WhatsApp’s privacy policy and the myth of user choice

On February 3, the Supreme Court posed a question many users have wondered: When WhatsApp says you have a "choice" about sharing data, but the alternative is losing the app entirely — is that really a choice?

This sits at the heart of a five-year legal battle over the messaging app's 2021 privacy policy that has now reached India's highest court, with implications for how democracies regulate digital monopolies.

In January 2021, WhatsApp updated its privacy policy, requiring Indian users to accept expanded data-sharing with Meta companies — Facebook and Instagram — or stop using the app. Unlike a 2016 policy that allowed users to opt out, the 2021 version eliminated the choice.

Also read: What Justice Bhuyan’s remarks on judicial transfers reveal about state of judicial independence

The data includes phone numbers, transaction details, business interactions, and information from websites with WhatsApp features. Users faced what the Competition Commission of India (CCI) called a 'take-it-or-leave-it' ultimatum: accept or leave.

Critically, as the CCI found, even though WhatsApp later announced users wouldn't lose functionality for refusing the update, this "announcement did not withdraw the new terms of service and privacy policy". The 2021 policy remains effective, and crucially, "grants WhatsApp the unilateral right to expand data sharing at any point, without giving any choice to users" — creating what the regulator called "a precarious situation".

The CCI's case

The CCI initiated an investigation on its own in March 2021, concerned that WhatsApp's dominance over 80 per cent of the market gave it unfair leverage. In November 2024, after extensive investigation, the CCI found multiple violations involving both "exploitative" and "exclusionary" abuse — one of the first cases where an Indian regulator imposed liability for both forms simultaneously.

As the CCI found, messaging services exhibit "positive direct network effects" — each additional user makes the service more valuable to existing users. This creates "a tendency towards concentration".

The CCI's analysis was groundbreaking in recognising "privacy as a critical non-price parameter of competition".

Drawing on international precedents — including the European Commission's Facebook/WhatsApp merger decision, Microsoft/LinkedIn merger, Google/DoubleClick assessment, and crucially, the Bundeskartellamt's (Germany's most important competition authority) 2019 Facebook decision — the CCI concluded "there is a consensus behind the idea that competition on privacy can constitute an element of competition".

The CCI found that WhatsApp benefits from powerful "direct network effects" — the value increases as more users join, creating what regulators call a "lock-in effect". When a messaging app reaches a critical size, these network effects make it "very difficult to switch to a new platform", resulting in "high entry barriers" even for technically superior competitors.

Also read: Why Supreme Court is concerned with marriage battles choking its docket

The regulator imposed a Rs 213.14 crore penalty and ordered WhatsApp to provide clear opt-in/opt-out mechanisms with full transparency, banning data sharing with Meta for advertising for five years.

Appellate tribunal's compromise

Meta and WhatsApp appealed to the National Company Law Appellate Tribunal (NCLAT), arguing the CCI addressed potential rather than actual harm and should have awaited India's Digital Personal Data Protection Act.

The NCLAT's November 2025 judgment was nuanced, upholding the penalty but overturning the finding that Meta leveraged messaging dominance into advertising. It lifted the five-year ban, reasoning that such restrictions could collapse WhatsApp's free-to-user model, while maintaining transparency and user-choice requirements.

Importantly, the NCLAT's December 2025 clarification ensured that CCI's safeguards — disclosure, opt-out rights, and purpose limitation — "apply uniformly to both advertising and non-advertising data sharing", closing a potential loophole.

Supreme Court's sharp response

When both sides appealed to the Supreme Court this month, Chief Justice Surya Kant called the privacy policy "a decent way of committing theft of private information". The Bench questioned how ordinary Indians — a fruit seller or domestic worker — could understand complex legal terms.

"What is the choice? You have a complete monopoly and you are saying I am giving a choice. It is either you walk out or we will share the data," he said.

Also read: AI With Sanket | Should WhatsApp be banned in India?

The apex court began dictating an order preventing any data-sharing. Senior advocates requested time to file affidavits. Justice Joymalya Bagchi, also a member of the three-judge Bench, raised a critical issue: unlike European law, India's data protection framework doesn't recognise personal data's economic value.

As the CCI's counsel noted: "Their entire revenue comes from advertising. We are the products. It is free because of that." The court added the Ministry of Electronics and Information Technology (MeitY) as a party and scheduled the final hearing for April 15.

Both the CCI and NCLAT explicitly relied on foreign jurisdictions, particularly the European cases.

The Bundeskartellamt decision (2019)

The CCI cited the Bundeskartellamt's February 2019 Facebook decision as a key precedent for treating privacy as a competition parameter. The NCLAT went further, extensively discussing the 2023 Court of Justice of the European Union (CJEU) ruling in Meta Platforms & Ors. v. Bundeskartellamt (Case C-252/21), which upheld the German regulator's position "on matters of principle".

Also read: India-made messaging app 'Arattai' tops app store charts, overtakes WhatsApp

The CJEU's 2023 Grand Chamber ruling established that "when an undertaking abuses its dominant position, violation of data privacy rules or reduction of privacy by excessive data sharing can form part of the competition law assessment".

The court noted that "the scale of the processing of the data" and its significant impact on users could constitute abuse even without demonstrating concrete anticompetitive effects — potential exclusion suffices.

By October 2024, after years of negotiations, Meta introduced an 'Accounts Centre' giving users a genuine choice about linking accounts across Meta services, and the Bundeskartellamt closed the case with the decision becoming final.

Franco-German joint report

The NCLAT also cited the May 2016 Joint Report by Autorité de la concurrence (of France) and the Bundeskartellamt, which stated: "Privacy issues cannot be excluded from consideration under competition law simply by virtue of their nature."

The report noted that privacy policies "could be considered from a competition standpoint whenever these policies are liable to affect competition, notably when implemented by a dominant undertaking for which data serves as a main input".

Europe's Digital Markets Act

The EU's 2023 Digital Markets Act (DMA) designates seven "gatekeepers" and prohibits combining personal data across services without clear, freely given user choice. Meta's 'Consent or Pay' model violated the DMA.

In April 2025, Meta was fined Euro 200 million. The European Commission ruled that users must have a free, less-personalised alternative. By December 2025, Meta announced a new option using substantially less data, rolling out to EU users in January this year.

Economics of digital dominance

The CCI's economic analysis revealed how digital markets differ fundamentally from traditional industries:

Network effects create natural monopolies: As the CCI found, messaging services exhibit "positive direct network effects" — each additional user makes the service more valuable to existing users. This creates "a tendency towards concentration" where "the dominant platform" enjoys compounding advantages. "The greater the switching costs, and thus, the higher the value" the platform extracts.

Also read: Maharashtra govt employee loses Rs 1.9 lakh to WhatsApp wedding card scam

Data as competitive advantage: The CCI noted that combining WhatsApp, Facebook, and Instagram data enables advertising targeting competitors that cannot match, "creating entry barriers" and resulting in "denial of market access". This is precisely what the German and European regulators also found — data aggregation isn't just about privacy, it's about competitive foreclosure.

The 'free' service model: The CCI rejected arguments about "zero-price markets", finding that "users provide non-monetary consideration through personal data". As Justice Bagchi noted, European law recognises data's economic value — but India's framework doesn't yet. When services are 'free', privacy becomes the price, yet users have no way to know its value.

Drawing on international precedents, the CCI concluded "there is a consensus behind the idea that competition on privacy can constitute an element of competition".

The consent illusion: The CCI found the 2021 policy "used vague and broad language, allowing WhatsApp to expand data collection at any time". Even if users theoretically could refuse, the reality is that "when a messaging app reaches a critical size", the strong network effects make it challenging to switch. This is what the Supreme Court meant by questioning whether monopolists can claim to offer "choice".

Privacy as competition

The CCI's approach represents what legal scholars call the "integrative approach" — recognising that in digital markets, privacy and competition are inseparable. As the regulator noted, "increased data collection or broader data sharing can be considered a reduction in the overall quality of service".

This matters because traditional competition law focused on price. But as the NCLAT observed, "in the context of digital services, where many offerings are provided at zero monetary cost, consumers tend to place substantial importance on non-price factors, such as the degree of privacy protection, data security, and transparency of data practices."

Also read: TTD launches WhatsApp-based feedback system for devotees

When WhatsApp reduces privacy protections, it's not just a privacy violation — it's a quality reduction that harms consumer welfare, similar to a manufacturer using inferior materials. This is the breakthrough insight that both German and Indian regulators embraced, and that European law has now codified through the DMA.

What's next, what it means

The Supreme Court will consider interim relief on February 9, potentially restricting data use pending final judgment on April 15. The court's tough stance suggests it may go further than lower authorities.

Whatever the decision, several precedents are already established: dominant platforms cannot hide behind 'consent' when users lack realistic alternatives; competition authorities can examine data practices as part of antitrust mandates; 'free' services' hidden costs warrant regulatory scrutiny; and global platforms need region-specific approaches.

The fundamental question transcends WhatsApp: In a world where a handful of companies mediate human communication and commerce, who sets the rules? For decades, companies wrote terms and users either accepted or excluded themselves from digital life. This case challenges that arrangement, asserting that essential infrastructure requires constraints proportional to power.

The outcome will help determine whether the digital age's winner-take-all dynamics are natural law or policy choice — and whether users get genuine say in data use or merely the illusion of choice the Supreme Court so pointedly questioned. For 500 million Indian WhatsApp users and billions worldwide, the answer couldn't matter more.