Data Privacy Qua WhatsApp Policy Of 2021: A Critical Analysis Under Indian Competition Law

Abstract

This article examines the Competition Commission of India's ("CCI") intervention in WhatsApp's 2021 Privacy Policy¹ under the Competition Act, 2002 ("Act"). It argues that data has become both a parameter of market power and a mechanism of exploitative and exclusionary abuse. By integrating competition law and privacy jurisprudence, the article highlights how the CCI's approach reflects a shift towards recognizing privacy as a non-price factor in consumer welfare. Drawing on comparative insights from the Court of Justice of the European Union's ("CJEU") ruling in Meta v. Bundeskartellamt ² and legislative frameworks such as the European Union Digital Markets Act and India's Draft Digital Competition Bill, the article situates the case within a broader global movement to regulate digital platforms.

I. Introduction

On 23^rd February,2026, WhatsApp LLC informed the Supreme Court of India that it would comply with the order issued by the Competition Commission of India, undertaking to implement a framework that grants users a clear and voluntary choice regarding the sharing of their data with Meta Platforms Inc. and its affiliated entities.

In January 2021, WhatsApp updated its Privacy Policy, requiring Indian users to agree to the revised terms and conditions by February 8, 2021, in order to continue using their accounts. The stated goals were to improve transparency in data collection, use, and sharing practices at WhatsApp, and to inform users about optional business messaging features. The update expanded information sharing with other Meta platforms, such as Facebook and Instagram, including user contacts, behaviour data, and transaction information. Unlike the earlier 2016 and 2019 revisions, which allowed users to opt out, the 2021 policy was a take-it-or-leave-it move.

The Competition Commission of India (CCI), in its Suo motu investigation under Section 19(1) of the Act, pursuant to an order under Section 26(1), directed the Director General to investigate the scope and competitive impact of data sharing resulting from the mandatory acceptance of the revised Privacy Policy by users. This intervention was an important development because competition authorities began discussing privacy policies as a possible breach of competition law.

In its final order dated 18 November 2024, the CCI found that WhatsApp abused its dominant position by imposing unfair conditions under Section 4(2)(a)(i) through the mandatory expansion of data sharing with Meta group entities and imposed a penalty of ₹213.14 crore along with other behavioural remedies. Further, CCI found that WhatsApp's 2021 Privacy Policy amounted not only to exploitative abuse but also to leveraging under Section 4(2)(e) of the Competition Act, 2002. The Commission reasoned that the mandatory sharing of user data with Meta entities could enable the group to strengthen its position in adjacent markets, particularly digital advertising and related services. On appeal, the National Company Law Appellate Tribunal upheld the finding of dominance and the imposition of penalty, but it narrowed the scope of the leveraging analysis, emphasising that cross-market abuse requires clear evidence of dominance and competitive impact in the secondary market, and cannot rest solely on structural integration within a corporate group.

An appeal³ was filed before the Supreme Court against NCLAT's order, however during the hearing, WhatsApp reaffirmed that the platform would adhere to directions of NCLAT concerning user data practices, emphasizing and committed to obtaining informed user consent before sharing personal data with Meta entities. A cross-appeal filed by CCI against NCLAT's order seeking revival of a five-year ban on sharing user data for advertising purposes, remains pending in the Supreme Court⁴.

II. Legal Framework

The Competition Act, 2002 prohibits enterprises and their groups from abusing a dominant position in the market. Section 4 of the Act lays down what kinds of conduct amount to such abuse.

• Section 4(2)(a)(i) prohibits an enterprise from imposing unfair or discriminatory conditions in the sale or provision of goods or services. In simple terms, if a company holds such a strong position in the market that consumers have no real alternative, it cannot use that position to force them to accept unfair terms.
• Section 4(2)(c) prohibits an enterprise from denying market access to competitors. This means a powerful company cannot act in a manner that prevents or restricts other businesses from entering the market and competing effectively.
• Section 4(2)(e)⁵ prohibits an enterprise from leveraging its dominance in one market to enter into, or protect its position in, another market. In other words, a company cannot use its strength in Market A to gain an unfair advantage in Market B.

Before determining whether such abuse exists, the Commission must first determine whether the enterprise holds a "dominant position." This requires delineation of the relevant market in accordance with Sections 2(r), 2(s), and 2(t) of the Act.

• Section 2(r) defines the "relevant market" as the area in which competition conditions are sufficiently similar.
• Section 2(s) explains "relevant geographic market," meaning the specific territory (for example, India) where competition conditions are uniform.
• Section 2(t) "relevant product market" as comprising all products or services that are interchangeable or substitutable, either from the consumer's perspective (based on characteristics, price, and intended use) or from the producer's perspective (based on the ability to switch production without significant cost or risk).

To determine this, the Commission applies factors as enumerated under Section 19(6) (for geographic market) and Section 19(7) (for product market) of the Act. These include consumer preferences, price differences, switching costs, regulatory barriers, and the availability of substitutes. The purpose is to identify the actual competitive constraints faced by the enterprise.

III. Market Structure and Dominance in Network Economies

Messaging applications are marked by strong direct network effects. The usefulness of a platform increases as more users join, since communication depends on shared participation. In such markets, users tend to remain on the service where most of their contacts are present. Switching to a competing application is therefore not simply a matter of downloading an alternative; it requires the parallel movement of one's network. This limits the practical substitutability of rival platforms even where alternatives formally exist.

In this setting, the Competition Commission of India defined the relevant market as over-the-top (OTT) messaging services for smartphones in India. WhatsApp's market share in this market exceeded 80 %. While market share alone is not decisive under Section 4 of the Competition Act, 2002, the Commission considered it alongside structural features of the market, including network effects, entry barriers, and user lock-in. These characteristics were seen as strengthening the durability of market power and reducing the effectiveness of competitive constraints. The finding of dominance thus rested not only on numerical share but on the structure of the market and the limited ability of users to switch in response to changes in terms of service.

IV. CCI's Finding

A. Unfair Conditions under Section 4(2)(a)(i) of the Act

The CCI observed that WhatsApp, through its "take it or leave it" policy, imposed an unfair or discriminatory conditions on its users. This finding was grounded in Section 4(2)(a)(i) of the Act, which prohibits a dominant enterprise to impose any unfair or discriminatory terms in the sale or provision of services. The Commission opined that the policy imposed an unwarranted precondition, requiring users to allow WhatsApp to share their data with other Meta entities in order to continue using the platform. This conclusion was based on the fact that, unlike earlier versions, the 2021 policy removed the opt-out option. The Commission noted that a dominant enterprise cannot compel users to accept broadened data-sharing terms as a condition for continued access to the platform, particularly where users are dependent on it, and the same would amount to imposing an unfair condition under Section 4(2)(a)(i) of the Act.

The CCI rationalized that privacy constitutes a non-price parameter of competition and forms part of service quality in zero-price digital markets. In markets characterised by strong network effects that limit effective alternatives, the consent obtained through a "take it or leave it" scheme cannot be considered voluntary in any competitive sense.

B. Leveraging and Market Access under Sections 4(2)(c) and 4(2)(e)

The Commission also found that incorporating WhatsApp user data into Meta's advertising ecosystem, for purposes beyond the provision of WhatsApp services, could create a monopoly in adjacent markets. It expressed concern that the accumulation and cross-use of such data enhanced Meta's competitive advantage and restricted effective competition by raising barriers to entry for rival firms in online display advertising.

On this assessment, the CCI identified infractions of Section 4(2)(c) and 4(2)(e) of the Act and a monetary penalty of ₹213.14 crore was imposed, along with behavioural remedies, including a five-year prohibition on advertising-related data sharing.

V. Jurisdiction of the CCI

WhatsApp and Facebook argued that privacy and data protection fall exclusively under the purview of Information Technology Act, 2000⁶ and Digital Personal Data Protection Act, 2023, and thus beyond the CCI's scope. They argued that such issues must be dealt with by special regulators. However, CCI in its prima facie order dated 19 January 2021 emphasized that due to its enormous scale of users, WhatsApp collected large volumes of sensitive user behaviour, communication and transaction data. This data advantage, in turn, created substantial entry barriers and strengthened the Meta's market position. Importantly, the CCI clarified that the competitive harm from data aggregation is not confined to privacy concerns, but has direct implications for competition law, since it strengthens Meta's capacity to engage in targeted advertising and leveraging dominance into adjacent markets.

The Hon'ble Supreme Court's decision in Competition Commission of India v. Bharti Airtel Ltd ⁷ is relevant in this context. The Court held that where technical or sector-specific issues arise, sectoral regulators like TRAI should first render its findings, however, this does not oust jurisdiction of CCI. Once factual findings are made, the CCI is competent to examine and adjudicate competition law concerns. By analogy, while data protection authorities may address privacy-related issues, the CCI is fully empowered to assess whether unilateral data policies foreclose competition or impose unfair terms. The assessment must therefore be undertaken through a competition law lens to determine whether such policy updates give rise to concerns that violate Section 4 of the Act.

However, Section 62 of the Act is critical in understanding the relationship between competition law and other regulatory frameworks. Section 62 clarifies that the provisions of the Act are in addition to, and not in derogation of, other laws in force. Accordingly, even if privacy and data protection are governed by separate statutes, such as the IT Act or the Digital Personal Data Protection Act, the CCI is not precluded from examining the same conduct under competition law.

VI. Data as the New Price: Privacy Degradation as Exploitative Abuse

In today's time, consumers value non-price parameters of services, such a s quality, customer service, and innovation, as equally important as price. Competitors in the market also compete based on such non-price parameters. A reduction in non-price parameters like consumer data protection and the loss of control over their personalized data by users can therefore amount to reduction in the service quality for the purpose of antitrust law analysis. Lower data protection standards do not only lead to the exploitation of users; it also allows WhatsApp/Facebook to further entrench their position and leverage their dominance in neighbouring or unrelated markets, like the online display advertisement market, which results in foreclosure and exclusionary effects.

In Harshita Chawla v. WhatsApp Inc.⁸, concerns were raised regarding WhatsApp's data security practices, recognizing privacy as a dimension of competition in digital markets. In digital markets where services are offered at zero monetary price, "data itself becomes the price," and therefore a reduction in privacy safeguards may be treated as a decline in service quality.

Consumers often find it difficult to switch from one digital service to another due to the lock-in effect, where the costs of switching are substantial. In context of data-driven platforms, this arises because users accumulate substantial personal correspondence and build extensive networks of contacts over time. As these contacts may not migrate to a new or more privacy-protective service, users feel compelled to remain on the existing platform.

VII. Integration of Privacy and Antitrust

The CCI emphasized that privacy is not merely a fundamental right but also a "quality" parameter in competition analysis. In zero-price digital markets, consumer welfare depends not only on price but on service quality, autonomy, and meaningful choice. Competition law aims to foster competition on the merits (such as price, innovation, quality etc.), thereby enabling users to exercise real choice and protect consumer welfare. In digital economy, where data functions as the price for free services, non-price factors, such as quality, should be considered in determining consumer harm.

This integrationist approach is exemplified in the Court of Justice of the European Union (CJEU) decision in Meta Platforms, Inc. v. Bundeskartellamt.⁹ The CJEU has strictly interpreted the standard for processing personal data under the General Data Protection Regulation (GDPR), Regulation (EU) 2016/679¹⁰, holding that such processing is permissible only where it is objectively necessary for the performance of contractual obligation integral to the provision of service. The CJEU observed that processing personal data for providing users with personalized content is not necessary for facilitating social networking and communication. The CCI in the present case has followed a similar approach by highlighting the competition concerns associated with processing data for providing personalized content while considering the degraded level of privacy protection as an incidental factor.

VIII. Meta and WhatsApp: Principal Defenses

A. Encryption & Scope of Data Processing

WhatsApp argued that the 2021 policy update did not affect end-to-end encryption of personal messages content. According to the company, the policy related only to metadata, device information and business messaging functionality, and not to the substance of messages. It contended that equating metadata with message content for privacy purposes was misplaced and overstated.

B. Business Integration & Efficiency

Meta presented the 2021 update a measure to expand WhatsApp's business offering and enhance interoperability across its broader infrastructure. It argued that service integration was necessary to improve reliability, customer service, payment functionality and product development.

At the core of its defence, WhatsApp argued that a blanket ban will harm Indian micro, small and medium enterprises. "Around 200,000¹¹ Indian advertisers use Facebook and Instagram ads that direct customers to WhatsApp, including Kirana stores, family-run shops, repair services, independent sellers and startups with limited budgets. Targeted ads linked to WhatsApp chats allow such businesses to reach interested consumers in a cost-effective manner."

C. Fraud Prevention and Platform's Integrity

WhatsApp emphasized that connection data, device identifiers, and usage indicators are necessary to detect spam, impersonation fraud and software-driven abuse. It argued that certain metadata processing is integral to the platform security and it cannot be equated with commercial exploitation.

D. Multi-Homing and Contestability

Meta also relied on evidence of increased downloads of competing applications such as Telegram and Signal following the policy announcement. It argued that the availability of alternatives and the prevalence of user multi-homing demonstrate the existence of competitive constraints, thereby undermining the allegations of coercion and negating claims of foreclosure.

E. Innovation

Meta further contended that over-regulation could stifle novel business models and discourage innovation aimed at improving consumer experience and expanding usage. It maintained that evidence from India and beyond shows that some "anti-competitive" defaults, such as bundling or integration, can promote viable ecosystems, particularly in markets characterised by strong network effects and high investment requirements.

IX. NCLAT Judgment and Appellate Recalibration

A. Affirmation of Exploitative Abuse

The NCLAT upheld the CCI's finding that WhatsApp imposed unfair conditions in violation of Section 4(2)(a)(i) of the Act. The Tribunal agreed that removal of meaningful opt-out mechanisms from the 2021 policy in a dominant network-driven market resulted in structurally constrained user consent. It further accepted that privacy can operate as a parameter of competition, and that the coercive extraction of data may amount to exploitative abuse even in zero-price markets.

B. Narrowing of Leveraging under Section 4(2)(e)

However, the Tribunal set aside the CCI's finding of leveraging and quashed the five-year prohibition on advertising-related data sharing. It opined that Section 4(2)(e) requires clear evidence of dominance in the neighboring market and demonstrable foreclosure effects. The Tribunal clarified that hegemony in one market does not automatically translate into hegemony in another and that findings of leveraging should be based on real evidence of competition marginalization, rather than on speculative assumptions about ecosystem advantages.

C. Preservation of Consent

While the leveraging theory was curtailed, the NCLAT did not dilute the requirement of meaningful consent and transparency protection over non-essential data processing. The position of NCLAT was clear regarding the fact that the opt-out facility should be made available to the users. The appellate outcome therefore sustains the finding of exploitative conduct while imposing stricter evidentiary standards for establishing exclusionary abuse.

X. Empirical Evidence: User Responses and Market Effects

The theoretical concerns surrounding coercion and lock-in were accompanied by observable user reactions in early 2021. Following the policy announcement, competing applications such as Telegram and Signal experienced sharp increase in downloads. Data from Sensor Tower indicated that in the initial months of 2021, Telegram's installations rose substantially on a year-on-year basis, while Signal saw an extraordinary surge. WhatsApp's global installations declined in the immediate aftermath, suggesting that many users explored alternatives.

However, these patterns also illustrate the strength of network effects. By February 2021, downloads of Signal and Telegram declined sharply, while WhatsApp's growth stabilized and resumed. This indicates that although users initially expressed dissatisfaction and experimented with alternatives, there was no long- term migration.

In economic terms, this reflects the distinction between multi-homing and effective switching. Users may download multiple messaging apps simultaneously, but meaningful engagement and communication often remain concentrated on the largest network.

XI. Exploitative Unfairness and Competitive Foreclosure: Drawing the Doctrinal Line

A central issue raised in this case is whether degradation of privacy should be characterized primarily as exploitative abuse, or whether competition law intervention requires proof of exclusionary foreclosure. While abuse of dominance enforcement has traditionally focused on conduct that restricts rivals and entrenches market power, Section 4 of the Act also captures exploitative abuses through the imposition of unfair conditions on consumers.

In zero-price digital markets, erosion of privacy protections and coercive data-sharing may operate as a form of non-price exploitation: users do not pay in monetary terms, but through reduced autonomy and data surrender. The CCI's approach reflects this understanding by privacy as an element of the quality dimension of competition.

At the same time, the NCLAT's narrowing of the CCI's leveraging findings under Section 4(2)(e) of the Act underscores the evidentiary limits of expansive ecosystem-based theories. Data integration within a corporate group does not, by itself, establish foreclosure in adjacent markets such as online advertising; competition law requires clearer demonstration of actual or likely competitive exclusion.

XII. Conclusion

The WhatsApp litigation is a crucial milestone in the history of the Indian abuse of dominance jurisprudence under the Competition Act, 2002. The case reframes privacy not only as the issue of informational autonomy, but also a dimension of competitive structure. In digital markets where there is no exchange of monetary value (i.e. zero-price markets), a decline in privacy safeguards may amount to a reduction in service quality, particularly where users lack viable switching options.

The statutory framework under the Act is adequately equipped to accommodate such analysis. Section 19(4)(m) Act permits the CCI to consider any other factor that may be relevant to the determination of dominance. Such residuary provision allows the CCI to take into the account factors such as control over data, size of data collection, and privacy loss as indicators of structural market power in the digital spheres.

Reference:

I. Cases (India)

• Competition Commission of India v Bharti Airtel Ltd(2019) 2 SCC 521 (SC).
• Harshita Chawla v WhatsApp IncCase No 15 of 2020 (CCI).
• In Re: Updated Terms of Service and Privacy Policy for WhatsApp UsersSuo Motu Case No 01 of 2021 (CCI).
• Meta Platforms Inc & WhatsApp LLC v Competition Commission of India(NCLAT, 2025).
• S. Puttaswamy v Union of India(2017) 10 SCC 1 (SC).

II. Statutes & Indian Regulatory Framework

• Competition Act 2002.
• Information Technology Act 2000.
• Digital Personal Data Protection Act 2023.
• Draft Digital Competition Bill 2024 (India).
• Competition Commission of India (General) Regulations 2009.

III. Commission and Appellate Orders

• Competition Commission of India,Order under Section 26(1), Suo Motu Case No 01 of 2021 (24 March 2021).
• Competition Commission of India,Final Order in Re: WhatsApp Privacy Policy, (18 November 2024).
• National Company Law Appellate Tribunal, Judgment in Appeal against CCI WhatsApp Order (04 November 2025).

IV. Comparative & International Materials

• Case C-252/21,Meta Platforms Inc v Bundeskartellamt EU:C:2023:537 (CJEU).
• Regulation (EU) 2016/679 (General Data Protection Regulation).
• Regulation (EU) 2022/1925 (Digital Markets Act).
• Bundeskartellamt,Facebook Decision (B6-22/16, 2019).

V. Secondary Literature (Academic & Policy)

• Maurice E Stucke and Ariel Ezrachi,Competition Overdose: How Free Market Mythology Transformed Us from Citizen Kings to Market Servants (HarperCollins 2020).
• Ariel Ezrachi and Maurice E Stucke,Virtual Competition (Harvard University Press 2016).
• OECD, 'Quality Considerations in Digital Zero-Price Markets' (OECD Policy Roundtable 2018).
• Anja Lambrecht and Catherine Tucker, 'Can Big Data Protect a Firm from Competition?' (2017) 28(2) Competition Policy International 1.

VI. Empirical Sources (For Section X: User Responses and Market Effects)

• Sensor Tower,App Download Data Report: Messaging Apps January-February 2021.
• App Annie (data.ai),Global Messaging App Usage Report 2021.
• Business Standard, 'Signal, Telegram Downloads Surge After WhatsApp Policy Update' (January 2021).
• The Economic Times, 'WhatsApp Downloads Dip After Privacy Backlash' (2021).
• Reuters, 'WhatsApp Delays Privacy Policy Rollout After User Backlash' (January 2021).

Footnotes

1. In Re: Updated Terms of Service & Privacy Policy for WhatsApp Users, Suo Motu Case No. 01 of 2021, Competition Comm'n of India (Jan. 19, 2021).

2. Bundeskartellamt, Facebook Decision (B6-22/16, 2019).

3. 23^rd February, 2026

4. S N Thyagarajan, WhatsApp tells Supreme Court it will implement CCI order on giving users greater say in sharing their data, Bar & Bench (23 Feb. 2026, 4:31 PM)

5. Competition Act, 2002, No. 12 of 2003 (India), Id. § 4(2)(a)(i), (c), (e)

6. Information Technology Act, 2000, No. 21 of 2000 (India)

7. Competition Comm'n of India v. Bharti Airtel Ltd., (2019) 2 S.C.C. 521 (India).

8. Harshita Chawla v. WhatsApp Inc., Case No. 15 of 2020, Competition Comm'n of India (Jan. 19, 2021)

9. Meta Platforms Inc. v. Bundeskartellamt, Case C-252/21, ECLI:EU:C:2023:537 (Ct. Just. Eur. Union July 4, 2023)

10. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation), 2016 O.J. (L 119) 1

11. https://www.hindustantimes.com/india-news/blanket-ban-on-data-sharing-will-hurt-small-biz-whatsapp-tells-sc-101771875802237.html

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.