JSA Prism | Competition & Data Privacy

Please click here to download the Prism as a PDF.

Competition Commission of India holds that the other parallel data privacy regulations do not curtail its power over competition law related issues in data driven digital industries

The Competition Commission of India (“CCI”) order against Meta Platforms, Inc. (“Meta”) and WhatsApp LLC[1] (“WhatsApp”) assumes significance as it throws light on how the data-related practices of the digital platforms including treatment of privacy rights will be viewed from the competition law perspective in India. This order represents the continuous evolving nature of competition law jurisprudence in the digital space, particularly in the data driven economy. From a data privacy perspective, this order reinforces the growing trend among regulators, both in India and globally, of treating data collection, user autonomy, and consent mechanisms as central not only to privacy regulation but also to digital competition.

Brief facts

Based on certain media reports and information(s) filed before the CCI, the CCI formed a prima facie view and directed the office of the Director General (“DG”) to investigate into WhatsApp’s 2021 policy which made it mandatory for the users to accept the terms and conditions in order to retain their WhatsApp account information and allowed sharing of personalised user information with Meta group companies and third parties (“WhatsApp 2021 Policy”).
Based on its investigation, the DG in its report, delineated 2 (two) relevant markets, as set out below:
- markets for Over-The-Top (“OTT”) messaging apps through smartphones in India; and
- market for online display advertising in India.
The DG found that Meta operating through WhatsApp and Messenger hold a dominant position in the market for OTT messaging apps through smartphones in India. According to the DG, Meta (through WhatsApp) contravened Sections 4(2)(a)(i), 4(2)(c) and 4(2)(e) of the Competition Act, 2002 (as amended) (“Competition Act”), in relation to the 2 (two) relevant markets delineated above.
After hearing the parties, on November 18, 2024, the CCI endorsed the markets delineated by the DG and held that the WhatsApp 2021 Policy mandating users to accept its privacy policy and terms of service amount to abuse of dominant position in both the relevant markets (“Meta Order”).
Accordingly, the CCI imposed a penalty of INR 213.14 crore (Indian Rupees two hundred and thirteen crore fourteen lakh) on Meta and WhatsApp and directed them to implement certain behavioural remedies, including, providing an ‘opt-out’ option to the WhatsApp users in case their data is to be shared for purposes other than for providing WhatsApp related services. Further, WhatsApp was directed to not share user data collected on its platform with other Meta companies or Meta company products for advertising purposes for a period of 5 (five) years from the Meta Order.

Findings of the CCI

CCI’s jurisdiction on data protection and privacy norms

The CCI considered WhatsApp’s preliminary objection arguing that the investigation and the alleged violation of the Competition Act are based on the DG’s conclusion of a breach of data protection and privacy norms, which is outside of the scope of the Competition Act.
The CCI emphasised the need for competition authorities to monitor and address anti-competitive behaviour in data-driven markets stating that data protection and privacy laws are different from competition law. The CCI further highlighted that data protection and privacy laws focus on maintaining transparency and security for individual rights, while competition law addresses the impact of data on market power and preventing dominant firms from exploiting their data advantage to the detriment of competition and consumer welfare. Accordingly, the CCI rejected the maintainability related argument of WhatsApp and sent a clear signal of jurisdiction over privacy issues.
Clearly, while the Digital Personal Data Protection Act, 2023 (“DPDP Act”) places consent, purpose limitation, and data minimisation at its core, the CCI’s approach reinforces that privacy is not only a matter of individual rights but also a structural condition of fair market conduct.

Market for OTT messaging apps through smartphones in India

Relevant market:
- The CCI observed that the definition of relevant product market implies that products and services should be considered part of the same market only if consumers regard them as direct substitutes and, in this context, different digital services like social media platforms, streaming services, and search engines do not necessarily serve the same consumer needs or provide the same functionality.
- The CCI further observed that the users engage with WhatsApp, Facebook, Netflix, X, etc., for distinct purposes i.e., communication, social interaction, entertainment, micro-blogging, etc. Given that the OTT messaging apps like WhatsApp are primarily designed for smartphones providing seamless and instant messaging capabilities, the CCI held that the said services including that of Zoom, etc. cannot be considered interchangeable or substitutable with OTT messaging apps. Accordingly, the CCI concluded that the device segmentation including defining the market basis smartphones is also required to accurately assess the competitive landscape and Meta’s position in such market.
Alleged dominance: The CCI found Meta group (through WhatsApp) to be dominant in the market for OTT messaging apps through smartphones in India, based on different factors such as Meta’s (including group companies) significant financial resources, Daily Active Users (DAUs), Monthly Active Users (MAUs), direct as well as indirect network effects, dependence of the consumers on WhatsApp as a primary communication tool, strong lock-in effects, absence of countervailing buying power and control over huge data acting as barriers to market entry.

Market for online display advertising in India

Relevant market: The CCI assessed the presence of Meta, focusing on advertising as its primary revenue generation activity. It examined various advertising modes and market dynamics to identify competitive constraints on Meta. The CCI rejected Meta’s argument that offline and online advertising are part of the same relevant market and that search and display advertising are interchangeable. Accordingly, the CCI endorsed the relevant market as the ‘market of online display advertising in India’, as delineated by the DG.
Alleged dominance: Meta argued that the DG did not find Meta to be a dominant player in the alleged ‘market for online display advertising in India’. In this regard, the CCI formed a view that there is no statutory or technical requirement that an enterprise must hold dominance in the market where the denial of market access is alleged. The CCI further observed that particularly in multi-product ecosystems like Meta’s, services are closely integrated in terms of functionality, data and target groups and a dominant firm’s conduct in one market can have exclusionary effects in another related market.

Alleged abuse of dominant position in both the relevant markets

‘Take-it-or-leave-it’ nature of WhatsApp 2021 Policy: The WhatsApp 2021 Policy, according to the DG’s investigation, lacks the ‘opt-out’ option and the users were not voluntarily agreeing to sharing of their personal data. If the users did not wish to accept the new policy, they were directed to visit Help Centre to delete their account. The WhatsApp 2021 Policy was found to be exploitative under the Competition Act where the users were forced to accept conditions that prioritise the company’s commercial interests at the expense of user autonomy and privacy protection (a non-price parameter of competition amongst players, specifically where service offerings are provided at zero monetary cost), thereby amounting to an imposition of unfair practice under Section 4(2)(a)(i) of the Competition Act.
The CCI’s treatment of the ‘take-it-or-leave-it’ privacy policy broadly aligns with Section 6 of the DPDP Act, which mandates that consent must be free, informed, specific, and unconditional. Any practice that conditions the provision of a core service on excessive/mandatory data sharing could be interpreted as coerced/invalid consent, thus raising red flags under both laws.
Internationally, the European Data Protection Board and national data protection authorities of jurisdictions, such as Germany, have taken a similar position. The German authority’s landmark decision[2] against Meta (Facebook) in 2019 held that the excessive and non-consensual aggregation of user data across services violated both GDPR and competition norms. That ruling, like the CCI’s order, emphasised that dominant platforms must not use their position to force users into consenting to broad data sharing across ecosystems.
Data collection and sharing of data by Meta (through WhatsApp):
- The CCI set out a detailed and granular level of users’ data required by WhatsApp, including the businesses/customers’ related information provided for using WhatsApp Business App. Meta argued that WhatsApp’s 2016 Policy had already disclosed its data collection and sharing practices with Meta, and the WhatsApp 2021 Policy merely seeks to record users’ acknowledgment of these existing terms.
- The CCI observed that such opacity and ambiguity in data policies is inherently unfair to users and raises significant competition concerns. A dominant platform like WhatsApp cannot use such broad terms without providing users with a clear understanding of the true cost of the services in terms of data sharing.
- The CCI noted that data aggregation with companies like Meta serves as both a driver of market power and a barrier to entry, making it difficult for competitors to enter or expand in the market. The cumulative impact of such practices can favour data-rich players, thereby limiting consumer choice and undermining the competitive dynamics of the digital marketplace.
- The WhatsApp 2021 Policy grants WhatsApp the unilateral right to expand data sharing at any point, without giving any choice to users and also affecting their privacy. The ‘privacy right’ is increasingly recognised as a critical non-price parameter of competition. The CCI concluded that such practices of lowering data protection standards by a dominant firm not only weakens the consumer’s position but also have significant exclusionary effects on competition. Accordingly, the same was also found to be in violation of Section 4(2)(a)(i) of the Competition Act.

Notably, the CCI’s concerns regarding ambiguous and opaque data practices mirror the DPDP Act’s principles of transparency and purpose limitation. Under the DPDP Act, personal data must be collected only for specific and lawful purposes, and the data subject must be clearly informed of the purpose. Denial of market access and leveraging by Meta:

in relation to the “market for online display advertising in India”, the CCI observed that by leveraging data collected from various sources, Meta enables advertisers to reach specific consumer segments more efficiently, resulting in more personalised ads and better engagement, ultimately improving the effectiveness of advertising campaigns. In this regard, the CCI also assessed the significant presence of Meta in the display advertising market which reflects the number of times an advertisement has been served to a user, along with analysing the revenue generated by Meta vis-à-vis its competitors in the online display advertisement market in India;
the CCI also noted that Meta’s cross-platform integration of data, such as the WhatsApp 2021 Policy strengthens Meta’s ability to offer more personalised and targeted advertisements and positions Meta is a more attractive partner for advertisers, as it operates a closed ecosystem or ‘walled garden’. As a result, the competitors particularly smaller companies or start-ups may struggle to gain a foothold in the display advertising market, resulting in a denial of market access to market opportunities;
the CCI also held that sharing of WhatsApp users’ data between Meta companies for purposes other than providing WhatsApp services creates an entry barrier for rivals of Meta, violating Section 4(2)(c) of the Competition Act. Additionally, Meta’s leveraging of its dominant position in the OTT messaging apps through smartphones to protect its position in the online supply advertising market was held to be in contravention of Section 4(2)(e) of the Competition Act; and
in addition to imposing certain behavioural remedies, the CCI also levied a penalty of INR 213.14 crore (Rupees two hundred thirteen crore fourteen lakh) @4% of the average total relevant turnover of WhatsApp and Meta for violation of Section 4 of the Competition Act, taking into account mitigating factors.

Interestingly, from a data privacy lens as well, leveraging user data to build closed advertising ecosystems raises serious concerns under the DPDP Act’s principle of data minimisation. If data collected for messaging is repurposed for behavioural advertising across unrelated Meta platforms, such cross-context processing would need a distinct consent mechanism. The DPDP Act requires purpose-specific consent, and blanket or implied consent across services would likely be treated as non-compliance under the DPDP Act.

Observations

The CCI in dynamic digital markets needs to balance regulation with a light touch approach to ensure innovation is not chilled.
The data-driven businesses particularly entities which could be considered dominant in specific markets (including because of the ecosystem of group companies) under the Competition Act need to re-visit their policies to ensure that the consent policies contain all the relevant information/disclosures, sans any opacity and ambiguity in data policies, to enable the users to make informed choices and such entities cannot use the data furnished by users in an unbridled manner including sharing with group companies.
Meta and WhatsApp appealed the Meta Order before the National Company Law Appellate Tribunal (“NCLAT”) which passed an interim stay order on the CCI’s direction to deposit the penalty, by directing that 50% of the total penalty imposed by the CCI be deposited with the NCLAT.[3] Of the 5 (five) behavioural remedies imposed by the CCI, the NCLAT stayed 1 (one) behavioural remedy pertaining to the prohibition for WhatsApp to share user data collected on its platform with other Meta companies or Meta company products for advertising purposes for a period of 5 (five) years from the date of receipt of the Meta Order.

Conclusion

The CCI has as a market regulator assumed jurisdiction by expressly holding that the introduction of the DPDP Act does not fetter the power of the CCI to exercise its jurisdiction.

This affirmation of concurrent jurisdiction is consistent with global regulatory practice, where authorities such as the European Commission are increasingly cooperating with data protection bodies. Going forward, companies operating in data-driven sectors should recognise that lawful data processing is not only a privacy issue but also a competition issue. Accordingly, businesses should implement governance frameworks that embed privacy-by-design and choice architecture aligned with both the Competition Act and DPDP Act as well as constantly evolving digital competition norms.

This Prism has been prepared by: