INTRODUCTION:
In a recent ruling, the Competition Commission of India (CCI) has slapped a heavy fine of 213.14 crore on Meta, the parent company of WhatsApp, for its unfair business practices related to WhatsApp’s 2021 privacy policy update. The impugned privacy policy makes it mandatory for the users to accept the terms and conditions in order to retain their WhatsApp account information and provides as to how it will share personalised user information with Facebook Inc. (later renamed as Meta Platforms, Inc. and hereinafter, referred to as ‘Meta’) and its subsidiaries.
The CCI found that this practice violated competition laws by leveraging WhatsApp’s dominant position to coerce user compliance, thereby stifling competition and undermining user autonomy. This ruling is significant in itself as it not only penalizes Meta but also underscores the growing recognition of privacy as a fundamental component of competition law.
In this blog, we will focus on the privacy implications of the Competition Commission of India’s (CCI) decision and how this addresses transparency and fairness in data collection and usage, thereby setting a precedent for how privacy is integrated into competition law. Furthermore, this blog will explore the ruling’s significance in the Indian context, given the increasing scrutiny of tech giants’ data practices and the evolving privacy landscape under the new Digital Personal Data Protection Act, 2023 (DPDP Act). The analysis will shed light on how this decision empowers users, curtails excessive data exploitation, and strengthens regulatory oversight in protecting individual privacy.
BACKGROUND OF THE CASE:
In January 2021, the Commission observed that WhatsApp users started receiving notification from WhatsApp informing them about their new changes in WhatsApp’s terms of service and privacy policies. These terms of service and privacy policies were as follows:
“WhatsApp is updating its terms and privacy policy. Key updates include more information about:
- WhatsApp’s service and how we process your data.
- How businesses can use Facebook hosted services to store and manage their WhatsApp chats.
- How we partner with Facebook to offer integrations across the Facebook Company Products.
By tapping AGREE, you accept the new terms and privacy policy, which take effect on February 8, 2021. After this date, you will need to accept these updates to continue using WhatsApp. You can also visit the Help Center if you would prefer to delete your account and would like more information.”
Therefore, the above stated notification made it mandatory that, starting February 8, 2021, users would be required to accept WhatsApp’s updated terms and privacy policy in full, including provisions mandating the sharing of their data across various categories with other Facebook companies, to continue using the platform. Unlike the earlier privacy policies dated August 25, 2016, and December 19, 2019, which allowed existing users to opt out of data sharing with Facebook, the latest update removed this choice, making data sharing with Facebook mandatory for all users.
The Commission primarily found that WhatsApp in garb of its new policy update, has violated the provisions of Section 4 of the Competition Act, 2002 and therefore issued order under Section 26(1) to conduct further investigation.
Based on the further investigation, the Competition Commission of India (CCI) identified two relevant markets in the case: the market for Over-the-Top (OTT) messaging apps through smartphones in India and the market for online display advertising in India. The Commission determined that Meta holds a dominant position in the first market, namely OTT messaging apps and found its practice in violation of Section 4 of the Competition Act, 2002. Specifically, the sharing of WhatsApp users’ data among Meta companies for purposes beyond providing WhatsApp’s core service was found to create entry barriers for Meta’s rivals, effectively denying market access in the display advertising market, in violation of Section 4(2)(c) of the Act. Additionally, the Commission found that Meta leveraged its dominant position in the OTT messaging market to safeguard its position in the online display advertising market, which contravenes Section 4(2)(e) of the Act.
WHAT DOES THE RULING ENTAIL?
The CCI’s ruling against WhatsApp and Meta imposes significant measures aimed at addressing privacy concerns and anticompetitive practices. First, a financial penalty of ₹213.14 crore has been levied on Meta for engaging in practices deemed exploitative and abusive of its dominant market position. Additionally, the CCI has explicitly prohibited WhatsApp from sharing user data with other Meta-owned platforms, such as Facebook and Instagram, for purposes unrelated to WhatsApp’s core service, including targeted advertising. This prohibition is intended to safeguard user privacy and prevent Meta from gaining an unfair advantage in the online display advertising market.
The ruling also underscores the importance of addressing dominance and its misuse. By mandating data-sharing policies without user consent, WhatsApp created significant barriers for rivals, limiting competition in the online advertising sector. These actions contravened Sections 4(2)(c) and 4(2)(e) of the Competition Act, which prohibit exclusionary and exploitative practices. Moreover, the CCI emphasized privacy as an essential non-price competition parameter, recognizing that degrading privacy standards effectively reduces service quality and consumer welfare.
PRIVACY IMPLICATIONS OF THE RULING:
One of the critical aspects of the ruling is the reinforcement of user autonomy. By forcing users to accept intrusive data-sharing practices to continue using WhatsApp, the company leveraged its dominant position to coerce compliance, undermining consumer choice.
During its submission, WhatsApp has invalidated the DG investigation argued that the CCI had overstepped its jurisdiction by examining issues related to data protection and privacy, which it claimed were beyond the scope of the Competition Act, 2002. It pointed out that specialized statutes such as the Digital Personal Data Protection Act, 2023, and the Information Technology Act, 2000, already govern these matters. WhatsApp further stated that questions of user consent and data collection practices under its 2021 Privacy Policy were already being adjudicated by the Supreme Court and Delhi High Court, and therefore, the CCI’s findings were pre-emptive.
The CCI countered these claims by asserting its jurisdiction to examine the conduct of WhatsApp and Meta, emphasizing the pivotal role of data in determining the competitiveness and market power of digital enterprises. The Commission argued that data collected by platforms is crucial for improving service quality, enabling zero-cost offerings, and driving personalized services, which directly impact competition. It highlighted that excessive control over diverse data could create entry barriers and distort market dynamics. Therefore, the CCI concluded that its focus on the competitive implications of WhatsApp’s data practices was justified and necessary to ensure fair competition in digital markets.
This intervention by the CCI signals a regulatory shift toward ensuring transparency and fairness in data governance. Furthermore, the ruling expands the jurisdiction of competition law to address privacy concerns, complementing the provisions of India’s DPDPA, 2023. The Commission directed WhatsApp to include a detailed explanation of the user data shared with other Meta companies or Meta company products. This explanation must clearly outline the purpose of such data sharing, with each type of data explicitly linked to its corresponding purpose. These directives of the CCI align with the requirements under Section 5 of theDPDPA, which mandates that any request for consent must be accompanied or preceded by a notice. This notice should inform the Data Principal about the specific personal data being collected and the precise purpose of its processing. Therefore, such measures aim to enhance transparency and ensure that users are fully informed about how their data is utilized, promoting accountability and trust in digital data practices.
This broader regulatory approach positions privacy as a central issue in competition law and sets a precedent for holding dominant digital platforms accountable for exploitative data practices. The decision not only penalizes Meta but also lays the foundation for greater scrutiny of data policies, encouraging a fairer and more competitive digital ecosystem in India.
CONCLUSION:
The CCI’s ruling against WhatsApp and Meta marks a pivotal moment in the intersection of privacy and competition law in India. By penalizing Meta for its exploitative practices and mandating transparency in data-sharing policies, the decision underscores the importance of user autonomy and fair competition. It also reflects a broader regulatory effort to hold dominant digital platforms accountable for their data governance practices, emphasizing the role of privacy as a critical factor in market dynamics. This ruling not only aligns with the provisions of newly enacted DPDPA, but also sets a precedent for addressing privacy concerns within the framework of competition law. By promoting accountability and trust, the CCI’s intervention aims to foster a fairer digital ecosystem, ensuring that user rights and market fairness are prioritized in India’s evolving digital landscape.
