The National Company Law Appellate Tribunal (NCLAT) on Tuesday delivered a landmark judgment in the contentious WhatsApp privacy policy case, providing partial relief to technology giants Meta Platforms Inc. and WhatsApp LLC while upholding significant portions of the Competition Commission of India’s order.
The two-member bench, comprising Chairperson Justice Ashok Bhushan and Technical Member Arun Baroka, maintained the hefty Rs 213.14 crore penalty imposed on Meta but struck down critical findings and directives that had threatened to reshape the company’s business model in India.
Understanding the NCLAT’s Landmark Ruling on WhatsApp privacy policy case
In a significant departure from the CCI’s original order, the tribunal set aside the finding that Meta had leveraged WhatsApp’s dominant position in the messaging market to strengthen its presence in the online display advertising sector. This represented a major victory for Meta in a case that has been closely watched by the global tech industry.
The bench also quashed the CCI’s controversial five-year ban on data sharing between WhatsApp and other Meta group companies for advertising purposes. This directive, contained in paragraph 247.1 of the original CCI order, would have severely restricted Meta’s integrated advertising ecosystem.
“The findings of the Commission so far as they relate to Section 4(2)(e) and the direction in paragraph 247.1 are set aside. The rest of the order is upheld,” Justice Bhushan’s bench declared in its order.
Background: The WhatsApp Privacy Policy Case Controversy
The case traces its origins to January 2021, when WhatsApp implemented a controversial privacy policy update that made sharing user data with other Meta companies mandatory. The move sparked widespread concern among India’s 500 million WhatsApp users, as it removed the previous opt-out option that users had enjoyed.
The Competition Commission of India took suo motu cognizance of this update, expressing serious concerns that users were being forced to accept a “take-it-or-leave-it” policy without meaningful choice. The CCI’s investigation revealed that the policy change had significant implications for market competition and consumer welfare.
In its comprehensive 156-page order issued on November 18, 2024, the CCI had found Meta guilty of abusing its dominant position under Sections 4(2)(c) and 4(2)(e) of the Competition Act, 2002. The regulator concluded that Meta had unfairly leveraged WhatsApp’s unparalleled reach to consolidate its position in the lucrative online display advertising market.
CCI’s Original Findings and Directives
The CCI’s original order was sweeping in its scope and implications. The competition watchdog had imposed multiple behavioral remedies on Meta, including:
– A complete five-year ban on sharing WhatsApp user data with Meta companies for advertising purposes
– Mandatory provision of clear explanations to users about data sharing practices
– Implementation of a robust opt-out mechanism for users
– Transparency requirements regarding data collection and usage
– Prohibition of conditioning WhatsApp access on mandatory data sharing acceptance
The CCI had determined that WhatsApp’s mandatory privacy policy update constituted an unfair imposition on users who had no viable alternatives in the over-the-top (OTT) messaging market.
January 2025: NCLAT Grants Interim Relief
Before Tuesday’s final judgment, the NCLAT had already provided temporary relief to Meta in January 2025 by staying the five-year data sharing ban. The tribunal had expressed concerns that such a sweeping prohibition could disrupt WhatsApp’s fundamental business model, which provides free messaging services to millions of Indian users.
At that time, Justice Bhushan’s bench had observed that “the ban of five years may lead to the collapse of the business model” of WhatsApp, given that the platform operates on a free-to-use basis for consumers.
The tribunal had, however, directed Meta to deposit 50 percent of the Rs 213.14 crore penalty as a precondition for the interim stay, demonstrating a balanced approach to the matter.
Meta’s Defense: Jurisdiction and Business Model Arguments
Throughout the appellate proceedings, Meta mounted a vigorous defense on multiple grounds. Senior Advocates Kapil Sibal, Mukul Rohatgi, and Arun Kathpalia led the tech giant’s legal team, arguing that the CCI had fundamentally overstepped its jurisdiction.
The core of Meta’s argument centered on the contention that the case primarily involved data protection and privacy issues, which fall under the purview of the Digital Personal Data Protection (DPDP) Act rather than competition law. Meta’s counsel emphasized that the DPDP Act, though notified, was yet to be fully enacted and implemented.
Senior Advocate Arun Kathpalia made a particularly notable argument when he characterized user data as Meta’s “private property,” stating: “It’s collected by me, it’s my personal property. Shall I give it to my competitors?”
This argument highlighted Meta’s position that data sharing within its own ecosystem enhanced user experience and supported small and medium businesses.
Meta also pointed to ongoing proceedings in the Supreme Court and Delhi High Court examining similar privacy policy issues, arguing that multiple judicial forums were addressing overlapping concerns.
CCI’s Counter-Arguments: Consumer Choice and Market Dominance
The Competition Commission defended its order vigorously, with Senior Advocate Balbir Singh and Advocate Samar Bansal presenting a strong case for regulatory intervention. The CCI maintained that its focus was squarely on business conduct and abuse of dominant position, not individual privacy rights per se.
The regulator emphasized that WhatsApp’s unparalleled market dominance—with over 500 million users in India—created insurmountable network effects. Users couldn’t realistically switch to alternative platforms because their entire social and professional networks were locked into WhatsApp’s ecosystem.
The CCI argued that Meta’s size, resources, and integration across Facebook, Instagram, Messenger, and WhatsApp placed it far ahead of any competitors. This dominant position, the regulator contended, gave Meta an unfair advantage in the online display advertising market.
Crucially, the CCI highlighted a key difference between India and Europe: while European users enjoyed opt-out rights under GDPR regulations, Indian users were given no such choice, making the policy update particularly coercive.
Implications of the NCLAT Verdict
The NCLAT’s nuanced ruling carries significant implications for multiple stakeholders in India’s digital economy.
- For Meta and WhatsApp, the judgment provides breathing room for their advertising-based business model while maintaining financial accountability through the penalty. The company can now continue sharing user data across its platforms for advertising purposes, supporting its integrated ecosystem approach.
- For consumers, the verdict represents a mixed outcome. While the five-year ban that might have protected user privacy is gone, other CCI directives regarding transparency, opt-out mechanisms, and clear disclosures remain in force.
- For the regulatory landscape, the judgment highlights the complex interplay between competition law and data protection regulations. The NCLAT specifically noted that the Digital Personal Data Protection Act, once fully implemented, may supersede aspects of this order, keeping the door open for future modifications.
- For the tech industry broadly, this case establishes important precedents about the limits of competition regulation in addressing privacy concerns, particularly in the absence of comprehensive data protection legislation.
The Digital Personal Data Protection Factor
A crucial element of the NCLAT’s reasoning was the forthcoming Digital Personal Data Protection (DPDP) Act. The tribunal noted that this legislation, once enforced, would comprehensively address data protection and sharing issues.
Justice Bhushan’s bench specifically granted both parties the liberty to seek modifications to the order once the DPDP Act or other data protection legislation comes into effect. This forward-looking provision acknowledges that India’s regulatory framework for data protection is still evolving.
Legal experts suggest that the DPDP Act’s implementation could reshape the entire landscape of data sharing practices, potentially requiring fresh examination of Meta’s policies under a more comprehensive privacy framework.
Who is Justice Ashok Bhushan: The Man Behind the Bench
Justice Ashok Bhushan, who led the NCLAT bench in this landmark case, brings an impressive judicial pedigree to the role. Born on July 5, 1956, in Jaunpur district, Uttar Pradesh, Justice Bhushan has had a distinguished legal career spanning over four decades.
After graduating with a law degree in first division from Allahabad University in 1979, he enrolled as an advocate with the Bar Council of Uttar Pradesh. He practiced extensively on the civil and original side at Allahabad High Court, serving as standing counsel for prestigious institutions including Allahabad University and State Mineral Development Corporation Limited.
Judicial career: Justice Bhushan’s judicial career began when he was elevated as a permanent Judge of the Allahabad High Court on April 24, 2001. He later served as Acting Chief Justice and then Chief Justice of the Kerala High Court from 2014 to 2015. His elevation to the Supreme Court of India came on May 13, 2016, where he served with distinction until his retirement on July 4, 2021.
Major contributions: During his Supreme Court tenure, Justice Bhushan was part of several landmark judgments, most notably the historic five-judge Constitution Bench that delivered the Ayodhya verdict.
He also led benches monitoring COVID-19 management and relief efforts during the pandemic, dealing with critical issues affecting millions of Indians. His balanced and thoughtful approach to complex legal issues has earned him respect across the legal community.
On November 8, 2021, Justice Bhushan assumed charge as Chairperson of the NCLAT, bringing stability to the tribunal after it had functioned with acting chairpersons for nearly 20 months. His four-year tenure has been marked by handling several high-profile corporate and competition law cases.
Industry Reactions and Expert Analysis
Legal experts have offered varied perspectives on the NCLAT judgment. Some view it as a pragmatic decision that recognizes the commercial realities of free-to-use digital platforms, while others express concern that it may dilute consumer protection in the absence of strong privacy legislation.
Privacy advocates have expressed disappointment that the five-year data sharing ban was removed, arguing that this leaves Indian users with fewer protections compared to their European counterparts who benefit from GDPR regulations.
Competition law practitioners, however, note that the NCLAT appropriately recognized the limits of using competition law to address privacy concerns, a distinction that will likely influence future regulatory approaches.
Broader Context: Global Tech Regulation
This case unfolds against a backdrop of increasing global scrutiny of big tech companies’ data practices. Jurisdictions worldwide are grappling with how to balance innovation, consumer protection, and fair competition in digital markets.
→ The European Union’s Digital Markets Act and Digital Services Act represent comprehensive attempts to regulate platform power. The United States continues to debate federal privacy legislation while pursuing antitrust cases against major tech firms.
→ India’s approach, as reflected in this case, appears to be evolving toward a multi-layered framework combining competition law, data protection legislation, and sector-specific regulations. The interaction between these different regulatory instruments will shape the future of India’s digital economy.
Way Forward
While the NCLAT verdict provides clarity on several key issues, the legal battle may not be entirely over. Meta retains the option to approach the Supreme Court if it wishes to challenge the penalty or other aspects of the order that were upheld.
Similarly, the CCI or consumer advocacy groups could potentially appeal against the portions of the order that were set aside, particularly the removal of the five-year data sharing ban.
The upcoming enforcement of the Digital Personal Data Protection Act could also trigger a fresh round of regulatory scrutiny, potentially requiring Meta to revise its practices to comply with comprehensive privacy regulations.
Industry observers are also watching whether this verdict will influence other ongoing cases involving tech platforms and data sharing practices, both in India and internationally.
