Meta and WhatsApp Privacy Policy Legal Battle in Indian Courts

Meta Platforms Inc. and WhatsApp approached India's Supreme Court challenging the NCLAT judgment that upheld the ₹213.14 crore penalty. Meta argues the regulator overstepped its jurisdiction, setting the stage for a landmark legal battle over data privacy and competition law.

NCLAT issued its final judgment, overturning the CCI's finding that Meta leveraged dominance in the OTT messaging market to consolidate its position in online display advertising. However, the tribunal sustained the ₹213.14 crore penalty and reinstated user-choice safeguards following CCI's clarification, granting WhatsApp three months for compliance.

The National Company Law Appellate Tribunal temporarily stayed both the ₹213.14 crore penalty and the five-year restriction on data sharing, observing that a categorical ban could materially disrupt WhatsApp's free-service business model.

The Competition Commission of India found that WhatsApp's 2021 privacy policy constituted an abuse of dominance under the Competition Act, 2002, and imposed a penalty of ₹213.14 crore on Meta Platforms. The CCI also mandated remedial directives including prohibition on linking service access to cross-platform data sharing and requirement for clear opt-in and opt-out mechanisms.

Delhi High Court allowed the Competition Commission of India's probe into WhatsApp's privacy policy to proceed despite Meta and WhatsApp's challenges to the CCI's decision to investigate.

A two-judge Bench of the Delhi High Court rejected the petition but directed WhatsApp to delete data of users who chose to delete the application by September 25, 2016.

Karmanya Singh Sareen filed a Special Leave Petition in the Supreme Court of India challenging WhatsApp's privacy policy for violating the right to privacy by sharing user data with Facebook and Meta group companies.

WhatsApp announced a 2021 privacy policy update on a 'take-it-or-leave-it' basis, making data sharing with Meta companies mandatory as a prerequisite for continued service access, departing from earlier policies that allowed user opt-out.