India’s $25 Million Fine on Meta: Lessons in Competition and Privacy
Abstract
On November 18, 2024, the CCI fined Meta INR 213.14 crore ($25M) for abusing its dominant position through WhatsApp’s 2021 Privacy Policy, which forced users into mandatory data sharing. The CCI ruled this as an unfair condition under the Competition Act, 2002, undermining consumer choice and distorting digital advertising competition.
This paper explores how the CCI’s ruling on WhatsApp’s 2021 Privacy Policy impacts market competition, consumer rights, and data privacy regulations in India. By restricting Meta’s data sharing for five years, the CCI reinforces regulatory scrutiny on tech giants, emphasizing the need for privacy-centric policies and stronger enforcement of competition and data protection laws in India.
Keywords: Competition Law, Data Privacy, Abuse of Dominance, Consumer Rights, Regulatory Enforcement, Digital Economy, Targeted Advertising.
I. Introduction
On November 18th, 2024, the Competition Commission of India (“CCI”) imposed a fine of INR 213.14 crore ($25 million) on social media giant Meta for abusing its dominant position via unfair business practices concerning the WhatsApp Privacy Policy update implemented in January 2021. In January 2021, WhatsApp had notified its users of the updated privacy policy which included an expanded scope of data collection and mandatory data sharing with all Meta Companies and Meta Company Products (“Meta”) on a take-it-or-leave-it basis, removing the earlier opt-out option. The CCI has concluded that the policy update’s compulsory acceptance requirement constitutes an imposition of unfair conditions and an abuse of Meta’s dominant position under India’s Competition Act, 2002 (“Act”).
This article argues that Meta’s imposition of mandatory data-sharing through WhatsApp’s 2021 Privacy Policy update constitutes an abuse of dominance under the Indian competition law regime, highlighting the intersection of data privacy and market competition. It asserts that such practices harm consumer choice, create entry barriers in the digital advertising market, and necessitate stricter regulatory enforcement to ensure a fair and privacy-centric digital economy. This paper is divided into four sections. The first section provides an overview of the CCI’s findings and the legal basis for the fine imposed on Meta. The second section explores the intersection of competition law and data privacy, emphasizing the implications of WhatsApp’s 2021 Privacy Policy update. The third section examines impact of Meta’s practices on the consumer, including reduced agency and trust. Finally, the concluding section discusses the broader lessons for India’s regulatory landscape and the future of the digital economy.
II. CCI’s Analysis
The CCI identified two distinct yet interconnected markets relevant to its analysis– (i) the market for OTT messaging apps through smartphones, a space largely dominated by WhatsApp due to its extensive user base, strong network effects, and high daily and monthly active users and (ii) the online display advertising market which is a critical revenue-generating segment for companies like Meta where access to vast amounts of user data provides a significant competitive advantage. The CCI found that WhatsApp’s 2021 Privacy Policy update imposed unfair and exploitative conditions on users by mandating the acceptance of its data-sharing terms with Meta as a condition for continued use of the app. This policy eliminated the previously available opt-out option, effectively coercing users into sharing their personal data. Given WhatsApp’s dominance in the OTT messaging space, such conduct amounted to an abuse of dominant position, as users had no meaningful choice but to accept the terms if they wished to continue using the platform. The CCI determined that this behavior also violated Section 4(2)(a)(i) of the Competition Act, 2002, which prohibits dominant entities from imposing unfair terms and conditions on consumers.
The CCI determined that Meta’s sharing of WhatsApp user data for purposes other than providing messaging services creates an entry barrier for Meta’s rivals and thus results in denial of market access in the display advertisement market. Furthermore, Meta leveraged its dominance in the OTT messaging app market to reinforce its position in online display advertising, which contravenes Section 4(2)(e) of the Act which prohibits the use of strength or dominance in one market to dominate another market. Beyond its exploitative nature, the policy also had exclusionary effects in the online display advertising market. The CCI concluded that Meta’s ability to access WhatsApp’s extensive user data created an entry barrier for competitors in digital advertising by allowing Meta to refine its targeted ad services in a way that its rivals could not match. This resulted in denial of market access, a direct contravention of Section 4(2)(c) of the Competition Act.
During its investigation, the CCI considered multiple factors in assessing Meta’s dominance, including network effects, lack of countervailing buyer power, data aggregation as an entry barrier, and consumer dependence on WhatsApp as a default messaging platform. The CCI also rejected WhatsApp’s defense that its data-sharing practices were justified under data protection laws, asserting that competition law operates independently of privacy regulations when data control results in anti-competitive harm.
WhatsApp attempted to counter these findings by arguing that it does not operate in a narrow, standalone OTT messaging market but rather in a broad “market for user attention”, which refers to the broad digital ecosystem where different platforms and services compete for users’ time, engagement, and data. In rejecting this argument, the CCI emphasized that OTT messaging services constitute a distinct and separate market from other digital services due to their unique functionality, intended use, and consumer expectations and that WhatsApp operates as a dominant player within the narrower OTT messaging market. The CCI also dismissed WhatsApp’s claim that users could easily switch to alternative platforms like Telegram or Signal, pointing out that network effects, user lock-in, and the widespread adoption of WhatsApp as the default messaging service in India made switching impractical for most users.
Apart from the penalty imposed, CCI also barred WhatsApp from sharing user data with Meta for any advertising purposes for five (5) years from the date of the order. Post expiration of the said period, WhatsApp’s policy should (a) include the details of the data shared with Meta including the purpose of such data-sharing, and (b) not require users to accept WhatsApp’s sharing of user data with Meta as a pre-condition to accept WhatsApp services. Additionally, in case of sharing of WhatsApp user data for purposes other than for providing WhatsApp Services, all users (including the ones who accepted the 2021 update) will have an opt-out option for sharing their data for non-service-related purposes or a prominent settings tab to review and modify data sharing preferences. Additionally, a dedicated settings tab must be introduced to allow users to review, manage, and modify their data-sharing preferences.
III. Intersection of Competition and Data Privacy Laws
The CCI order highlights the critical overlap between Competition Law and Data Privacy Law, particularly in the digital economy. By requiring users to accept mandatory data-sharing terms, WhatsApp not only exploited its dominant position in the OTT messaging market but also undermined principles of informed consent, data minimization and user choice, which constitute key tenets of data privacy. These principles are not merely theoretical as they also form the cornerstone of robust privacy frameworks like General Data Protection Regulation, as well as emerging Data Protection laws in India including the Digital Personal Data Protection (DPDP) Act, 2023.
The DPDP Act, 2023 codifies these principles into the Indian legal framework, reinforcing the importance of informed consent, user choice, and data minimization. Section 6 of the Act mandates that personal data cannot be processed without obtaining explicit and informed consent from the user. Consent must be free, specific, informed, and unambiguous, aligning with global privacy standards. WhatsApp’s “take-it-or-leave-it” approach—forcing users to accept data-sharing with Meta to continue using the app—directly violates the principle of free and specific consent under the Act. Additionally, the absence of an opt-out mechanism further weakens user choice, which the DPDP Act explicitly seeks to protect. Similarly, the DPDPA enshrines the principle of data minimization , which requires that only data necessary for a specific, legitimate purpose be collected and processed. WhatsApp’s broad data collection and sharing for advertising purposes—beyond the scope of messaging services—contravenes this principle. Under the DPDP Act, entities processing personal data must ensure that data collection is limited to what is necessary for the stated purpose, which WhatsApp failed to adhere to.
Under WhatsApp’s updated policy, data including contact lists, metadata, and behavioral patterns are shared with Meta to optimize targeted advertising. WhatsApp’s policy update erodes these principles by combining consent for messaging services with data-sharing practices unrelated to its core service, such as targeted advertising. Users are not given a genuine choice to opt out of these practices. This goes beyond the legitimate purposes of providing messaging services, as defined under principles of data minimization which mandates organizations to only collect and process such data as is absolutely necessary to achieve a specific purpose. Such overreach is a clear violation of privacy principles outlined in global and domestic legal frameworks. While some of this data collection can be justified for providing messaging services, sharing it for targeted advertising raises concerns about the overreach of legitimate purpose. It creates a scenario where user data is shared and monetized in ways the user might neither anticipate nor consent to.
With over two billion users worldwide, WhatsApp has a significant market share in India, dominating the OTT messaging market. This data-sharing arrangement bolsters Meta’s targeted advertising capabilities across platforms like WhatsApp, giving Meta a significant edge over its competitors. Smaller firms in the digital advertising or social networking markets lack comparable access to such vast and integrated data pools, creating an uneven playing field. Meta’s capability to aggregate data from WhatsApp (e.g., user behavior, preferences, and demographics) with information from its other platforms including WhatsApp can result in a comprehensive user profile that competitors cannot replicate. The data-sharing practices raised concerns about whether WhatsApp’s dominance in one market unfairly strengthened Meta’s position in another, thereby distorting competition and harming consumer autonomy. This dual violation underscores the necessity of a harmonized regulatory approach that addresses the unique challenges posed by data-centric business models. The CCI order underscores the need for companies to adopt privacy frameworks that prioritize both user consent and fair market competition.
IV. Impact On Consumers
For Indian users, the mandatory acceptance of the policy results in significant informational asymmetry between service providers and consumers wherein consumers are not fully aware of how their data will be used and a lack of genuine choice as rejecting the policy would mean losing access to a platform integral to everyday communication. By depriving consumers of their right to make informed, autonomous decisions about their data, such practices undermine user agency and consumer welfare. The lack of genuine choice regarding data-sharing affects consumer trust, a critical component and currency of the digital economy.
Meta’s ability to consolidate its dominance across multiple markets—messaging, social networking, and targeted advertising and forcing users in a take-it-or-leave-it situation enables it to fine-tune its advertising algorithm to the consumers. Such practices aid in Meta getting a competitive edge over its competition and could subtly coerce users into choosing Meta’s platforms, thus, limiting the practical choice of alternatives. When users feel coerced into accepting opaque policies, their willingness to engage with digital services diminishes. This not only affects Meta’s competitors but also stifles innovation in the broader tech ecosystem creating a chilling effect where users may become wary of trying new platforms or innovations. For instance, there was a noticeable shift among users from WhatsApp to alternative messaging platforms, both globally and in India when the January 2021 privacy update was announced. While platforms like Signal and Telegram saw a temporary surge in downloads, they struggled to retain users due to WhatsApp’s entrenched position, network effects, and Meta’s vast resources. This shift showed that many people want privacy-focused alternatives, but it also revealed how hard it is for smaller platforms to compete with Meta’s strong position and vast resources.
V. Building a Fair and Trustworthy Digital Future
The legal proceedings are ongoing, with Meta and WhatsApp contesting the CCI’s findings and penalties. The final outcome will depend on the NCLAT’s comprehensive review of the case. The order underscores an increased regulatory scrutiny in the digital and privacy landscape that could influence global tech giants to align their governing policies as per the evolving data protection standards. It serves as a critical reminder of the intersection between data privacy, market competition, and consumer trust. With the increased vigilance, tech giants face mounting pressure to prioritize fairness in their practices and they strive to embrace accountability and user-centric policies to navigate the complexities of the digital age. As India moves towards enacting comprehensive data protection legislation, such rulings may provide a blueprint for addressing the dual challenges of fostering market competition and safeguarding individual rights in the digital age. They also set a precedent for stricter regulatory enforcement, encourage businesses to adopt privacy-first practices, and align India’s digital governance framework with global standards such as the GDPR. With heightened vigilance, tech giants face mounting pressure to embrace fairness and accountability to navigate the complexities of the digital economy. The CCI order serves as a pivotal reminder that in the race for technological dominance, accountability and user trust must remain the cornerstone of the digital economy. Ultimately, empowering users with genuine choice and robust protections will lay the foundation for a more equitable and trustworthy digital landscape.
VI. Conclusion
In concluding, the CCI’s ruling against Meta underscores the intersection of competition law and data privacy, setting a crucial precedent for regulating digital markets. By addressing Meta’s anti-competitive practices and data exploitation, the decision highlights the need for stronger enforcement and consumer protections. As India navigates evolving regulations, this case signals a shift toward greater accountability for tech giants, ensuring a fair, competitive, and privacy-conscious digital economy.
[*Swati Singh is a lawyer based in Mumbai and a graduate of ILS Law College, Pune.]