NCLAT allows WhatsApp–Meta data sharing for ads, upholds Rs 213.14 cr CCI penalty

New Delhi: The National Company Law Appellate Tribunal (NCLAT) has partly set aside the Competition Commission of India’s (CCI) order against Meta Platforms, allowing WhatsApp to share user data with group companies for advertising while upholding a penalty of Rs 213.14 crore.

A two-member bench led by Chairperson Justice Ashok Bhushan and Technical Member Arun Baroka delivered the ruling in appeals arising from WhatsApp’s 2021 privacy policy update. That update made data-sharing with Meta entities mandatory for targeted ads and removed the earlier opt-out for India’s more than 500 million users.

In 2022, the CCI, acting suo motu, held that Meta abused WhatsApp’s dominance in the messaging market to aid its online display advertising business, finding violations of Sections 4(2)(c) and 4(2)(e) of the Competition Act, and imposed the fine along with a five-year bar on such sharing.

NCLAT has now set aside the leveraging finding under Section 4(2)(e) and quashed the five-year prohibition in paragraph 247.1 of the CCI order. At the same time, it affirmed the monetary penalty and retained directions on transparency, clearer disclosures in the privacy policy and effective opt-out mechanisms for users.

On the matter, a Meta spokesperson said, “We welcome the NCLAT’s decision. While we await the written order, we continue to reiterate that WhatsApp’s 2021 privacy policy update did not change the privacy of people’s personal messages which remain end-to-end encrypted. WhatsApp’s optional business features make people’s lives more convenient with services like bill payments, ticket booking, and shopping, while supporting local businesses and furthering India’s digital economy.” 

The tribunal noted the overlap between competition concerns and data-protection issues and said the forthcoming Digital Personal Data Protection (DPDP) framework could address several questions more comprehensively. It granted liberty to both sides to seek modifications once the DPDP regime is fully operational.

Earlier, in January 2025, NCLAT had stayed the five-year bar as an interim measure, observing that it could “lead to the collapse of the business model” of a free-to-use service supported by advertising.

Meta welcomed the partial relief and argued during hearings that the CCI strayed into privacy policy terrain better handled by data-protection law. Senior Advocate Arun Kathpalia, appearing for Meta, said user data collected by the company is proprietary and that intra-group use supports better services and small-business advertising. The CCI, for its part, pointed to WhatsApp’s market power and switching frictions in India, and contrasted Indian users’ position with stronger opt-out rights under Europe’s GDPR.

Meta had deposited 50% of the penalty during the interim stay. With the fine now affirmed, the company is expected to pay the balance. Related privacy matters remain pending before the Supreme Court and the Delhi High Court.