NCLAT suspends CCI’s 5-year data sharing ban on WhatsApp and Meta, upholds ₹213.14 cr penalty

The National Company Law Appellate Tribunal (NCLAT) on Thursday granted partial relief to WhatsApp, suspending the five-year data sharing ban imposed by the Competition Commission of India (CCI) as part of its November 2024 ruling. The CCI had found that WhatsApp violated the Competition Act by using its dominant position to force users into accepting a 2021 privacy policy update, which required users to share data with Meta platforms such as Facebook and Instagram for targeted advertising. In response, the NCLAT stayed the five-year data sharing moratorium, which could have significantly impacted WhatsApp's business model.

While suspending the ban, the NCLAT upheld other key elements of the CCI's order. WhatsApp is still required to provide users the option to opt out of data sharing for purposes unrelated to WhatsApp services. Additionally, WhatsApp must disclose the types of data shared with Meta entities and provide reasons for sharing this data. The CCI had directed WhatsApp to implement these changes within three months of its order, and the NCLAT confirmed this part of the ruling.

The CCI had initiated the investigation into WhatsApp’s updated privacy policy, concluding that it violated the Competition Act by abusing its market dominance in the over-the-top (OTT) messaging app sector. The policy update removed the option for users to opt out of data sharing with Meta for advertising purposes. The CCI argued that this forced users into accepting the policy, thereby undermining their autonomy and creating anti-competitive effects by hindering competitors' market access. The commission further noted that the data sharing between WhatsApp and Meta for advertising purposes could create barriers for competitors in the online advertising market, thereby restricting competition.

WhatsApp and Meta filed an appeal against the CCI’s decision, arguing that the five-year data sharing ban was excessive and damaging to their business operations. They also pointed out that the Digital Personal Data Protection (DPDP) Act, once enforced, would address concerns regarding data protection and privacy, which they argued was outside the purview of the Competition Act. The companies emphasized that data sharing was vital for WhatsApp’s business model, especially in facilitating personalized advertisements for small and medium businesses using Facebook and Instagram.

The NCLAT’s decision also stipulated that WhatsApp must pay 50% of the ₹213.14 crore penalty within two weeks. The tribunal allowed both parties to seek modifications to the order should the DPDP Act or other data protection laws be enforced. The next hearing has been scheduled for March 17, 2025, with both parties instructed to complete their pleadings within six weeks. The case continues to raise critical issues regarding the balance between data privacy, market competition, and user autonomy in the digital age.