NCLAT mandates user consent for WhatsApp data collection across advertising and other uses

New Delhi: The National Company Law Appellate Tribunal (NCLAT) on Monday clarified that its earlier order in the WhatsApp privacy matter applies to user data collection and sharing for all non-WhatsApp purposes, including both advertising and non-advertising activities.

The clarification came in response to an application filed by the Competition Commission of India (CCI) seeking clarity on the scope of NCLAT’s previous ruling. The tribunal stated that WhatsApp and Meta cannot claim unrestricted control over user data.

“Appellant (WhatsApp and Meta) cannot assert unilateral or open-ended rights over user data,” NCLAT said.

“We had clearly held that 'users must retain the right to decide what data is collected, for which purposes and for how long. Any non-essential collection or cross-use like advertising etc. can occur only with the concerned users' express and revocable consent,’” the tribunal added.

NCLAT further observed that once users are given the option to opt in or opt out of data sharing at any stage, whether while using regular features or optional features, their rights remain protected over time. It noted that this addresses the issue of exploitation raised in connection with WhatsApp’s 2021 privacy policy.

“Once users are provided optionality at any stage to opt in or opt out of data sharing, whether using regular features or optional features, their rights are protected for all times and there is a removal of exploitation, which has been the issue in 2021 WhatsApp policy,” the tribunal said.

Based on this analysis, the appellate tribunal allowed the CCI’s application and clarified that “remedial directions contained in Paras 247.2.1 to Paras 247.2.4 of the Applicant's impugned order dated 18.11.2024 will apply to WhatsApp user data collection and sharing for all non-WhatsApp purposes, including non-advertising and advertising purposes.”

The two-member bench comprising Chairperson Justice Ashok Bhushan and Member Arun Baroka also granted WhatsApp three months to comply with the directions and implement the required changes.

Earlier, on November 4, NCLAT had granted partial relief to WhatsApp by setting aside a portion of the CCI’s order that imposed a five-year ban on data sharing with Meta Platforms for advertising purposes. 

However, it upheld the penalty of Rs 213 crore imposed on Meta and confirmed that WhatsApp’s 2021 policy violated Sections 4(2)(a)(i) and 4(2)(c) of the Competition Act, constituting abuse of dominance and leading to market denial.

In Para 264 of its judgement, the tribunal stated that Para 247.1 of the original CCI order was set aside, while Para 247.2 was upheld. As a result, user consent is explicitly required for data sharing for non-advertising purposes, while the order did not expressly address consent requirements for advertising purposes.

In its earlier 184-page order, NCLAT had noted that cross-platform data sharing between WhatsApp and Meta strengthened Meta’s position in the display advertising market and created entry barriers for competitors lacking access to WhatsApp user data.

However, the tribunal also held that the CCI’s finding of a breach under Section 4(2)(e) was not sustainable, stating that it could not be conclusively established that Meta had leveraged dominance in the OTT messaging market to protect or extend dominance in online display advertising, as WhatsApp and Meta are separate legal entities.

In November last year, the CCI imposed a penalty of Rs 213.14 crore on Meta Platforms over WhatsApp’s 2021 privacy policy update. Meta and WhatsApp challenged the order before NCLAT, which in January passed an interim order staying the five-year ban on data sharing for advertising purposes.