Appellate Tribunal Affirms Core Competition Concerns in WhatsApp-Meta Privacy Policy Case

On 4 November 2025[1], the National Company Law Appellate Tribunal (NCLAT / Tribunal) partly upheld the Competition Commission of India’s (CCI) order dated 18 November 2024[2] against WhatsApp LLC (WhatsApp) and Meta Platforms Inc (Meta). The case arose from WhatsApp’s 2021 Privacy Policy (2021 Policy), which required users to accept allegedly expanded data‑sharing terms with Meta group companies or lose access to the WhatsApp service. Introduced in January 2021 and initially mandated by February (later extended to May), the update allegedly broadened data-sharing to include usage logs, device identifiers, IP addresses, phone numbers, and business communication metadata. Unlike the 2016 policy, which offered a one-time opt-out from sharing data for advertising purposes, the 2021 policy eliminated any such opt-out choice.

Amid growing global concerns, in 2021, the CCI initiated a suo motu investigation and concluded that WhatsApp and Meta had abused its dominant position in the market for Over-the-Top (OTT) messaging apps through smartphones in India[3] in violation of Section 4 of the Competition Act, 2002 (Competition Act). The abuse was found to involve the imposition of unfair terms on users and the facilitation of cross-platform data integration, which created significant entry barriers in the online display advertising market[4]. As a consequence, the CCI had also imposed fines amounting to INR 213 crores (approx. USD  23 million) along with numerous directions to alter business and product practices to WhatsApp which are discussed separately below.  

On appeal, the Tribunal affirmed CCI’s jurisdiction to examine privacy-linked competitive harm, holding that competition law and data protection operate as complementary regimes. While the Digital Personal Data Protection Act, 2023 (DPDP Act) and the erstwhile Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (SPDI Rules) govern consent and lawful processing, the Competition Act addresses coercive practices enabled by market power. Privacy was recognised as a non-price parameter of competition in zero-price markets where users “pay” with data; excessive or mandatory data collection was treated as reduced service quality, constituting exploitative abuse under Section 4 of the Competition Act and therefore within the CCI’s jurisdiction.

The NCLAT also upheld the delineation of two relevant markets viz. OTT messaging apps through smartphones in India and online display advertising in India, reaffirmed WhatsApp’s dominance (large user base, strong network effects, high switching costs, ecosystem integration), and found Meta a leading but not dominant player in the market for online display advertising in India.

The NCLAT sustained the CCI’s findings of exploitative abuse of dominance by WhatsApp, holding that its 2021 Privacy Policy imposed coercive “take-it-or-leave-it” terms, used vague language, and expanded data collection beyond what was necessary- reducing privacy and service quality. It also confirmed exclusionary abuse of dominance, noting that cross-platform data sharing under the policy gave Meta an unfair targeting advantage in online display advertising, which competitors could not match. However, it set aside the CCI’s finding on leveraging under Section 4(2)(e) of the Competition Act. Leveraging refers to using dominance in one market to gain or protect power in another. The Tribunal held that while WhatsApp’s policy enabled Meta to access user data for advertising, Meta is not dominant in online display advertising and WhatsApp and Meta are legally distinct entities. Therefore, WhatsApp’s dominance in messaging could not be considered as having been leveraged to extend dominance in advertising.

On remedies, the NCLAT did not introduce new obligations but upheld the core measures originally ordered by the CCI, while striking down the five-year blanket ban on sharing WhatsApp user data for advertising as disproportionate. The upheld obligations require WhatsApp to provide clear and detailed disclosures about what data is shared with Meta companies and for what purposes, ensure that data sharing for non-WhatsApp purposes is not a condition for using the service, and offer all users-including those who accepted the 2021 Policy-a genuine opt-out option with the ability to review and change their choice easily within the app. WhatsApp must also ensure that all future policy updates comply with these transparency and choice requirements. These measures aim to restore user autonomy, prevent coercive practices, and embed informed consent as a competitive standard in digital markets.

Lastly, the Tribunal upheld the penalty of INR 213.14 crore (approx.- 23 million USD) imposed by the CCI, calculated on the combined relevant turnover of WhatsApp and Meta in India. It justified joint liability on the basis that Meta exercises complete control over WhatsApp’s operations, with common executives, integrated decision-making, and the absence of separate financial statements for WhatsApp. This level of operational and functional integration meant that WhatsApp effectively acted as an extension of Meta’s ecosystem, enabling Meta to benefit from the anti-competitive conduct. The Tribunal emphasized that in such circumstances, imposing the penalty on the parent entity is consistent with the principle that dominant firms and their controlled subsidiaries bear heightened responsibility to ensure compliance with competition law.

Interestingly, on 18 November 2025, the CCI moved an application before the NCLAT seeking clarification on whether the transparency and optout obligations upheld by the Tribunal also extend to advertising linked data sharing. This is significant because, while the five-year blanket ban on ad related sharing was struck down as disproportionate, the CCI appears intent on restoring the essence of that restriction through conduct remedies rather than structural prohibitions. If the clarification is granted, WhatsApp would need to offer granular disclosures and genuine, revocable consent for all ad related data flows-embedding choice and transparency as competitive standards. Strategically, this signals the CCI’s push to institutionalize informed consent as an antitrust safeguard, ensuring privacy and competition law converge. Dominant platforms should expect that consent architecture will now be scrutinized not only for DPDP compliance but also for exploitative abuse under Section 4 of the Competition Act. Business Takeaway: The DPDP Act and its DPDP Rules, 2025 should address some competition law concerns by mandating clear notices, granular consent, and easy withdrawal, reducing ambiguity and coercion. These requirements align with competition law principles of transparency and user autonomy. However, they do not eliminate risk for dominant firms. Under DPDP, businesses must deny service if consent is refused-a lawful privacy obligation. Yet, for a market leader, conditioning access on consent for data beyond what is strictly necessary can still be seen as exploitative under competition law. This creates a compliance tension: privacy law demands strict consent enforcement, while competition law penalizes “take-it-or-leave-it” structures. Companies offering zero-price services or handling large-scale user data must design consent flows that meet DPDP standards without triggering antitrust liability. Data governance is now both a privacy and competition compliance issue.

[1] NCLAT: WhatsApp LLC & Ors. v Competition Commission of India & Anr. Competition App (AT) No. 1 of 2025, order dated 4 November 2025.

[2] CCI: In Re: Updated Terms of Service and Privacy Policy for WhatsApp Users Suo Moto Case No. 01 of 2021 and Case Nos. 05 of 2021 & 30 of 2021, order dated 18 November 2024.

[3] The market for OTT messaging apps through smartphones in India comprises internet-based messaging services (e.g., WhatsApp, Telegram) offering real-time communication and multimedia features, distinct from SMS/MMS due to cost, functionality, and strong network effects that create high switching barriers.

[4] The market for online display advertising in India includes banner, video, and rich media ads served on websites, apps, and social media platforms, distinct from search advertising because targeting objectives and pricing models differ- display focuses on impressions and audience segmentation rather than keyword intent.