The National Company Law Appellate Tribunal (NCLAT) on Monday clarified that WhatsApp must take user consent before sharing data for both advertising and non-advertising purposes.
A bench led by NCLAT chairperson Justice Ashok Bhushan allowed the Competition Commission of India’s (CCI) plea seeking clarity on the scope of the tribunal’s 4 November ruling. The tribunal made it clear that user consent is mandatory for all the data that WhatsApp collects and shares with it parent company Meta, not just the data used for advertising.
Earlier, the NCLAT had upheld the CCI’s finding that WhatsApp’s 2021 privacy policy relied on coerced consent, forcing users to accept data sharing or lose access to the service. However, there was confusion over whether this consent requirement applied only to advertising data or to all data practices. The tribunal clarified on Monday that the CCI’s corrective directions apply across the board.
The NCLAT also said that WhatsApp will have three months to comply, as provided in the original order. During the hearing, WhatsApp’s lawyers sought more time, arguing that making system-level changes would be a large and complex task. While the tribunal was initially inclined to allow only one month, it ultimately allowed three months, as already granted earlier.
Meta and WhatsApp opposed the CCI’s plea, arguing that the earlier judgement was clear and needed no clarification. They claimed that data sharing through optional advertising features already respected user choice and that the CCI was trying to impose new obligations.
The tribunal rejected this argument, saying the key issue is user choice at the point where data is collected and shared. It ruled that any non-essential or advertising-related data sharing can take place only with a user’s clear and revocable consent, with the option to opt in or opt out at any stage.
The NCLAT noted that WhatsApp cannot claim open-ended rights over user data, and that restoring opt-in and opt-out choices removes the coercive “take-it-or-leave-it” nature of the 2021 policy.
WhatsApp's 2021 privacy policy update
The issue stems from the NCLAT’s 4 November judgment in the WhatsApp-CCI case, in which the tribunal partly upheld the CCI’s ₹213.14 crore fine on Meta Platforms and WhatsApp over the 2021 WhatsApp privacy policy update. The CCI had deemed the policy to be exploitative and exclusionary. However, the appellate tribunal set aside the CCI’s five-year ban on WhatsApp sharing user data with Meta companies for advertising purposes.
According to the CCI’s understanding of the judgement, the NCLAT emphasised the primacy of user consent and indicated in several parts of the order that consent was required irrespective of whether the data was used for advertising or other purposes.
The regulator, however, pointed to ambiguity in the concluding portion of the judgement. In paragraph 264, the tribunal set aside paragraph 247.1 of the original CCI order while upholding paragraph 247.2. According to the CCI, this effectively mandates user consent for data sharing for non-advertising purposes, while remaining silent on whether consent is required for advertising-related data sharing.
It therefore approached the tribunal, asking it to clarify that its 4 November order makes user consent mandatory irrespective of whenever WhatsApp shares user data with other Meta entities for advertising or non-advertising purposes.
‘No abuse of dominance’
In its 184-page judgement, the NCLAT observed that cross-platform data sharing between WhatsApp and Meta strengthened Meta’s position in the online display advertising market and created entry barriers for competing digital advertising firms that did not have comparable access to WhatsApp user data.
At the same time, the tribunal held that the CCI’s ruling that Meta had violated Section 4(2)(e) of the Competition Act was not sustainable, saying it could not be conclusively established that Meta had leveraged WhatsApp’s dominance in the over-the-top (OTT) messaging market to protect or extend its dominance in the online display advertising market, particularly since WhatsApp and Meta were separate legal entities. Section 4(2)(e) prohibits a dominant enterprise from using its strong position in one market to enter, protect, or strengthen its position in another distinct market.
The case dates back to November 2024, when the CCI fined Meta ₹213.14 crore in relation to WhatsApp’s 2021 privacy policy update. Meta and WhatsApp challenged the order before the NCLAT, which in January 2025 granted them interim relief by staying the five-year ban on data-sharing between WhatsApp and Meta for advertising purposes.