Relief for Meta: NCLAT stays CCI ban on WhatsApp’s data-sharing policy but asks platform to pay half the fine

New Delhi: The National Company Law Appellate Tribunal on Thursday granted relief to Meta Platforms by staying the five-year ban imposed by India’s competition regulator on WhatsApp’s data-sharing practices. 

The NCLAT bench, led by Justice Ashok Bhushan, noted that such a ban, linked to WhatsApp’s privacy policy, could disrupt WhatsApp’s business model in India.

Meta Platforms, which rebranded from Facebook, had challenged the Competition Commission of India’s 18 November 2024 ruling.

While the ban was stayed, the appellate tribunal did not put a stay on the entire order. The tribunal directed Meta to deposit 50% of the penalty, which amounts to ₹213 crore, within two weeks. Meta has already paid 25% of the fine.

NCLAT also acknowledged that the upcoming data protection law in India could address concerns related to data privacy, suggesting that future regulatory frameworks may resolve some of these issues. The tribunal reserved its decision for 16 January.

A detailed order from the NCLAT is still awaited.

The core issue stems from WhatsApp’s release of an in-app notification in January 2021, requiring users to accept its revised privacy policy by 8 February 2021, or face a potential discontinuation of the service.

Also Read: NCLAT admits Meta’s appeal against CCI’s data-sharing ban, ₹213 crore fine

WhatsApp’s 2021 privacy policy sparks controversy

The order imposed a penalty of ₹213.14 crore for allegedly abusing Meta’s dominant position in relation to a controversial update to the privacy policy of its WhatsApp messaging service in 2021. Additionally, the CCI’s ruling imposed a five-year ban on Meta sharing user data with other platforms.

At the last hearing, senior advocates Kapil Sibal and Mukul Rohatgi, representing Meta, cited statements made by Union minister of electronics and information technology Ashwini Vaishnaw. The minister recently announced that the new Digital Personal Data Protection Rules, 2025, would be implemented by mid-2025. The defence argued that the CCI order could not be enforced until the new rules are in place, as its directive would override pending legislation.

They also referenced a 2021 Supreme Court ruling, which allowed WhatsApp to share user data with Facebook, provided users were informed and given the option to delete their accounts if they disagreed with the data-sharing terms.

“We need an absolute stay on this. Let the Supreme Court decide on privacy and the statutory rules, and then, My Lord, you can make your decision,” said Sibal. 

“The balance of convenience is in my favour. I have been operating under this policy for years. What’s in my 2016 policy, which is different from the 2021 one, is just a little bit more transparent.”

Sibal added, “I don’t see why this order should operate at all, at least until the new rules come into effect. Once the rules are in place, the order itself could become fractured, as the minister has stated it will be implemented by the middle of this year.”

Meta also noted that the challenge to the 2016 WhatsApp privacy policy is still pending before the Supreme Court’s Constitution Bench. Moreover, the company argued that the CCI’s ruling stemmed from a complaint filed by no users who formally objected to WhatsApp’s data-sharing practices.

In response, CCI counsel Samar Bansal contended that while data privacy law concerns personal data, competition law addresses business data. He emphasized that Indian users currently do not have an opt-out option, unlike their European counterparts.

Bansal also pointed out that WhatsApp had already allowed users to accept or reject its privacy policy in Europe without causing any service disruption there. He argued that similar practices should be applicable in India.

In its petition to the NCLAT, Meta voiced concerns over the potential impact of the data-sharing ban on its ability to offer personalised ads on Facebook and Instagram. WhatsApp, which shares user data, such as phone numbers, transaction details, business interactions, and device information, with Meta, could be significantly affected by the ban.

Also read: Did WhatsApp’s policy tweak break the law?

Meta explained that Indian businesses, such as fashion retailers, would struggle to personalize ads on Facebook or Instagram based on WhatsApp interactions, such as those related to specific clothing lines.

The company also argued that implementing the CCI’s remedy could force it to roll back or pause several features and products, potentially jeopardizing the commercial viability of Meta and WhatsApp in India.

However, Meta did not specify the exact monetary impact of the decision.

Facebook India Online Services, which manages advertising inventory in India, reported a record revenue of $351 million in 2023-24, the highest in at least five years.

The core issue stems from WhatsApp’s release of an in-app notification in January 2021, requiring users to accept its revised privacy policy by 8 February 2021, or face a potential discontinuation of the service.

In its 18 November 2024 order, the CCI determined that the 2021 policy update allowed Meta to further entrench its dominance in internet-based messaging via WhatsApp and online display advertising.

For purposes beyond advertising, the CCI asserted that WhatsApp’s policy must include a clear explanation of the user data shared with Meta’s other companies, such as Facebook.

The regulator also ruled that sharing WhatsApp user data with other Meta products or companies, for reasons other than providing WhatsApp services, should not be a condition for users to access the messaging service in India. The decision reinforced user consent as a key principle in the operation of social media giants, in line with measures adopted by other countries.

“Take it or leave it” policy

According to the CCI ruling, WhatsApp’s 2021 privacy policy update outlined how businesses could use Facebook-hosted services to store and manage their WhatsApp chats with customers. The competition watchdog determined that WhatsApp’s practice of sharing users’ business transaction data with Meta granted the company an unfair advantage over rival platforms.

The CCI further found that WhatsApp’s policy update, presented on a “take it or leave it” basis, imposed an unjust condition by forcing all users to accept expanded data collection terms and the sharing of data within the Meta group, with no option to opt out. The regulator argued that this undermined user autonomy and constituted an abuse of Meta’s dominant position.

In December 2021, Germany’s data protection commissioner temporarily prohibited Facebook from processing WhatsApp user data. Additionally, Ireland’s Data Protection Commission imposed a fine on WhatsApp for a previous privacy policy update, which required users to accept these terms before the EU’s General Data Protection Regulation (GDPR) came into force in 2018, as reported by Mint in October.