NCLAT Rules WhatsApp Needs User Consent for All Data Uses Beyond Advertising

WhatsApp must obtain user agreement before sharing data with Meta parties for both advertising and non-advertising reasons, according to a clarification made on 15 December by the National Company Law Appellate Tribunal (NCLAT). A panel headed by Justice Ashok Bhushan, the chairperson of the NCLAT, granted the Competition Commission of India's (CCI) request for clarification regarding the extent of the tribunal's November 4 ruling.

The decision clarified that user consent is required for all data, not only advertising data, that WhatsApp gathers and distributes with its parent firm, Meta. The CCI's conclusion that WhatsApp's 2021 privacy policy was based on compelled consent, requiring users to agree to data sharing or risk losing access to the service, was previously upheld by the NCLAT. Nevertheless, it remained unclear if this consent requirement simply extended to data used for advertising or to all data shared on WhatsApp. The tribunal made it clear that the CCI's directives were applicable everywhere.

WhatsApp Should Comply in Three Months

As stipulated in the initial order, the NCLAT further stated that WhatsApp had three months to comply. WhatsApp's attorneys requested extra time during the hearing, claiming that implementing system-level changes would be a significant and difficult undertaking. The tribunal finally gave it three months, as previously permitted, despite its initial inclination to give it just one. Meta and WhatsApp contested the CCI's appeal, claiming that the previous ruling was unambiguous and didn't require further explanation.

They asserted that the CCI was attempting to impose additional duties and that data sharing through optional advertising features already respected user choice. The panel dismissed this claim, stating that user choice at the time of data collection and sharing is the crucial factor. It decided that users must give their explicit, revocable approval before any non-essential or advertising-related data exchange can occur, and they have the choice to opt in or out at any time.

Why NCLAT Opt for such Ruling?

The NCLAT stated that WhatsApp could not assert unrestricted rights over user data and that the 2021 policy's coercive "take-it-or-leave-it" aspect was eliminated by reinstating opt-in and opt-out options. According to the directive, NCLAT reaffirms the fundamental idea of eliminating exploitation by giving users their choice again. Users must continue to have control over what information is gathered, why, and for how long. The abuse revealed in the 2021 WhatsApp policy is resolved once users are freely given the choice to opt in or opt out of data sharing, whether for advertising or non-commercial purposes. In the WhatsApp-CCI case, the NCLAT's ruling on November 4 partially upheld the CCI's INR 213.14 crore fine against Meta Platforms and WhatsApp for the 2021 WhatsApp privacy policy modification.

The policy was considered exploitative and exclusionary by the CCI. The CCI's five-year ban on WhatsApp sharing user data with Meta firms for advertising purposes, however, was overturned by the appeal body. The NCLAT highlighted the importance of user consent and said in multiple sections of the order that consent was necessary regardless of whether the data was used for advertising or other purposes, according to the CCI's interpretation of the ruling.