Aryan Tiwari is a 3rd year B.Sc. LL.B. (Hons.) student, at the National Law Institute
University, Bhopal and Divyansh Jatwar is a 3rd year student at Hidayatullah National Law
University, Raipur.
Introduction
The National Company Law Appellate Tribunal (NCLAT) judgment Dated 4 November, 2025 in WhatsApp LLC and Meta Platforms, Inc. v. Competition Commission of India presents a landmark moment in how India addresses powerful digital companies that rely heavily on user data. In this case, the Tribunal reviewed an order passed by the Competition Commission of India (CCI), which had tried to restrict WhatsApp and Meta from sharing user data for advertising for five years. This prohibition raises fundamental questions about the scope, proportionality and enforceability of behavioural remedies in zero-price digital markets. The Tribunal set aside this restriction and its nuanced approach signals a significant development in how Indian competition law addresses data-linked dominance. This, we contend, leaves a significant remedial gap in India’s digital competition framework that neither the existing Competition Act nor the proposed Digital Competition Bill adequately addresses.
This article examines the NCLAT judgment through three critical lenses: (1) the scope of institutional competence can competition regulators address privacy harms? (2) remedial proportionality when are behavioural remedies excessive? and (3) the relationship between competition law and data privacy regulation how should these frameworks operate together?
The Evolution of WhatsApp Privacy Litigation
The controversy began when WhatsApp announced its 2021 privacy policy update on 4 January 2021, it quicklybecame the subject of public concern. Unlike its 2016 update which had been challenged before the Delhi High Court, and the 2021 version proposed much broader data-sharing between WhatsApp and other Meta companies includingFacebook and Instagram. Simultaneously, three separate procedural pathways emerged:
Firstly, the user approached the Supreme Court seeking to stay the 2021 policy under Article 21,[1] which protects the fundamental right to privacy, relying on the Puttaswamy judgment, user argued that WhatsApp expanded data-sharing amounted to an unconstitutional intrusion into users personal information.
Secondly, the Internet Freedom Foundation and others approached the Supreme Court in the already pending Karmanya Sareen petition (originally challenging the 2016 WhatsApp policy), seeking an interim injunction on the 2021 update, contending its data-sharing terms were more intrusive than the 2016 version.
Thirdly, on 24 March 2021, the CCI initiated a suo motu investigation under Section 26(1) of the Competition Act, 2002, noting that WhatsApp 2021 policy could amount to an abuse of dominance by compelling users to accept unfair data terms.
The convergence of these three proceedings constitutional, competition, and (prospectively) data protection reveals a deeper structural challenge in India digital governance. When a single corporate action (a privacy policy update) simultaneously engages constitutional courts, competition regulators and data protection authorities. The absence of a coordination mechanism between these institutions creates risks of regulatory fragmentation and forum shopping. This institutional overlap is not merely procedural but substantive it affects the coherence and predictability of India’s digital regulation.
CCI Jurisdiction and the High Court Deference
WhatsApp attempted to block the CCI investigation before the Delhi High Court. This challenge tested the institutional boundaries between competition law and privacy law The Division Bench’s order of 25 August 2022 was decisive; it held that the CCI possessed jurisdiction to investigate competition-related effects of WhatsApp data-sharing policy.
The Supreme Court, examining privacy under Article 21, is concerned with whether a private action violated constitutional guarantees.[2] The CCI, examining conduct under Section 4 of the Competition Act, evaluates whether market power has been leveraged to impose unfair competition. The Division Bench specifically noted that the CCI was examining the 2021 Policy purely through the prism of the Competition Act in exercise of its statutory mandate as the authority responsible for enforcing Section 4 of the Competition Act, as the regulator responsible for preventing abuse of dominance.[3]
The High Court allowing the parallel CCI proceedings could potentially create a conflicting standards. For instance, the Data Protection Board (DPB) under Section 28 of the DPDP Act, 2023 is specifically mandated to adjudicate violations of informed consent (Section 7) and lawful processing (Section 4). The CCI, in concluding that WhatsApp take-it-or-leave-it policy was an unfair condition under Section 4(2)(a)(i) of the Competition Act, essentially made a parallel determination on the validity of consent. This is a direct regulatory overlap. Without a clear rule which authority hasfinal say on consent, different authorities can reach opposite conclusions and platforms can easily use that to their benefit.
This jurisdictional overlap exposes a critical gap in digital regulation. The DPDP Act, 2023 does not contain any provision establishing primacy over or coordination with the Competition Act in matters involving data practices of dominant platforms. Similarly, the Competition Act lacks a deference mechanism for privacy-specific determinations. A possible solution would be the introduction of a statutory consultation protocol similar to the memorandum of understanding between the European Commission and national data protection authorities requiring the CCI to consult the DPB before making findings that substantively engage with consent and data processing standards.
The CCI’s Investigation and Final Order
In its order dated 18 November 2024, issued after a detailed three-year investigation, the CCI identified two relevant markets:
- the market for OTT messaging services accessed through smartphones in India, and
(2) the market for online display advertising in India.
This delineation reflected careful attention to demand-side (whether users can easily switch to alternatives) and supply-side interchangeability (whether service providers can readily enter or shift into the market). The CCI chose not to use broad market definitions like the user attention market or the consumer communication services market, which would have grouped WhatsApp with everything from OTT apps to email, SMS, and social media.
The CCI market definition was methodologically sound. By defining a narrow market for OTT messaging services on smartphones, the CCI avoided the dilution of WhatsApp market share that would have resulted from a broader definition. This approach aligns with the European Commission’s methodology in Google Shopping (Case AT.40099, 2017), where narrow market definition was instrumental in establishing dominance. However, the narrowness of the market definition also invites criticism: it arguably overlooks the competitive constraints imposed by platforms such as Telegram, Signal, and even Instagram Direct, which serve overlapping communicative functions.
The Unfair Conditions Violation: Section 4(2)(a)(i)
The CCI found that WhatsApp had imposed unfair conditions on users in violation of Section 4(2)(a)(i) of the Competition Act. The 2021 privacy policy, forced users with a take-it-or-leave-it choice either accept data-sharing or lose functionality. WhatsApp warning of account deletion, reflecting its dominant position and users dependence on the platform. .
The CCI specificallycriticized this as a concern of the absence of meaningful opt-out mechanisms. Unlike the 2016 policy which allowed a 30-day window for users to withhold consent, the 2021 offered no such option to new users , nor did it sustain the earlier opt-outs for existing users. This resulted in a clear imbalance of bargaining power, compounded by significant information asymmetry and an absence of genuine user choice.
The CCI concluded that these practices amounted to exploitative abuse by a dominant enterprise, as users were compelled to accept intrusive data-sharing terms to continue using a communication service. The order not only protected the user choice not to share their data but also restricted Meta to create a monopolies by utilizing the data. By including privacy as a competition parameter.
The CCI finding of exploitative abuse under Section 4(2)(a)(i) represents, a doctrinally significant application of competition law to data practices. Traditionally, exploitative abuse has been assessed through pricing metrics excessive pricing, discriminatory pricing and similar quantitative indicators. By extending exploitative abuse to encompass qualitative degradation of privacy terms, the CCI has effectively expanded the conceptual boundaries of Section 4(2)(a)(i) to accommodate the realities of zero-price digital markets.
NCLAT Appellate Review
The NCLAT judgment, spanning184 pages, addressed approximately 17 distinct categories, starting with procedural points and ending with whether WhatsApp abused its dominance and whether the CCI remedies were proportionate. Notably, the Tribunal did not reject the CCI jurisdiction; rather, it reaffirmed that competition law and privacy law operate in complementary spheres, each examining different aspects of WhatsApp’s conduct.
On the core question of whether the CCI exceeded its jurisdiction by engaging with privacy and consent issues, the Tribunal held that the CCI examination was permissible because it focused on competitive effects as privacy operates as a non-price factor in digital markets.
The Tribunal upheld the ₹213.14 crore penalty, affirming the CCI finding that WhatsApp‘’s conduct violated Section 4(2)(a)(i). It also upheld the behavioural directions requiring detailed disclosure of data collection and sharing purposes.
Setting Aside the Five-Year Advertising Ban
The Tribunal’s most significant departure from the CCI’s order came in striking down five years advertising plan, which prohibited WhatsApp from sharing user data with Meta companies. The Tribunal’s reasoning turned on two grounds:
On causation, the Tribunal found that the CCI had not adduced sufficient empirical evidence demonstrating that WhatsApp used user data for advertising purpose.
On proportionality, the Tribunal observed that an absolute five-year prohibition on a business practice that had been ongoing since the 2016 policy “may lead to the collapse of the business model which has been followed by WhatsApp LLC”.
The NCLAT requirement for direct empirical evidence of data use in advertising ignores the integrated nature of Meta business. The CCI order noted that the parent company Facebook uses dataexplicitly to promotes the use of WhatsApp Business data for targeted ads on Facebook and Instagram. By stating this as insufficient and citing the business model defence, the Tribunal has erred in properly assessing the evidence. It has created a rules that a competition authority must show internal, real-time data often a trade secret document to prove harm, making it nearly impossible restrict data aggregation by dominant players.
The argument that insufficient empirical evidence and prohibiting data-sharing would collapse WhatsApp business model implicitly accepts that the business model is itself lawful and worthy of protection. But this begs the very question that competition enforcement seeks to answer: if the business model depends on conduct that constitutes abuse of dominance, the model itself cannot serve as a justification for continuing that conduct. The European Court of Justice, in Google Shopping (Case C-48/22 P), rejected a similar argument, holding that the commercial success of a business model does not immunise it from competition scrutiny.
Privacy as a Competition Parameter: The NCLAT Doctrinal Contribution
The NCLAT reasoning treated privacy as a competition parameter in zero-price digital markets. Traditional competition involves price and quality, but digital platforms monetize user attention and data. Users pay through data and surveillance tolerance. The Tribunal held that when a platform weakens privacy protections, it effectively reduces the quality of the service. WhatsApp had built its user base by promising secure, encrypted, privacy-preserving messaging, then unilaterally expanded data collection.[4] By answering affirmatively, the Tribunal has provided the CCI with a foundation for investigating data practices of dominant platforms without requiring proof of price-based harm a requirement that would be inherently impossible to satisfy in zero-price markets. However, this doctrinal advance carries its own risks. If privacy becomes a routinely invoked competition parameter, the CCI may find itself making quasi-privacy determinations that duplicate or contradict the Data Protection Board’s mandate under the DPDP Act, 2023.
By framing privacy as part of service quality, the NCLAT positioned privacy within established competition doctrine without amending the Competition Act. The tribunal simply clarified that privacy is one of those quality dimensions in data-driven markets.
Complementarity Between Competition Law and Data Privacy Regulation
The Tribunal’s significant doctrinal contribution articulated privacy law and competition law as complementary frameworks. Privacy laws like the SPDI Rules and DPDP Act safeguard individual data subject rights through informed consent and access provisions. Competition law addresses whether dominant firms misuse data to distort markets, foreclose rivals, or impose unfair conditions. Both frameworks operate simultaneously, answering different regulatory questions within India’s digital governance ecosystem.
Privacy law asks “Is this data use lawful under privacy statutes?” Competition law asks: “Does this conduct exploit dominance and unfairly harm consumer choice or fair competition?” A data practice might violate both regimes (for ex: deceptive consent-seeking that is both unfair under privacy law and exploitative under competition law) or violate only one (for ex: a dominant platform’s transparent but commercially unreasonable terms that breach competition law but comply with privacy requirements).
The CCI Clarification Application
The CCI application, pending before the NCLAT as of December 2025, carries substantial implications. If the Tribunal clarifies that identical safeguards apply across use-cases, it could suggest that privacy protections flow from the dominance-based coercion itself, not from specific data uses. This would reinforce the principle that competition law can address privacy-linked harms irrespective of downstream purposes.
Conversely, if the Tribunal maintains a distinction, drawing back from the five-year ban while retaining consent safeguards, it may signal that the core abuse lies in imposing data-sharing as a service condition, not in data-sharing itself. Under this view, once users can opt out and understand the terms, competition concerns diminish, even if advertising leverages the data.
The NCLAT as an Appellate Forum for Digital Regulation
The NCLAT role deserves attention. Unlike the National Company Law Tribunal (NCLT), which hears company law and insolvency matters, the NCLAT serves as the sole appellate body for CCI decisions under Section 53-A of the Competition Act.[5] This structure reflects the Parliament’s decision to create specialized appellate expertise for competition matters rather than routing appeals through High Courts
International Approaches: Ex-Ante Versus Ex-Post Regulation
The European Union’s Digital Markets Act designates large online platforms as “gatekeepers” and imposes predefined conduct obligations without requiring proof of harm in individual cases. The United States, historically reliant on ex-post (after a rule or law has been violated) enforcement through the Sherman Act, has recently proposed rule-based obligations for large digital platforms.
India’s hybrid model ex-post (prevent failures before they happen) enforcement through the Competition Act, supplemented by proposed ex-ante regulation through the Digital Competition Bill(Draft), sits between these poles. The Bill contemplates obligations analogous to those the CCI ordered. These include interoperability requirements, restrictions on exclusive data uses, and algorithmic transparency mandates. This represents a shift from ex-post enforcement to ex-ante regulation.
The WhatsApp-Meta case powerfully illustrates why ex-ante regulation may be necessary to supplement ex-post enforcement in digital markets. The CCI investigation took over three years from initiation (March 2021) to final order (November 2024), followed by further appellate proceedings. During this period, WhatsApp’s 2021 privacy policy remained in effect, and data-sharing with Meta continued uninterrupted. Even assuming the CCI’s order had been fully upheld, the accumulated competitive advantage from three years of unchallenged data aggregation cannot be retrospectively undone. This temporal mismatch between the pace of digital market dynamics and the pace of ex-post competition enforcement underscores the case for ex-ante obligations such as those contemplated in the Draft Digital Competition Bill that prevent data-related abuses before they occur rather than seeking to remedy them years after the fact.
Conclusion
The NCLAT’s judgment in WhatsApp–Meta is a well-developed integration of competition law with the realities of digital markets. It recognizes that privacy is a genuine non-price parameter of competition in zero-price services, and that a dominant firm can exploit its position not only through pricing but also through its data practices. The Tribunal also clarified that competition authorities can address privacy-related competitive harms without having to decide whether a platform has violated privacy laws. Together, these principles create a coherent guiding principle for scrutinizing data-driven monopolies within the boundaries of the existing Competition Act. The judgment shows that competition law and privacy law will now grow together, with each shaping how the other develops. By demanding impossible evidence and defence of the business model, it leaves the CCI with onlymonetary penalties and disclosure mandates remedies that do not restore user choice. The way courts and regulators deal with this issue in upcoming case will decide how digital rights are protected for hundreds of millions of people in India.
Keywords: Competition Law, Data Privacy and Digital Markets.
[1] The Constitution of India, 1950 (26 of 1950) art 21.
[2] Justice K.S. Puttaswamy (Retd.) and Anr v Union of India and Ors, Writ Petition (Civil) No 494 of 2012, (2017) 10 SCC 1 (SC).
[3] WhatsApp LLC v Competition Commission of India 2022 SCC OnLine Del 1436 (Del HC, 25 August 2022).
[4] WhatsApp, ‘Privacy Policy (EEA)’ (WhatsApp) https://www.whatsapp.com/legal/privacy-policy-eea accessed 11 December 2025.
[5] The Competition Act, 2002 (12 of 2003) s 53A.