NCLAT Confirms Abuse of Dominance: Whatsapp LLC v. Union of India
BACKGROUND
In January 2021, WhatsApp released an in-app notification mandating users to accept its updated privacy policy (“2021 Privacy policy”) and Terms of Service by 08 February 2021, failing which users would lose access to the platform.1 Unlike previous policy updates, the 2021 Privacy Policy, removed the option for users to decline sharing their data with Meta Group entities. On 24 March 2021, the Competition Commission of India (‘CCI’) took suo moto cognizance of the update and directed the Director General to conduct an investigation, observing prima facie that the revised policy appeared “exploitative” and “exclusionary”, potentially amounting to an abuse of dominant position under Section 4 of the Competition Act.
CCI ORDER
In its order dated 18 November 2024,2 the CCI identified two distinct yet interconnected relevant markets: (a) the market for online display advertising in India and (b) the market for Over-The-Top (“OTT”) messaging applications through smartphones in India. The CCI rejected WhatsApp and Meta’s contention that these constituted “zero-price market”, holding instead that users provide personal data as a form of non‑monetary consideration, thereby making such markets economically significant.
The CCI observed that user data is a critical input in online display advertising, enabling highly granular audience targeting and conferring substantial competitive advantage on entities with deeper data repositories.
Further, the CCI observed that the 2021 Privacy Policy update which removed the user opt‑out mechanism and expanded the scope of data sharing with Meta group entities, afforded Meta a structural advantage by enhancing its reach and data‑profiling capabilities.
Consequently, the CCI consequently imposed a USD 25.5 million penalty on WhatsApp and Meta for violating the following provisions of Section 4 of the Competition Act:
- coercing users into accepting expanded data collection and sharing with Meta group entities without offering an option to opt-out under the Privacy Policy, thereby violating Section 4(2)(a)(i) of the Competition Act;
- sharing user data beyond WhatsApp service needs, denying market access in online display advertising in India, thereby violating Section 4(2)(c) of the Competition Act; and
- leveraging dominance in OTT messaging applications through smartphones in India to protect its online display advertising position, thereby violating Section 4(2)(e) of the Competition Act.
In addition to monetary penalties, the CCI imposed certain restrictions on WhatsApp including a 5 year ban on sharing data with Meta. WhatsApp and Meta have subsequently appealed the CCI’s order before the NCLAT.
SUBMISSIONS BEFORE THE NCLAT
Before the NCLAT, WhatsApp and Meta argued that the CCI had exceeded its jurisdiction by assessing privacy and consent‑related issues, which they contended fall exclusively under the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, especially since the Digital Personal Data Protection Act, 2023 had not yet been notified at the time of the judgment. They further submitted that the 2021 Privacy Policy did not materially differ from the previous 2016 Policy, as it neither expanded data collection nor removed existing opt‑out options, and therefore prior precedents rejecting similar challenges remained binding.
They further contended that the CCI’s findings were based on speculative harm, as no actual anti‑competitive effects had materialized over four years. WhatsApp and Meta also argued that the CCI failed to account for pro‑competitive efficiencies such as innovation and enhanced security features enabled through data integration. They also challenged the five‑year ban on using WhatsApp data for advertising, asserting that it was disproportionate, particularly given Meta’s non‑dominance in the online display advertising market.
KEY ASPECTS OF THE NCLAT RULING
- Data privacy practices as a competition concern:
The NCLAT, on 04 November 2025 held that while data protection laws are aimed at safeguarding personal information, competition law is concerned with whether a dominant enterprise’s use of personal or non‑personal data distorts competition, restricts consumer choice, or results in exploitative or exclusionary conduct. It clarified that there is no conflict between the Competition Act and data‑protection statutes, as both operate in complementary domains. The NCLT also noted that international competition authorities similarly recognize that technology companies’ privacy policies and data‑handling practices can have adverse competitive effects in digital markets.3
- Abuse of dominance in the relevant markets:
The NCLAT upheld the CCI’s delineation of the relevant markets and rejected WhatsApp and Meta’s objections. It endorsed the CCI’s analysis of abuse of dominance and made the following key findings:
- Violation of Section 4(2)(a)(i): NCLAT held that WhatsApp’s 2021 Privacy Policy forced users into accepting data-sharing terms or lose a critical communication tool thereby, imposing unfair, discriminatory, “take-it-or-leave-it” conditions without offering an effective opt-out option, thereby violating of Section 4(2)(a)(i) of the Competition Act.
- Violation of Section 4(2)(c): NCLAT agreed that sharing user data between WhatsApp and Meta strengthened Meta’s competitive position in online display advertising by giving it data advantages unavailable to rivals. This resulted in denial of market access, engaging Section 4(2)(c) of the Competition Act. Although the CCI had noted that Meta was a “leading” and not dominant player in display advertising, the NCLT emphasized that Section 4(2)(c) is broad and applies to denial of market access “in any manner,” making the corporate separation between WhatsApp and Meta irrelevant for this assessment.
- Non‑application of Section 4(2)(e): While the conduct resembled leveraging dominance, the NCLAT agreed that Section 4(2)(e) could not apply because it requires both entities involved to be dominant in their respective markets. Since Meta is not dominant in online display advertising, the provision was inapplicable despite Meta’s full control over WhatsApp.
Accordingly, the NCLAT upheld the CCI’s findings for violation of Section 4(2)(a)(i) and Section 4(2)(c) but not of Section 4(2)(e) of the Competition Act. It also affirmed the penalty, but set aside the five‑year ban on data sharing, holding that the CCI’s directions restoring user choice made such a prohibition unnecessary.
CLARIFICATORY ORDER (15 DECEMBER 2025)
Following the ruling, the CCI sought clarification regarding whether the upheld transparency and opt‑out requirements also applied to data sharing for advertising purposes. In its clarificatory judgment, the NCLAT reaffirmed that:4
- Explicit, revocable user consent is required for any data collection or sharing beyond core messaging functions, including for advertising;
- WhatsApp must ensure transparency, purpose limitation, and opt‑out options for such data use; and
- WhatsApp must implement these compliance measures within three months.
APPEAL TO THE SUPREME COURT
WhatsApp has challenged the NCLAT judgment before the Supreme Court of India. The contentions raised in the appeal and the outcome on the same remain to be seen.5
OUR THOUGHTS
The NCLAT’s ruling is significant on three fronts: (a) it affirms privacy as a non‑price parameter of competition, (b) it defines the limits of the CCI’s powers in addressing data‑related conduct, and (c) it aligns competition law enforcement with evolving data protection norms pre‑ and post‑the DPDPA.
Firstly, by treating personal data as non‑monetary consideration, the NCLT affirms that privacy and user choice influence competitive dynamics in digital markets. This expands abuse‑of‑dominance analysis beyond price to include exploitative data practices, underscoring user autonomy as a core element of consumer welfare.
Secondly, the ruling balances enforcement with restraint. While upholding the CCI’s authority to scrutinize unfair or exclusionary data practices, the NCLAT struck down the five‑year data‑sharing ban as unjustified and redundant once user choice is restored in the 2021 Privacy Policy. The decision reiterates that remedies must target actual competitive harm, not duplicate privacy regulation.
Thirdly, the NCLT aligns competition oversight with India’s evolving data‑protection framework by reaffirming the centrality of consent, transparency, and purpose limitation for any data use beyond core messaging. Its clarificatory order further requires explicit, revocable consent and opt‑out mechanisms even for advertising‑related data. Collectively, these findings advance India’s digital competition jurisprudence by integrating privacy considerations while maintaining the CCI’s competition‑focused mandate.
The information contained in this document is not legal advice or legal opinion. The contents recorded in the said document are for informational purposes only and should not be used for commercial purposes. Acuity Law LLP disclaims all liability to any person for any loss or damage caused by errors or omissions, whether arising from negligence, accident, or any other cause.
