The Privacy and Antitrust Paradox

Introduction

The Competition Commission of India (“CCI”), in a landmark decision, vide order dated 18.11.2024, held social media giants Meta and WhatsApp guilty of indulging in anti-competitive practices, specifically for abuse of dominant position under Section 4(2) of the Competition Act, 2002 ("ACT"). Consequently, the CCI imposed a penalty of INR 213.14 Crores and a five-year ban from sharing user data collected on WhatsApp with Meta (Facebook) and related entities for advertising purposes. [1] The CCI also imposed several other conditions for sharing user data for purposes other than advertising using its powers conferred under Section 27 of the Act.

Interim Order of the NCLAT

Meta and WhatsApp have filed appeals before the National Company Law Appellate Tribunal (“NCLAT”) being aggrieved by the order of the CCI. The NCLAT while hearing the interim application for a stay of the order of CCI, granted only a partial stay, vide order dated 23.01.2025, specifically on the five-year restriction against sharing WhatsApp user data with Meta for advertising purposes, with the condition that WhatsApp and Meta deposit 50% of the penalty within two weeks to maintain the partial stay. [2] The appeals are pending before the NCLAT for hearing on its merits.

Factual Background to the proceedings before the NCLAT

In 2021, WhatsApp updated its Terms of Service and Privacy Policy, which apply to users in India and other countries. Unlike previous updates, the 2021 Privacy Policy removed the opt-out option available in prior updates, enabling users to disable data sharing across Meta and other related platforms for advertising purposes.

In January 2021, the CCI launched a suo motu investigation into WhatsApp's 2021 Privacy Policy for violations under the Act. The investigation focused on how WhatsApp and Meta’s data-sharing practices abused their dominant market position, affecting user privacy and competition. Despite Meta and WhatsApp challenging the CCI’s jurisdiction to go into data privacy and usage concerns before the Delhi High Court and the Supreme Court, their pleas were rejected by the respective Courts, upholding CCI’s exclusive power and jurisdiction to independently investigate anti-competitive practices, even if they fall under the purview of data protection. Consequently, CCI proceeded with its investigation and found WhatsApp and Meta guilty of anti-competitive practices.

Contentions put forth by Meta and WhatsApp

Meta and WhatsApp contested the ban on sharing WhatsApp user data for advertising, arguing that the CCI’s intervention was excessive of its jurisdiction. They asserted that data sharing and privacy concerns should fall under the DPDP Act and not the competition law. Further, they opposed the requirement to disclose details on user data sharing beyond WhatsApp, contending that it would provide competitors with insights into Meta’s operations without a reciprocal obligation.

Another major contention was the mandate for an opt-out option for data sharing. Meta and WhatsApp claimed this would cause irreparable harm to their business model and that the CCI failed to prove any anti-competitive harm to justify such a measure. They also argued that indefinitely enforcing these remedies for future policy updates would hinder innovation, create regulatory uncertainty, and negatively impact small businesses.

Key Findings of the CCI Order

1. Meta’s Dominance in Relevant Markets

The CCI identified two interrelated markets: (i) Over The Top (“OTT”) messaging services in India and (ii) online display advertising. CCI rejected Meta’s claim that WhatsApp competes with SMS, email, and other proprietary apps, noting that these services function differently and, therefore, cannot be categorised as the same as OTT messaging. In advertising, the CCI distinguished between online and offline advertisements, emphasising that Meta leverages its massive user data to significantly enhance its advertising dominance. The CCI also dismissed Meta's argument that they offer a zero- price market by stating that users pay the cost through their personal data. The tech giant’s omnipresence, including its integration with businesses and government services, further solidified its market power. 

2. WhatsApp 2021 Policy: A Take-It-Or-Leave-It Approach

The CCI found WhatsApp’s 2021 privacy policy coercive, as users had no meaningful option to opt out of it. WhatsApp also used vague language, allowing it to arbitrarily expand the data collection. CCI observed that compared to WhatsApp’s EU policy, Indian users were subjected to weaker privacy protections. This could also be due to the lack of data protection legislation in India. Even though the Digital Personal Data Protection Act, 2023 (“DPDP Act”) received the President of India’s assent on 11.08.2023, the Government is yet to notify the effective date of the legislation. The data-sharing arrangement reinforced Meta’s market power, creating a feedback loop where more data led to better- targeted ads, increasing revenue and user dependence on Meta’s platforms.

3. Data Sharing and Anti-Competitive Impact

Data is crucial for online advertising, and the 2021 policy gave Meta an unfair advantage by eliminating the opt-out option. Advertiser numbers on Meta nearly doubled after its 2016 privacy update, demonstrating the competitive impact of data-driven targeting. Given the high barriers to entry in online advertising, the CCI found that Meta’s data practices reinforced its dominance, making it difficult for new players to compete.

The NCLAT, while granting a partial conditional interim stay, directed that all other conditions issued by the CCI remain in effect, which include:

a) WhatsApp must update its privacy policy to clearly specify what data is shared with Meta and its purposes.
b) Users cannot be forced to share data beyond WhatsApp services to access the app.
c) WhatsApp must provide an opt-out option and allow users to modify their data-sharing preferences.
d) All future policy updates must adhere to these transparency and user-consent requirements.

The Privacy and Antitrust Paradox

Globally, regulators are increasingly integrating privacy into competition law. While the European Union initially treated privacy as separate from antitrust enforcement, Germany’s Federal Cartel Office and Japan’s Fair Trade Commission have linked privacy violations to anti-competitive conduct. [3] The U.S. has traditionally followed a separatist approach, but recent FTC actions indicate a shift toward considering data practices in antitrust scrutiny. [4]

As the Government is working its way through the implementation of the DPDP Act and the draft Digital Personal Data Protection Rules, 2025, which are underway for the approval of the Parliament, there is a vacuum for the protection of citizens' data and privacy. The CCI's ruling sets a precedent, recognising privacy as a competitive parameter in digital markets. While we await the final view of the NCLAT, we have to laud CCI’s proactive stance in delivering this decision identifying WhatsApp’s practices as abuse of dominance and anti-competitive and in taking a step towards ensuring data privacy of the people.

References

[1] Suo Motu Case No. 01 of 2021 and Case Nos. 05 of 2021 and 30 of 2021
[2] I.A. No. 280 od 2025 in Competition App. (AT) No. 1 of 2025 and Competition App. (AT) No. 2 of 2025, order dated 23.01.2025, NCLAT Delhi
[3] Kumar, N. (2025) The privacy-antitrust paradox? analysing the CCI’s penalty order against Meta and WhatsApp., Internet Freedom Foundation. https://internetfreedom.in/the-privacy-antitrust-paradox-analysing-the-ccis-penalty-order-against-meta-and-whatsapp/
[4] Thorne, J. (2024) United States: High-profile cases shed light on antitrust enforcement against data abuse, Global Competition Review. https://globalcompetitionreview.com/guide/data-antitrust- guide/first edition/article/united-states-high-profile-cases-shed-light-antitrust-enforcement-against-
data-abuse