WhatsApp, the popular messaging platform owned by Meta Inc., on Monday (February 23) told the Supreme Court that it will comply with directions requiring it to give users greater control over how their data is shared with other Meta companies.This is even as the court clarified that it will continue to hear WhatsApp’s main appeal challenging a Rs 213.14 crore penalty imposed by the regulator Competition Commission of India (CCI) over the platform’s 2021 privacy policy.The bench led by Chief Justice of India Surya Kant permitted WhatsApp and Meta to withdraw their interim applications seeking a stay of the National Company Law Appellate Tribunal’s (NCLAT) user choice safeguards, after the company said it would implement them within the timeline set by the tribunal.The case pertained to WhatsApp’s 2021 policy update, which made acceptance of expanded data sharing mandatory to continue using the app. There was no option to opt out: users had to either agree to the terms or lose access to it.While CCI had held that this amounted to an abuse of dominance and imposed the penalty, NCLAT upheld the fine but rejected the regulator’s finding that Meta had leveraged WhatsApp’s dominant market position to protect its advertising business.Meta and WhatsApp now argue that once this finding was set aside, the penalty cannot stand. The Supreme Court will now examine this question. We explain how the case has unfolded so far.In January 2021, WhatsApp rolled out an updated privacy policy that expanded the scope of data sharing with other Meta entities. Users were informed that accepting the new terms was mandatory to continue using the service. Story continues below this adUnlike an earlier 2016 update, which allowed existing users to opt out of data sharing for advertising, the 2021 policy offered no such choice.Also read | CCI vs WhatsApp is a pivotal battle for India’s digital spaceThe binary choice — between accepting the new terms or risk losing access to a service that had become one of the default modes of communication for millions of users in India — became a central legal problem.What the Competition Act saysThe Competition Act, 2002, intervenes when a firm or company that already enjoys market power uses that position in a way that harms users or distorts competition.Section 4 addresses “abuse of dominance”. While dominance itself is not illegal, abuse is. Abuse may take different forms. It may be exploitative, where users face unfair conditions. Or it may be exclusionary, where rivals are pushed out or prevented from entering the market.Story continues below this adDigital platforms complicate this analysis because price is rarely the currency. Messaging apps, search engines, and social networks are often offered at zero monetary cost. But regulators increasingly recognise that users pay through data. In this setting, privacy and control over personal information function as markers of service quality. It was against this understanding of dominance and abuse that WhatsApp’s 2021 policy update came to be examined.CCI steps in — and what it foundIn March 2021, CCI took suo motu cognisance of the update and ordered an investigation under Section 26(1) of the Competition Act. The regulator flagged concerns that WhatsApp, given its scale and network effects, was forcing users to accept expanded data sharing as a condition for continued access.WhatsApp challenged the investigation before the Delhi High Court, arguing that the issue belonged to the domain of privacy and data protection, not competition law. The court disagreed. Both the single bench in April 2021 and the Division Bench in August 2022 allowed the probe to continue, holding that competition law scrutiny is not excluded merely because the same conduct also raises privacy concerns. The court noted that Section 26(1) direction only triggers an investigation and does not impose penalties.Story continues below this adWhen CCI examined WhatsApp’s 2021 privacy policy, it was dealing with a market where users do not pay money but are deeply locked in. Messaging apps rely on network effects: the value of the service depends on how many others use it. Leaving a platform like WhatsApp often means persuading an entire contact list to move, which is rarely feasible.Also read | Meta faces new lawsuit over WhatsApp privacy, security claims: What are the allegations?Against this backdrop, CCI examined how WhatsApp’s data practices intersect with market power. In its November 2024 order, it identified two markets: “Market for OTT messaging apps through smartphones in India; and Market for online display advertising in India.” CCI held that WhatsApp was dominant in the messaging market, pointing to the size of the user base and the difficulty of switching platforms without persuading an entire contact network to move.‘Take it or leave it’Its concern was not data sharing in the abstract, but the absence of choice. It found that the 2021 update imposed unfair conditions on users by making expanded data sharing mandatory for continued access. Calling it a “take-it-or-leave-it” arrangement, it left users with no real choice. Because privacy functions as a non-price parameter of the competition in zero-price markets, the commission said that “increased data collection or broader data sharing can thus be considered a reduction in the overall quality of service”.Story continues below this adIt also examined the downstream effects of this data flow. It held that sharing WhatsApp user data with Meta companies for purposes beyond providing the messaging service distorted competition in the advertising market. The ability to combine WhatsApp data with Facebook and Instagram datasets created entry barriers for competing advertisers, and platforms could not realistically overcome them.On this basis, CCI held that Meta had used its position in messaging to protect its strength in advertising. It said, “Meta has engaged in leveraging its dominant position in the OTT messaging apps… to protect its position in the online display advertising market.” This, it said, reflected both exploitative harm to users and exclusionary harm to rivals.Besides imposing a penalty of Rs 213.14 crore, CCI issued a five-year ban on sharing WhatsApp data with the Meta company for advertising purposes, mandatory disclosures of what data is shared and for what purpose, and an opt-out mechanism for non-essential data sharing.What NCLAT saidOn appeal, NCLAT largely accepted CCI’s approach to market definition and dominance. It upheld that WhatsApp had imposed unfair conditions on users, and that cross-platform data sharing resulted in denial of access to the market. The penalty imposed was also sustained, with NCLAT finding CCI’s calculation method to be reasonable.Story continues below this adBut NCLAT also set aside two aspects of CCI’s order. It removed the finding of unlawful leveraging under Section 4(2)(e), stating that the reasoning, as framed, could not be sustained given that Meta and WhatsApp are separate legal entities.It also struck down the five-year ban on advertising-related data sharing, saying that once users are given a genuine revocable choice to opt in or opt out, a blanket prohibition becomes unnecessary. The emphasis, it said, must remain on restoring user choice rather than freezing data flows altogether.Also read | WhatsApp privacy risk? How researchers scraped data, profile pics from crores of Indian usersAfter NCLAT’s judgment, CCI returned to it seeking clarification on setting aside the advertising ban. The concern was that this could be read as exempting advertising-related data sharing from transparency and consent safeguards.In December 2025, NCLAT closed that gap. It clarified that “the remedial directions… will apply to WhatsApp user data collection and sharing for all non-WhatsApp purposes, including non-advertising and advertising purposes”. It underscored that once data originates from WhatsApp users, user rights attach to it regardless of how Meta deploys it. WhatsApp was given three months to comply with these safeguards.Privacy under competition lawStory continues below this adOn privacy, both CCI and NCLAT rejected the argument that privacy concerns fall outside competition law. CCI said that “data protection and privacy laws focus on maintaining transparency and securing individual rights… Competition law, on the other hand, addresses the impact of data on market power”. The two can operate in different domains and can apply to the same conduct.This overlap becomes significant in services that do not charge money. When a platform is free to use but difficult to leave, loss of control over personal data (and thus, privacy) can amount to harm even without a price increase. “The notion of ‘zero price’ is a misnomer as consumers end up paying with data instead of money,” CCI said.