Introduction
In a landmark clarification with far-reaching implications for digital platforms, the National Company Law Appellate Tribunal (NCLAT) has unequivocally reaffirmed that user consent for data sharing cannot be automatic, bundled, or coerced, even for advertising-related purposes. The ruling arises from a clarification application filed by the Competition Commission of India (CCI) in its long-running dispute with WhatsApp LLC and its parent company Meta Platforms Inc., concerning WhatsApp’s 2021 Privacy Policy. At its core, the judgment strengthens a foundational principle of digital governance: all non-essential data use, including advertising, requires express, informed, and revocable user consent.
Background: WhatsApp’s 2021 Privacy Policy and the CCI’s Findings
WhatsApp’s 2021 Privacy Policy update required users to accept expanded data-sharing with Meta as a condition for continuing to use the service. The policy did not offer a meaningful opt-out and framed acceptance as binary.
The CCI concluded that this conduct constituted abuse of dominance under Section 4 of the Competition Act, 2002 on two counts:
- Imposition of unfair conditions on users, by forcing acceptance of broad and vague data sharing, and
- Denial of market access, by strengthening Meta’s position in digital advertising through privileged access to WhatsApp user data.
NCLAT largely upheld these findings in its November 2025 judgment, emphasizing that data can function as a competitive asset capable of distorting markets.
The Central Legal Principle: Restoring User Choice
Across its original judgment and the subsequent clarification, NCLAT consistently returned to one unifying idea: the removal of exploitation by restoring genuine user choice.
The Tribunal articulated this principle in clear terms:
- Users must retain the right to decide what data is collected,
- For which specific purposes, and
- For what duration.
Crucially, the Tribunal rejected any distinction that would allow advertising-related data use to escape this framework. Advertising, analytics, and cross-platform integration were treated as non-essential purposes, permissible only with express and revocable consent.
Remedies, the Five-Year Ban, and the Source of Ambiguity
The Five-Year Advertising Ban
The CCI had imposed a five-year prohibition on sharing WhatsApp user data with Meta for advertising purposes. NCLAT set aside this ban, not because advertising data use was lawful by default, but because:
- The duration lacked a clear legal rationale, and
- A rigid ban was unnecessary once meaningful user choice was restored.
The Surviving Remedies
NCLAT upheld a series of behavioural remedies requiring:
- No conditioning of WhatsApp usage on consent for non-WhatsApp data sharing,
- Opt-out and revocable consent mechanisms, and
- Detailed transparency about data categories, recipients, and purposes.
The ambiguity arose because the operative portion of the judgment inadvertently suggested that one transparency obligation might not apply to advertising-related data after the ban period.
Clarification By NCLAT
In its December 2025 clarification, NCLAT acknowledged a mismatch between its reasoning and its operative directions. Invoking both statutory powers under the Competition Act and established judicial principles that no party should suffer due to a court’s accidental slip, the Tribunal clarified its intent.
The clarification states unequivocally that:
Whether WhatsApp data is used for ads or for any other Meta business purpose, the same strict rules apply: transparency, real choice, and revocable consent.
This correction ensures that advertising-related data use is subject to the same transparency and consent standards as any other non-essential data use.
Legal Significance: Competition Law as a Tool of Data Governance
Expanding the Role of Competition Law
raditionally, privacy and data protection were viewed as distinct from competition law. This decision reinforces a modern regulatory approach where data practices can constitute competitive abuse when they entrench dominance or exploit user dependency.
The ruling confirms that competition authorities can legitimately scrutinize consent architecture, transparency, and purpose limitation where data concentration affects market structure.
Advertising Is Not a Special Category
A key contribution of the judgment is its rejection of advertising as an exception. Platforms often argue that advertising data use is essential to “free” services. NCLAT squarely rejected this logic, holding that commercial necessity cannot override user autonomy.
From Time-Bound Bans to Structural Safeguards
Rather than relying on temporary prohibitions, the Tribunal opted for permanent behavioural obligations. This shift reflects a mature regulatory philosophy aimed at preventing future abuses regardless of how technology or business models evolve.
Implications for Technology Platforms and Users
For dominant platforms, the ruling necessitates:
- Re-engineering consent flows,
- Designing reversible data-sharing mechanisms, and
- Accepting that optional features cannot be used to bypass consent requirements.
For users, the judgment elevates them from passive data sources to active participants in data governance, even within highly integrated digital ecosystems.
Interface with India’s Emerging Data Protection Framework
Although the NCLAT decision formally arises under competition law, its importance extends well beyond antitrust enforcement. The clarification meaningfully intersects with India’s evolving data protection regime and, in effect, anticipates how privacy rights are expected to function in practice under the new legal framework.
India is in the middle of a transition from fragmented privacy protections to a structured statutory regime under the Digital Personal Data Protection Act, 2023 and its accompanying rules. While full operationalisation of this framework is still underway, the Tribunal’s reasoning reflects the same normative values that underpin modern data protection law.
Competition Law Filling a Regulatory Gap
At present, India’s data protection regime is not yet fully enforced across all sectors and platforms. In this regulatory gap, the NCLAT judgment demonstrates how competition law can operate as an interim but powerful tool for protecting informational autonomy.
Instead of waiting for privacy regulators to act, the Tribunal recognised that:
- When a dominant platform controls access to an essential digital service, and
- Uses that control to extract broad or irreversible consent,
the harm is not merely a privacy issue but also a competition concern, because it exploits dependency and reinforces market power.
This approach signals that data protection principles are not confined to data protection statutes alone, but can be enforced wherever data practices distort fairness, choice, or market structure.
Alignment with Data Protection Principles
Without explicitly applying the DPDP Act, the Tribunal’s clarification closely mirrors its foundational concepts.
The judgment reinforces:
- Purpose limitation, by requiring platforms to clearly explain why specific data is collected and how it will be used
- Consent specificity, by rejecting blanket or bundled consent for multiple downstream uses
- Revocability, by insisting that users must be able to withdraw consent without losing access to core services
These are not incidental observations. They reflect a judicial understanding that consent is meaningful only when it is informed, granular, and reversible. In effect, the Tribunal treated these principles as baseline standards of fairness, regardless of whether the enforcement route is competition law or privacy law.
Conclusion
The NCLAT clarification in the WhatsApp–Meta case represents more than a procedural correction. It is a substantive reaffirmation that user consent must be real, informed, and reversible, irrespective of how valuable data may be to platform economics.
For the general public, the message is simple: continued use of a dominant digital service cannot be made the price for surrendering control over personal data. For the technology sector, the implication is profound: data-driven growth must now be designed around user choice, not engineered around its erosion.
Source
Case Title: WhatsApp LLC Vs. CCI ( NCLAT, I.A. No. 6817 of 2025, Decided on Dec 15, 2025)
