NCLAT: WhatsApp Must Seek User Consent Before Sharing Data With Meta

The National Company Law Appellate Tribunal (NCLAT) on Monday ruled that WhatsApp could not share user data with Meta or its group entities without obtaining explicit user consent, irrespective of whether the data was used for advertising or non-advertising purposes.

The Competition Commission of India (CCI) had approached the NCLAT seeking clarity on its November 4 ruling, which overturned the antitrust regulator's directive barring Meta and WhatsApp from sharing user data with other Meta group firms for advertising purposes for five years.

In its application, the CCI asked the appellate tribunal to clarify whether the privacy safeguards emphasised in the judgment for non-advertising data sharing would also apply to data used for advertising, given the ruling's focus on user consent and privacy.

The regulator sought clarity on whether Meta's data-sharing practices -- for ads or otherwise -- would be subject to the same standards of transparency, strong privacy protections and genuine user consent.

The tribunal has now made it clear that WhatsApp must implement the CCIs directives including providing users with a clear and revocable choice on whether their personal data can be shared with other Meta entities such as Facebook and Instagram.

WhatsApp has been given three months to put the compliance mechanism in place.

The earlier NCLAT judgment had upheld the Rs 213.14 crore penalty imposed on Meta and WhatsApp but left ambiguity over the scope of user-choice safeguards.

The dispute stems from WhatsApp's 2021 privacy policy update, which allowed Meta group companies to access user data for business and advertising purposes.

The CCI took suo motu cognisance of the update following complaints that users were effectively compelled to accept the revised terms to continue using the app.

The regulator concluded that this 'take-it-or-leave-it' approach amounted to an abuse of dominance in the market for over-the-top messaging services and imposed a Rs 213.14-crore penalty on the companies.

In earlier proceedings, the NCLAT upheld the penalty but set aside the CCIs five-year ban on data sharing for advertising, observing that such a blanket prohibition could disrupt WhatsApp's business model.

-- Bhavini Mishra, Business Standard