises, by creating a competitive disadvantage, hindering innovation, and fostering regulatory uncertainty. These arguments were objected to by counsel for CCI, Advocate Samarth Bansal and IFF’s counsels from Sarvada Legal.
NCLAT upholds user autonomy and Penalty
After hearing the Interim Application on January 16, 2025, the Hon’ble NCLAT reserved the order for pronouncement on January 23, 2025. The NCLAT in its order granted some relief to Meta, but key user-centric directions from the CCI remain in effect. The Tribunal stayed the five-year ban on sharing WhatsApp user data with Meta for advertising purposes, noting that such a restriction could disrupt WhatsApp’s business model, which relies on providing free services to users. The tribunal observed that the advertisements form a major revenue source, and the five-year ban would have a prejudicial effect, potentially collapsing WhatsApp’s existing business model. The Tribunal also considered the Supreme Court’s pending case on WhatsApp’s 2021 Privacy Policy and the fact that the DPDP Act, 2023 has also been passed and is likely to be enforced, which may cover all issues pertaining to data protection and data sharing.
The directions which remain in effect:
- Transparency in Data Sharing: WhatsApp is required to update its privacy policy to provide a detailed explanation of the user data shared with other Meta companies or Meta products. The policy must clearly specify the types of data being shared and the purposes for which this data is being used. This would allow users to understand exactly how their data is being utilised and shared across the Meta ecosystem.
- Data Sharing not mandatory to access service: The sharing of user data with other Meta companies or products for purposes beyond WhatsApp services cannot be made a condition for users to access WhatsApp services in India. This ensures that users cannot be forced into data-sharing practices that are unrelated to the primary function of the app.
- User Autonomy in Data Management: WhatsApp is also required to offer users in India, both those who accepted the 2021 update and those who did not, the ability to manage how their data is shared for non-advertising purposes. Users will be provided with an opt-out option through an in-app notification, giving them control over whether their data is shared with other Meta products. Additionally, WhatsApp must provide users with the ability to review and modify their data-sharing preferences at any time via a prominent tab in the app’s settings.
- Compliance with Future Policy Updates: Any future policy updates that WhatsApp implements must comply with the same requirements regarding transparency, user consent, and data sharing for non-advertising purposes.
The NCLAT has granted liberty to seek modification of its interim order if the Digital Personal Data Protection Act, 2023, or any other data protection regulations are enforced. Noting the significance of the issues raised, the Hon’ble NCLAT emphasized the need for an expedited decision. It directed the parties to complete all necessary pleadings within six weeks from the date of the order. The Appeals are now scheduled for hearing on 17.03.2025.
IFF (Respondent No. 3) was represented by Advocates Abir Roy and Biyanka Bhatia of Sarvada Legal. We thank them for their representation in this matter.