Meta’s misuse of its market clout served a privacy alert to millions

The CCI also placed a five-year bar on WhatsApp from such sharing of user data for advertising purposes. Back then, amid an uproar among users, Meta argued that the tweak in terms was benign as it related only to ‘metadata’ (which draws upon raw data).

Also read: Three years on, Meta brings back facial recognition for selective use

More pertinently, it later claimed it did not penalize users who didn’t accept its revised deal; they could still use the app as they always had. But the damage was done. While the CCI found Meta’s idea of data-sharing unacceptable for the unfair edge it would gain over rivals, it also judged WhatsApp’s take-it-or-leave-it deal as an abuse of its dominant market position.

If its dominance of social media was obvious, then the force it sought to exert on users three years ago was equally so. The heft of its network meant few users could escape its gravity, although many tried to leave. Thus, from an antitrust perspective, Meta could hardly have expected to be let off. Yet, away from legal circles, this case may last longer in public memory for how it cracked open privacy as a significant concern online.

WhatsApp had a user base of a few hundred million in India by the time of its 2021 tweak. So, while waves of protest across chat groups may only have been ripples in reality, they played a sizeable role in creating a buzz over privacy as a popular worry.

Also read: Meta to offer ‘less personalized ads’ in concession to EU

The larger context was India’s own privacy bill in the works back then, a reason why Meta’s move stood out for its gall. The core aim of the proposed law was known all along: To grant people control over the information they gave various websites and apps.

Passed last year, the Digital Personal Data Protection Act institutes a regime based on informed consent. Under this law, an entity asking us for data must obtain our explicit go-ahead to gather, process or use it, which it can do only for clearly specified purposes, with a distinct okay needed for each purpose.

Also, among other provisions, the data obtained this way cannot be kept longer than required for the stated purpose and we retain the right to withdraw consent if we so choose.

Of course, this framework has exceptions, some of which cut state agencies more slack than necessary, but it does offer citizens a usable shield against privacy violations by the private sector. How robust it will prove, though, is yet to be tested. Since the rules are still to be notified, India’s privacy law hasn’t yet come into force.

As online operators needed time to adapt, the 2023 law could not have taken effect instantly. But the sooner it does, the better. Software can be adjusted to comply with it at various levels. Basic adjustments take little time, surely. What may take longer are major redesigns that hard-code compliance into digital systems so that any rule broken leaves a telltale trail.

Also read: Why the Ray-Ban Meta could be your best tech purchase of the year

This is the advisable way to comply. Hard-encoding could even be used as an advertising proposition by companies making privacy claims. We can hardly tell if our data is secretly being misused behind a friendly screen, after all, and once the new law kicks in, we’ll need signs of its efficacy. But the wait for that moment of reckoning mustn’t stretch on too long.