NCLAT partially upholds CCI order on ₹213 crore penalty, allows Meta, WhatsApp to share data

The National Company Law Appellate Tribunal (NCLAT) upheld the ₹213 crore penalty on Meta Platforms and WhatsApp, finding that the Competition Commission of India (CCI) had correctly established abuse of dominance and imposed a proportionate fine.

“The penalty imposed of ₹213.14 crore only (Rupees Two Hundred Thirteen Crores and Fourteen Lakhs only) upon Meta is upheld,” the judgment noted.

The tribunal agreed that WhatsApp’s 2021 privacy policy forced users to accept expanded data-sharing terms without real choice, violating Section 4(2)(a)(i) of the Competition Act, which prohibits dominant firms from imposing unfair conditions. It also noted that Meta and WhatsApp operate under common ownership and control, justifying a joint penalty.

However, the NCLAT said the five-year ban lacked reasoning and was legally unjustified. It observed that restoring user consent and opt-in/opt-out choice sufficiently addresses the coercive elements of the 2021 policy. “Once users have been given the option to freely decide to opt in or opt out…this direction becomes redundant,” the judgment stated.

Lawyers described the verdict as balanced and nuanced.

“The NCLAT has struck a fine balance in the WhatsApp and Meta case. By lifting the data-sharing ban and setting aside the dominance finding, it shields their business model. Yet by upholding the ₹213 crore penalty, it reminds Big Tech that fairness and transparency are now central to competition law,” said Ketan Mukhija, senior partner, Burgeon Law.

“This nuanced verdict reinforces that while dominance itself is not unlawful, leveraging it without informed user consent can still attract competition scrutiny,” Amit Tungare, managing partner, Asahi Legal.

According to Raheel Patel, partner at Gandhi Law Associates, the ruling indicates that competition cases should be based on clear evidence of market harm, rather than merely concerns about data or privacy. He said the decision may give tech companies more confidence to challenge broad claims of dominance and encourage CCI to adopt a more evidence-based approach in handling digital market cases.

The NCLAT’s decision came as a big relief for Meta’s operations in India, where it has a combined user base of nearly 850 million—about 350 million on Facebook and over 500 million on WhatsApp.

“While we await the written order, we continue to reiterate that WhatsApp’s 2021 privacy policy update did not change the privacy of people’s personal messages, which remain end-to-end encrypted,” a Meta spokesperson said.

The case arose from WhatsApp’s January 2021 privacy policy update, which required users to accept new terms allowing the app to share certain data, such as device information, business interactions, and usage details, with its parent company, Meta (then Facebook). WhatsApp said the update aimed to help businesses communicate with customers and improve ad services on Facebook and Instagram. However, users had to accept these terms to continue using the app, sparking global backlash over privacy concerns and allegations that WhatsApp was forcing people to share their data.

India’s competition watchdog held that the policy was exploitative and exclusionary conduct, unfairly strengthening Meta’s position in digital advertising by leveraging WhatsApp’s dominant presence in the messaging market.

In its November 2024 order, CCI fined Meta and WhatsApp ₹213.14 crore, prohibited them from sharing user data with Meta or its affiliates for five years, and directed them to disclose the specific purpose behind each category of data collected.

Legal challenge

Meta challenged the order before NCLAT. In January, the appellate tribunal granted partial interim relief, lifting the five-year data-sharing ban but requiring Meta to deposit 50% of the fine, in addition to the 25% already paid. The refund was made subject to the final verdict.

During the hearings, Meta argued that CCI had misapplied competition law to what was essentially a data protection issue. It maintained that the 2021 update did not broaden WhatsApp’s data collection beyond the 2016 policy but merely clarified existing categories. The company emphasized that no sensitive user data was shared with Meta for advertising and that features such as ‘Click to WhatsApp’ were optional.

Meta also cautioned that enforcing the data-sharing ban would harm small Indian businesses that rely on personalised advertising through Facebook and Instagram based on WhatsApp interactions. It stated that the ban could compel Meta to halt or withdraw key features, potentially impacting its commercial viability in India. Meta further argued that CCI overstepped its jurisdiction, lacked supporting evidence such as user complaints or surveys, and ignored the presence of rivals like Telegram, Signal, and iMessage.

In response, CCI defended its order, arguing that Meta’s vast size, integration, and resources across Facebook, Instagram, Messenger, and WhatsApp made it the dominant player in India’s messaging market. The regulator stated that the 2021 update eliminated the limited opt-out option previously available, requiring users, even those who had previously declined, to accept cross-platform data sharing in order to continue using the service.

CCI’s defence

CCI also pointed out that Indian users were treated differently from those in the European Union, where users enjoy stronger data rights under the General Data Protection Regulation (GDPR), such as the ability to rectify or erase information. This, it said, showed Meta’s deliberate decision to deny Indian consumers the same level of transparency and control.

Rejecting Meta’s claim that privacy concerns fall outside the scope of competition law, CCI argued that privacy and data control are essential to fair competition, as a lack of user consent and the misuse of data can distort markets and harm consumers’ welfare.

Regulator CCI argued that WhatsApp’s 2021 update, introduced on a ‘take-it-or-leave-it’ basis, effectively forced users to accept expanded data sharing, undermining user autonomy and enabling Meta to exploit WhatsApp’s dominance to boost its advertising business.

Under Section 27(b) of the Competition Act, 2002, CCI can impose a maximum penalty of up to 10% of a company's average turnover for the preceding three financial years if found guilty of abusing dominance or engaging in anti-competitive practices.

Globally, Meta’s data practices have faced similar scrutiny. In 2021, Germany’s data protection authority temporarily banned Facebook from processing WhatsApp user data, while Ireland’s Data Protection Commission fined WhatsApp €225 million in September 2021 for lack of transparency in data-sharing practices. Other countries also took action. Turkey’s Competition Authority suspended the new policy in January 2021, citing abuse of dominance, while Brazil’s justice ministry temporarily halted its rollout in May 2021, saying it violated consumer consent rules.

WhatsApp has emerged as a powerful platform for marketing and customer engagement, with over 3.14 billion users worldwide, according to a report by AI-based customer engagement platform Haptik The State of WhatsApp Marketing 2025. The report notes that brands increasingly rely on WhatsApp for personalized communication, achieving open rates of nearly 98% and click-through rates around 45%. Companies across sectors such as retail, fintech, and healthcare now use WhatsApp for sales, customer support, and retention, while the adoption of generative AI tools has boosted personalization and improved engagement levels by up to 9%.