Background
On 19th February 2014, Facebook announced that it had reached a definitive agreement to acquire WhatsApp, a leading and rapidly growing real-time mobile messaging service, with over 450 million users using each month. At the time, WhatsApp was experiencing strong growth, adding more than 1 million registered users per day. Shortly thereafter, the European Commission (“EC”) concluded the analysis of the transaction by which Facebook, Inc. (“Facebook”, USA) had acquired WhatsApp Inc. (“WhatsApp”, USA) by way of a purchase of shares for US$ 19 billion, which contributed to Facebook’s strategy of focusing its business on mobile development (Case no. COMP/M.7217). In its decision, the EC stated that the deal would raise no competition concerns and authorised the proposed acquisition of WhatsApp by Facebook concluding that Facebook Messenger and WhatsApp are not close competitors and that consumers would continue to have a wide choice of alternatives for consumer communication apps after the acquisition. The EC analysed potential data concentration issues only within the scope that the acquisition could weigh down competition in the online advertising market. Privacy-related concerns from the increased concentration of data within the control of Facebook because of the deal with WhatsApp are not an EU Competition Law matter.
A few years later, WhatsApp (acquired by Facebook Inc. in 2014 – now Meta Platforms) updated its Privacy Policy for users based in India, stating that it may now access users’ communications with businesses on its application. Additionally, WhatsApp informed its users that it will be collecting even more data (discussed in detail in SFLC.in’s Policy Analysis of Messaging Apps), such as –
- Usage and log information and device and connection information like battery levels and signal strength
- WhatsApp will collect users’ IP addresses and other information like phone number area codes to estimate general location
- For users of their payment service, WhatsApp will start processing payment account and transaction information which includes information about payment method, shipping details and transaction amount.
Additionally, WhatsApp users had no choice to opt-out of such terms and continue using the messaging service. On 24 March 2021, India’s competition regulator, Competition Commission of India (“CCI”) took suo moto cognizance of the matter and issued an order under Section 26(1) of the Competition Act, 2002 (in Suo Moto Case No. 1 of 2021) arriving at a prima facie finding that WhatsApp had abused its dominant position, thereby violating Section 4 of the Competition Act, 2002 by engaging in “exploitative and exclusionary conduct” through the 2021 Privacy Update. Further, the CCI directed the Director General to investigate the 2021 Privacy Policy, which resulted in the Investigation Report on 21 January 2023. On 18th November 2024, CCI gave its decision in the matter, ruling that WhatsApp had abused its dominant position. CCI imposed a penalty of INR 213.14 crores and a ban on data sharing between WhatsApp and other Meta Products and Companies.
WhatsApp challenged CCI’s order in the National Company Law Appellate Tribunal (“NCLAT”). In this blog post, we will analyse the key facets of NCLAT’s decision, from the perspective of digital competition and user privacy.
Harmonising data protection and digital competition issues
WhatsApp had vehemently argued (in front of the CCI as well as NCLAT) that the decision dealt with data protection and privacy issues, which fell outside the domain of the CCI.
Notably, the NCLAT recognized that competition regulators worldwide had identified privacy as a critical non-price competition parameter, valued by users on par with quality, customer service, and innovation. This aspect is even more relevant in the matter of applications providing platforms for personal communications, given its role in protecting users from unwarranted intrusion from external actors or even Meta/WhatsApp itself. Additionally, in its clarification order, the NCLAT has emphasised that data protection compliance under the DPDP framework will remain distinct from the remedies enforced under the Act.
WhatsApp’s 2021 Privacy Policy update had significant ramifications on its users. The platform offers a centralized service that allows no data portability or migration across different applications. This had, in fact, led to a mass exodus — where people instead migrated to messaging platforms such as Signal and Telegram. While this may give an indication of the overall reduced strength of WhatsApp users at the time, it also provides insights on how such updates can often limit consumer choice. In this instance, WhatsApp made a conscious decision to impose such “take it or leave it” terms on its users, given that it is aware of its position in the market of OTT messaging applications in India. NCLAT and CCI’s reasoning in this matter is progressive as it does not dilute the importance of investigating such issues from the angle of anti-competitiveness and consumer choice. These decisions are also aligned with relevant jurisprudence in foreign jurisdictions such as Germany and Italy, where WhatsApp has violated similar competition, data protection and consumer laws. In Germany, the Bundeskartellamt initiated a proceeding against Facebook – Facebook Inc., USA, the Irish subsidiary of the company, and Facebook Germany GmbH, Hamburg – on suspicion that Facebook had abused its market power by infringing data protection rules with its specific terms of service on the use of user data. In Italy, in May 2017, the Autorità Garante della Concorrenza e del Mercato (AGCM) fined WhatsApp EUR 3 million for having forced its users to share their personal data with Facebook as a conclusion of two investigations opened in October 2016 concerning infringements of the Consumer Code.
The NCLAT found that the CCI’s arguments in the matter related to the anti-competitive effects of WhatsApp’s 2021 Privacy Policy Update, considering its wider ramifications on consumer choice. that privacy and data collection practices can influence competition because they affect consumer choice, quality, and fairness in the market. NCLAT’s finding on this is critical as it recognizes that both facets of this issue will require attention from India’s competition as well as data protection authorities. The NCLAT’s reasoning on this issue can also be found in the European Court of Justice’s (“ECJ”) judgement in the Meta vs Bundeskartelllamt case. In fact, it can be argued that the NCLAT’s judgement on this point can be characterized as forward-looking, given that India is still a nascent jurisdiction for data protection enforcement and competition enforcement in digital markets. This greatly differs from the legal and regulatory environment in the EU, considering it heralds, arguably, the global benchmarks for antitrust and data protection regulation and enforcement.
Examining NCLAT’s reasoning on speculative vs actual harm
On multiple occasions, WhatsApp had contended that CCI’s assessment of anti-competitive harm was not based on evidence of actual harm to users. However, the NCLAT chose to base its findings on extensive qualitative evidence, in the larger context of WhatsApp’s conduct and inherent characteristics of digital markets. This included the following –
- Detailed cataloguing of data types collected under WhatsApp’s 2021 Policy;
- Comparative analysis with previous policies, and examination of market structure factors such as dominance, network effects, and switching costs influencing user choice;
- Extensive market feedback and submissions from competitors and advertising companies (such as InMobi, Affle, Taboola, LinkedIn, Snap, Tyroo, and Xapads);
- User coercion and imposition of the Policy were also assessed qualitatively through patterns of user prompts, acceptance rates, and the market situation where users faced a take-it-or-leave-it choice
Based on this evidence, NCLAT found that WhatsApp’s data sharing with Meta strengthens Facebook’s dominant position in the digital advertising ecosystem and adversely impacts competition. NCLAT’s clarification order states that WhatsApp’s Privacy Policy and its future iterations must include a detailed explanation for collection and sharing of user data with other Meta Companies or Meta Company Products, irrespective of whether such processing and sharing is being done for advertising or non-advertising purposes. The Privacy Policy must
specify the purpose of data sharing, linking each type of data to its corresponding purpose.
This finding can be further appreciated as the NCLAT recognized WhatsApp’s actions in the context of coercing user consent as a necessary pre-condition to continued access to its service. Furthermore, WhatsApp’s 2021 Privacy Policy Update would have coerced users to consent to data collection that went beyond the purposes of the WhatsApp service.
Given the inherent nature of digital markets, NCLAT recognized that regulatory intervention can occur based on evidence of speculative harm. Consequently, the NCLAT’s judgement on this point might have established a crucial precedent in the domain of digital competition. The NCLAT’s finding on this point also further indicates that there is a need for an ex ante digital competition law, that can pre-emptively address the consortium of harms stemming from anti-competitive conduct in digital markets.
Conclusion
Going forward, SFLC.in will be monitoring the developments in the landscape of antitrust enforcement in India. Additionally, in the years to come, it will be important to pay close attention to how the Data Protection Board of India and the CCI will coordinate together in cases where there are alleged violations of both the Digital Personal Data Protection Act, 2023 and the Competition Act, 2002. Likely, both authorities will have to wrestle with tricky dimensions of adjudicatory competence, informed consent and anti-competitive harms.
Finally, it will also be critical to keep an eye on the policymaking front. The Draft Digital Competition Bill had received significant criticism during the public consultation process in 2024. SFLC.in had also submitted its comments on the Bill. While it is vital to re-think the approach to these issues in consideration of consultation feedback, it is also important that a law governing digital markets is developed and enforced in a timely manner to course correct future scenarios of anti-competitive conduct in digital markets.
