Relief for Meta: 5-year ban on WhatsApp’s data-sharing practices on hold

New Delhi: The National Company Law Appellate Tribunal on Thursday granted interim relief to Meta Platforms by lifting a five-year ban imposed by India's competition regulator on WhatsApp's data-sharing practices. 

NCLAT, though, did not stay the penalty portion of the Competition Commission of India's ruling and directed Meta to deposit 50% of the ₹213 crore fine to secure a stay on the order. This deposit will be refunded if Meta, which had already paid 25% of the penalty to CCI, wins the case. 

The tribunal will next hear the case on 17 March.

Meta Platforms, which operates Facebook, Instagram, and WhatsApp, had challenged the CCI's 18 November ruling barring WhatsApp from sharing user data collected on its platform with other Meta companies or products for advertising purposes.

Meta argued that the CCI's order could severely impact its business model and cause harm, as the company needs to remain sustainable by monetizing user data through platforms like Facebook and Instagram.

The NCLAT bench, led by Justice Ashok Bhushan, noted that such a ban could disrupt the platform's business model in India.

“The ban of five years which was imposed may lead to the collapse of the business model WhatsApp’s privacy policy could disrupt the platform’s business model which has been followed by WhatsApp LLC. It is also relevant to notice that WhatsApp is providing WhatsApp services to its users free of cost,” the NCLAT ruling stated.

The NCLAT also noted that the Supreme Court earlier had not stayed the 2021 WhatsApp policy update, particularly in light of the recently passed Digital Personal Data Protection Act 2023, which is likely to address concerns regarding data privacy.

“We have also noticed that the Hon’ble Supreme Court has not granted an interim order staying the 2021 privacy policy, and the Digital Personal Data Protection Act 2023 has also been passed and is likely to be enforced, which may cover all issues pertaining to data protection and data sharing. We are of the prima facie view that the five-year ban imposed needs to be stayed.”

The appellate tribunal said that parties can seek modifications to the order once the new data protection laws are enforced.

NCLAT's decision comes as a major relief for the American tech giant, which has a combined user base of 850 million, with 350 million on Facebook and over 500 million on WhatsApp.

“We welcome the NCLAT’s decision to grant a partial stay on the Competition Commission of India’s (CCI) order. While we will evaluate next steps, our focus remains on finding a path forward that supports millions of businesses that depend on our platform for growth and innovation as well as providing high-quality experiences that people expect from WhatsApp,” said a Meta spokesperson.

The core issue stems from WhatsApp's release of an in-app notification in January 2021, requiring users to accept its revised privacy policy by 8 February 2021, or face a potential discontinuation of the service.

Also Read: NCLAT admits Meta’s appeal against CCI’s data-sharing ban, ₹213 crore fine

What experts say

According to tech experts and lawyers, Meta smartly leveraged the argument of the upcoming Data Protection Act in its favour. They believe that the CCI could have taken a stronger stance.

"The NCLAT's stay on the CCI's five-year ban and penalty against WhatsApp undermines the regulator's authority, offering Meta crucial relief to protect its data-driven model while questioning the proportionality of the CCI's actions. The CCI is likely to face limited options such as challenging the NCLAT stay in the Supreme Court or awaiting a final hearing," said Ketan Mukhija, senior partner at Burgeon Law.

Meta used the argument of the upcoming Data Protection Act in its favor by stating that the new law will overlap with CCI’s powers to decide on data privacy, said Isha Suri, research lead at the Centre for Internet and Society. 

"Although CCI has the prerogative to act suo motu on data privacy issues from the perspective of market dominance, this case highlights the need for stronger regulatory coordination among government agencies, including CCI and the upcoming data protection board under the Digital Personal Data Protection Act," said Suri.

"This order is surprising as it allows Meta to continue with its policy while still imposing a penalty on Meta. There is a lack of clarity around what this penalty is supposed to deter. The CCI needs to immediately challenge this in the Supreme Court."

According to Mishi Choudhary, founder of Software Freedom Law Center (SFLC.in), while Meta is entitled to appeal the order, no technical expertise is required by CCI or NCLAT to see the perverse data monetizing model Meta has forced its Indian users to adopt.

"CCI's order was correct in recognizing the exploitative policy of 'take it or leave it' with no clarity about data sharing, which allows Meta to exploit Indian users for targeted advertising." Choudhary also stated, "It's time for such data-exploiting practices to stop. Users who care about secure communication should anyway quit WhatsApp and choose more privacy-protecting platforms like Signal," she added.

In its petition to the NCLAT, Meta voiced concerns over the potential impact of the data-sharing ban on its ability to offer personalized ads on Facebook and Instagram. WhatsApp, which shares user data, such as phone numbers, transaction details, business interactions, and device information, with Meta, could be significantly affected by the ban.

Meta explained that Indian businesses, such as fashion retailers, would struggle to personalize ads on Facebook or Instagram based on WhatsApp interactions, such as those related to specific clothing lines.

The company also argued that implementing the CCI’s remedy could force it to roll back or pause several features and products, potentially jeopardizing the commercial viability of Meta and WhatsApp in India.

However, Meta did not specify the exact monetary impact of the decision.

Facebook India Online Services, which manages advertising inventory in India, reported a record revenue of $351 million in 2023-24, the highest in at least five years.

In its 18 November 2024 order, the CCI determined that the 2021 policy update allowed Meta to further entrench its dominance in internet-based messaging via WhatsApp and online display advertising.

For purposes beyond advertising, the CCI asserted that WhatsApp's policy must include a clear explanation of the user data shared with Meta’s other companies, such as Facebook.

The regulator also ruled that sharing WhatsApp user data with other Meta products or companies, for reasons other than providing WhatsApp services, should not be a condition for users to access the messaging service in India. The decision reinforced user consent as a key principle in the operation of social media giants, in line with measures adopted by other countries.

Also Read: CCI seeks to revamp penalty recovery rules; seeks public feedback

Take it or leave it policy

According to the CCI ruling, WhatsApp’s 2021 privacy policy update outlined how businesses could use Facebook-hosted services to store and manage their WhatsApp chats with customers. The competition watchdog determined that WhatsApp’s practice of sharing users’ business transaction data with Meta granted the company an unfair advantage over rival platforms.

The CCI further found that WhatsApp’s policy update, presented on a “take it or leave it” basis, imposed an unjust condition by forcing all users to accept expanded data collection terms and the sharing of data within the Meta group, with no option to opt out. The regulator argued that this undermined user autonomy and constituted an abuse of Meta’s dominant position.

In December 2021, Germany’s data protection commissioner temporarily prohibited Facebook from processing WhatsApp user data. Additionally, Ireland’s Data Protection Commission imposed a fine on WhatsApp for a previous privacy policy update, which required users to accept these terms before the EU’s General Data Protection Regulation (GDPR) came into force in 2018, as reported by Mint in October.

Also read: Did WhatsApp's policy tweak break the law?