Sidharth Sharma is a B.A. LL.B. (Hons.) student at Panjab University Regional Centre, Ludhiana. He has gained practical experience through internships in litigation, corporate advisory, and legal research. He has authored research works and case commentaries on contemporary legal issues and actively participate in moot court competitions, legal aid initiatives, and academic publication activities. He currently serve as Student Editor of the Publication Bureau and Student Coordinator of the Legal Aid Cell.
ABSTRACT
This blog examines the Competition Commission of India’s intervention in the WhatsApp privacy policy controversy, analysing whether India’s regulatory response adequately addressed the abuse of dominance arising from compelled data-sharing. Critically evaluating the CCI’s remedial framework, the NCLAT’s appellate dilution, and the doctrinal incompleteness of the differential privacy argument, it contends that India’s digital competition architecture remains structurally incapable of governing markets where dominance consolidates silently and enforcement arrives too late, for while legislative frameworks have been established, their structural drawbacks render the system reactive rather than preventative.
INTRODUCTION
In competition law, consent has meaning only if there is no repercussion for refusal. As such, the issue of WhatsApp’s 2021 policy is not just a simple data-sharing matter, but a significant development in the overall landscape of digital competition in India. The problem was not only about privacy in this instance, but also about the power of dominant digital giants to impose terms on consumers and exercise monopoly power by exploiting their dependency.
India’s regulatory response tried to address that question by characterizing privacy degradation as a non-price harm, and aggregating data as a tool of domination, but when the action was taken, it became clear that solving a problem is not a one-to-one match of recognizing it. Penalties were not imposed even close to statutory limits; remedies were not imposed sufficiently and were dismantled on appeal without any evidence or substitute remedy to enforce the imposed penalties. These concerns, collectively, reflect that India’s digital competition framework is still largely reactive as opposed to preventative in tackling technological market power.
FACTUAL BACKGROUND
In January 2021, WhatsApp revised its Privacy Policy, mandating a user’s approval to share more data with Meta’s affiliates in exchange for continued access to the platform. The 2016 policy had a limited “opt-out” clause, while the 2021 policy had no option or choice whatsoever. On 24 March 2021, the Competition commission of India reached at a prima facie opinion that this warranted investigation under Section 4 of the Competition Act, 2002. The Director General found that the policy was imposing unilateral conditions, benefiting from network effects and switching costs, and allowing Meta to use data in related markets, which could result in an abusive dominance.
The CCI finally issued behavioural directions, transparency requirements and a monetary penalty of Rs. 213.14 crore, and a five-year prohibition on WhatsApp sharing user data with Meta for advertising purposes. Both WhatsApp and Meta appealed against the order before the NCLAT but the order was amended by striking out the five-year restriction and weakening the findings on leveraging without giving adequate reasons for the changes.
THE 2016 BLIND SPOT
The 2021 policy has not come out of nowhere. In 2016, when WhatsApp first introduced data sharing with Facebook, , the CCI closed the case finding no prima facie violation. But that wasn’t the only institutional choice the Commission had. The power to monitor, warn and make precautionary directions on a dominant platform of the scale of WhatsApp without any abuse finding was already there. Rather, the 2016 order essentially validated the structure to be coercive.
This shows a structural issue at the core of it. India’s competition system was reactive, taking action only when damage was done. Unlike the European Union’s Digital Markets Act which takes steps to prevent harm before it can materialise, India has no measure to the same effect, structurally encouraging dominant platforms to take actions first and wait for the repercussions to come later.
THE DIFFERENTIAL PRIVACY ARGUMENT: LEGALLY INCOMPLETE
The most important was that India’s privacy framework was much more limited than for its European users. In the policy , for European users WhatsApp explicitly extended rights to access, rectify, port, and erase whereas it did not do so with Indian users. This discrepancy was noted by the Director General, and was used in his finding of policy discrimination under subsection Section 4(2)(a)(i) of the Competition Act. But to establish the discrimination in a legally binding manner, two preliminary conditions had to be met, and neither of these had been completely clarified.
The first issue relates to the definition of the market. WhatsApp operates in a two-sided market, one for users and one for advertisers, and the degree of competitive harm may differ on each side. While this was acknowledged, the judgment fails to address a critical prerequisite for proving discrimination, that the parties being compared must belong to the same geographic market. If Indian and European users fall under different geographic markets due to varying regulatory frameworks, any comparison of their treatment becomes legally meaningless.
The second condition is of justification. In order to make a discrimination claim, there must be no valid reason for the differential treatment. According to WhatsApp, increased protection in Europe was due to the EU’s GDPR obligations.. However, its voluntary adoption of the same protections for several non-EU jurisdictions after 2018 suggests the lower level of protection to Indian users was a business choice and not a compliance need. This certainly weakens WhatsApp’s defence, but it does not alone meet the legal requirement of Section 4.
These issues were not resolved, leaving the discrimination analysis uncertain in its doctrine. The NCLAT, in turn, interpreted Section 4(2)(a)(i) on a wider interpretation, without affirming or rejecting the discrimination argument on its own. This silence created a gap in the law that was soon to be a confrontation.
WAS THE CCI’S REMEDY SUFFICIENT?
An evaluation of remedial system including Rs. 213.14 crore penalty and the five-year data-sharing restriction, reveals certain limitations. Under Section 27(b), penalties can be up to 10% of the average turnover over a three-year period. Meta has already generated significant revenue, and the fine seems small, indicating that the CCI didn’t make full use of its punitive powers. The order failed to call for disgorgement,, of profit from the wrongdoing, which would have included a repayment of gains resulting from the wrongful action. This decision was heavily focussed on future compliance and did not adequately consider past harm. At the time the order was issued, millions of users had already accepted the 2021 policy, providing Meta with a trove of data from their users. However, the order did not require this data to be deleted, nor did it set any interoperability standards, nor did it operationalize data portability to level the playing field for Meta. This reflects an institutional gap in which remedies are unclear and enforcement is not as effective in addressing actual harm.
NCLAT: REMEDIES LEFT TOOTHLESS
The five-year restriction was removed altogether by the NCLAT, without any proper analysis of its underlying rationale and without offering a new, more robust or alternative remedy, thus undermining the remedial framework in its very structure.
This lack of reasoning creates a jurisprudential gap. The real problem in data-driven markets is the accumulation of data, rather than simply continual activity. When data is incorporated into the advertising systems, limiting future sharing has little remedial value. The NCLAT removed the most direct measure affecting the structural cause of harm by lifting the restriction.
The overall impact of the unreasonable enforcement conclusions and the dilution on appeal is a larger deterrence issue. However, if the dominant firms know that the risks of penalty and of removal of structural remedy on appeal are low, the expense of non-compliance is also predictable and manageable. Under this situation, enforcement can become just another cost of business, and not a serious barrier.
THE LEGISLATIVE RESPONSE AND UNRESOLVED QUESTIONS
India’s Draft Digital Competition Bill, 2024 is a direct reaction to the short-comings identified in this case. It proposes a shift from reactive to preventative regulation with the concept of ex ante regulation of Systemically Significant Digital Enterprises,. Despite this, there are still some questions that remain unanswered.
The first is relating to SSDE designation. For defining an SSDE, the bill demonstrates some quantifiable standards such as revenue, users, and market share, which are in line with the EU’s Digital Markets Act. But data power can build up before the financial power is seen and platforms often get data-rich companies before they’re earning much money. Emerging dominance may not be identified by financial thresholds.
The second relates to regulatory coordination. The Digital Personal Data Protection Act, 2023 sets up a new Data Protection Board, which may lead to the clash of jurisdictions with CCI. For now, there is no formal way in which such interaction is regulated in data-related competition cases, and a lack of a referral process could lead to a fragmented enforcement. These are not defects, but points that need to be improved. Such an action will have a strong bearing on the firmness of India’s efforts towards the proactive regulation of digital markets.
CONCLUSION
The WhatsApp case is not a resolution or a closure. It’s an incomplete reckoning and reveals serious shortcomings in India’s digital competition enforcement framework. While the CCI took a step in the right direction by recognizing privacy violations as a reasonable competition issue, steps without remedy are of little practical value. The NCLAT’s order without any justification to eliminate the five-year restriction turned the enforcement action into a symbolic gesture by the time it had been issued, as data benefits had already firmly entrenched themselves in the marketplace.
The Indian competition regime is not only slow but also structurally goes against markets with dominance that creeps in silently and stealthily. The Draft Digital Competition Bill and the Digital Personal Data Protection Act have the real potential to be transformative, but they are still just aspirational in nature without robust operationalisation. In digital markets, delay is not inefficiency but defeat, and that defeat is never shared as it falls on users alone.
