The National Company Law Appellate Tribunal (NCLAT) has clarified that its earlier order on WhatsApp’s privacy and consent safeguards has extended to the collection and sharing of user data for all non-WhatsApp purposes, including both non-advertising and advertising activities. The clarification has come in response to an application filed by the Competition Commission of India (CCI), which has sought clarity on the scope of the tribunal’s previous ruling.
The clarification has been issued through an order passed on the CCI’s application, as per media reports, with the tribunal confirming that WhatsApp and its parent company Meta cannot claim unilateral or open-ended rights over user data. The NCLAT bench, comprising Chairperson Justice Ashok Bhushan and Member Arun Baroka, has reiterated that users must retain the right to decide what data is collected, for what purposes and for how long, and that any non-essential data collection or cross-use, including for advertising, can take place only with users’ express and revocable consent.
The tribunal has further noted that allowing users to opt in or opt out of data sharing at any stage, whether for regular or optional features, has ensured continuous protection of user rights and has addressed concerns of exploitation that had arisen from WhatsApp’s 2021 privacy policy. Based on this reasoning, the NCLAT has allowed the CCI’s application and has clarified that the remedial directions contained in paragraphs 247.2.1 to 247.2.4 of the CCI’s order dated November 18, 2024, will apply to WhatsApp user data collection and sharing for all non-WhatsApp purposes, including non-advertising and advertising purposes. WhatsApp has been granted three months to comply with these directions by making the necessary changes.
The clarification has followed the NCLAT’s earlier order of November 4, which had granted partial relief to WhatsApp by setting aside a portion of the CCI’s original ruling while upholding a penalty of Rs 213.14 crore. The tribunal had confirmed that WhatsApp’s 2021 policy had breached Sections 4(2)(a)(i) and 4(2)(c) of the Competition Act by abusing its dominant position and creating market denial. While parts of the CCI’s remedial directions had been upheld, ambiguity had remained on whether user consent was required for advertising-related data sharing, a gap that has now been addressed through this clarification.
