CCI imposes ₹213 crore penalty on Meta over 2021 WhatsApp private policy update

New Delhi: India’s competition watchdog on Monday imposed a ₹213-crore penalty on Meta for abusing its dominant position as the 2021 privacy policy update of its messaging app WhatsApp undermined users’ ability to opt out of getting their data shared with the group’s social media platform Facebook.

The Competition Commission of India (CCI) ordered WhatsApp not to share user data collected on its platform with other Meta companies or products for advertising purposes for five years, according to a statement by the regulator. The CCI considers Meta a dominant player in internet-based messaging through WhatsApp and also in online display advertising.

For purposes other than advertising, WhatsApp’s policy should include a detailed explanation of the user data shared with other Meta group companies or products specifying the purpose, the CCI said. 

The regulator also said that sharing user data collected on WhatsApp with other Meta companies or products for purposes other than providing WhatsApp services should not be a condition for users to access WhatsApp service in India.

Queries emailed to Meta on Monday evening seeking comments remained unanswered at the time of publishing.

Also read | CCI seeks to revamp penalty recovery rules; seeks public feedback

Mint first reported on 14 October that the CCI has concluded after a probe that the messaging giant allegedly broke the country’s competition law.

For sharing data for purposes other than offering messaging services, all WhatsApp users in India, including those who have accepted its 2021 privacy policy changes, should be given a choice to manage such data sharing by way of an opt-out option prominently through an in-app notification, the regulator said. Also, all future policy updates should comply with these requirements, it said.

The order is significant as it upholds user consent as a key principle in the functioning of social media giants, similar to the measures taken by some of the other markets. In December 2021, Germany’s data protection commissioner had temporarily banned Facebook from processing German users' WhatsApp data. Ireland’s Data Protection Commission, too, had imposed a fine on WhatsApp in 2021 for a previous privacy policy update users were asked to accept, before the EU rolled out its General Data Protection Regulation (GDPR) in 2018, Mint reported on 14 October.

WhatsApp’s 2021 privacy policy update spoke about how businesses could use Facebook-hosted services to store and manage their WhatsApp chats with customers. The competition watchdog concluded that WhatsApp’s sharing of users’ business transaction information with Meta gave the group entities an unfair advantage over competing platforms.

The CCI said the WhatsApp’s policy update on a ‘take it-or-leave-it’ basis constituted imposing an unfair condition as it compels all users to accept expanded data collection terms and sharing of data within Meta group without any opt-out. This, according to the regulator, undermined users’ autonomy and constitutes an abuse of Meta’s dominant position.

Also read | Did WhatsApp's policy tweak break the law?

The CCI said that sharing WhatsApp users’ data between Meta companies for purposes other than providing WhatsApp Service creates an entry barrier for its rivals and results in denial of market access in the display advertisement market in violation of the competition law.

A WhatsApp spokesperson had in October told Mint that privacy of users remains the company’s highest priority and that WhatsApp’s Privacy Policy Update 2021 did not change the privacy of people’s personal messages. WhatsApp gave users the choice of accepting the Privacy Policy Update, and users who chose not to accept the update continued to use WhatsApp to communicate with friends and family without having their accounts deleted or losing functionality, the spokesperson had said then.