WhatsApp must take user consent for all data uses, not just ads: NCLAT
The National Company Law Appellate Tribunal (NCLAT) on Monday said WhatsApp must obtain user consent before sharing data for both advertising and non-advertising purposes.
A bench headed by NCLAT chief Justice Ashok Bhushan allowed the Competition Commission of India (CCI)’s plea to clarify the scope of the court’s November 4 order. The court made clear that user consent is mandatory for all data WhatsApp collects and shares with its parent company Meta, not just data used for advertising.
Earlier, NCLAT had upheld CCI’s finding that WhatsApp’s 2021 privacy policy was based on forced consent and forced users to agree to data sharing or lose access to the service. However, there was confusion as to whether this consent requirement applies to all data shared by WhatsApp or only to data used for advertising purposes. The court said on Monday that the CCI’s directions are generally valid.
NCLAT also said that WhatsApp has three months to comply as stated in the original order. During the hearing, WhatsApp lawyers asked for more time, arguing that making system-level changes would be a large and complex task. While the court was initially inclined to allow only one month, it ultimately allowed three months, as before.
Meta and WhatsApp opposed CCI’s plea, arguing that the earlier decision was clear and there was no need for any explanation. They claimed that user preference for data sharing through optional advertising features was already respected and that CCI was trying to impose new obligations.
The court rejected this argument, saying that the real issue is user choice at the point where data is collected and shared. It ruled that any non-essential or advertising-related data sharing can only occur with the user’s express and revocable consent and the option to opt-in or opt-out at any stage.
NCLAT stated that WhatsApp cannot claim open-ended rights over user data and bringing back opt-in and opt-out options removes the coercive “take it or leave it” nature of the 2021 policy.
WhatsApp’s 2021 privacy policy update
The issue arises from the NCLAT’s November 4 decision in the WhatsApp-CCI case; In this case, the court partially upheld the CCI’s decision. ₹213.14 crore penalty on Meta Platforms and WhatsApp due to 2021 WhatsApp privacy policy update. CCI felt the policy was exploitative and exclusionary. However, the appeals court annulled the CCI’s five-year ban on WhatsApp from sharing user data with Meta companies for advertising purposes.
In CCI’s understanding of the decision, NCLAT emphasized the primacy of user consent and stated in various sections of the decision that consent is required irrespective of whether the data is used for advertising or other purposes.
However, the regulator noted uncertainty in the conclusion part of the decision. In paragraph 264, the court noted that the original CCI decision contained paragraph 247.1. While canceling paragraph 247.2. approved the paragraph. According to CCI, this effectively requires user consent for data sharing for non-advertising purposes, while remaining silent on whether consent is required for advertising-related data sharing.
It therefore appealed to the court to clarify that its decision dated November 4 requires user consent regardless of when WhatsApp shares user data with other Meta entities for advertising or non-advertising purposes.
‘No abuse of dominance allowed’
In its 184-page ruling, NCLAT observed that cross-platform data sharing between WhatsApp and Meta strengthens Meta’s position in the online display advertising market and creates barriers to entry for rival digital advertising firms that do not have similar access to WhatsApp user data.
At the same time, the court held that the CCI’s decision that Meta had violated Article 4(2)(e) of the Competition Act was not sustainable and said that it could not be established with certainty that Meta was taking advantage of WhatsApp’s dominance in the over-the-top (OTT) messaging market to maintain or expand its dominance in the online display advertising market, especially since WhatsApp and Meta are separate legal entities. Section 4(2)(e) prohibits a dominant enterprise from using its strong position in one market to enter, maintain or strengthen another market.
The case dates back to November 2024, when CCI fined Meta ₹213.14 crore regarding WhatsApp’s 2021 privacy policy update. Meta and WhatsApp challenged the decision before the NCLAT, which in January 2025 granted them interim relief by lifting the five-year-old ban on data sharing for advertising purposes between WhatsApp and Meta.
