Daily Breach

Legal & Policy

Supreme Court to Meta: Respect Indians’ Privacy or Exit the Market

Introduction

India’s highest court has delivered one of its strongest warnings yet to Big Tech. The Supreme Court of India questioned the legality, ethics, and constitutionality of WhatsApp and Meta’s data practices, making it clear that “silent consumers” cannot be forced into surrendering personal data under a take-it-or-leave-it framework.

Background / Context

The case arises from WhatsApp’s controversial 2021 privacy policy, which mandated data sharing with its parent company, Meta, as a condition for continued use of the messaging platform WhatsApp.

The Competition Commission of India had earlier imposed a penalty of ₹213.14 crore, citing abuse of dominant market position. While the National Company Law Appellate Tribunal upheld the fine, it relaxed restrictions on data sharing, prompting appeals from both Meta and WhatsApp.

Key Court Observations

A three-judge Bench led by Chief Justice Surya Kant delivered pointed remarks questioning the very foundation of consent-based data collection when consumers have no realistic alternative.

  • The court compared large-scale data extraction to a “decent way of committing theft”, noting that millions of bytes of personal data may already have been harvested.
  • The Bench rejected the argument that users could simply “opt out”, observing that in practice, opting out meant exclusion from a near-monopoly communication service.
  • The court questioned whether ordinary citizens, including rural users or informal workers, could genuinely understand complex consent language drafted by global technology firms.

“We Are Not Only Consumers, We Are Products”

The court highlighted how behavioural data is monetised far beyond messaging services. A simple interaction, such as discussing medical issues online, can trigger targeted advertising within minutes.

The Solicitor General argued that personal data is not merely collected but commercially exploited, reinforcing the idea that users themselves have become the product in digital markets.

Gaps in India’s Data Protection Framework

The Bench closely examined the Digital Personal Data Protection Act, noting that while it safeguards privacy, it remains largely silent on the economic value of personal data.

Justice Joymalya Bagchi observed that even non-sensitive data carries significant monetary value and can be leveraged for advertising and behavioural profiling by parent-subsidiary corporate structures.

Global Comparison and EU Standards

The court asked the government to study the Digital Services Act, which regulates not only privacy but also the economic exploitation of user data.

The Bench raised a critical jurisprudential question: does sharing data automatically strip it of value, or should users retain rights over its commercial use?

“Follow the Constitution or Leave India”

In one of the hearing’s most striking moments, the Chief Justice warned Meta that constitutional rights are non-negotiable. If compliance with India’s privacy standards is not feasible, exiting the Indian market remains an option.

The court made it clear that addiction to platforms and market dominance cannot justify erosion of fundamental rights.

Impact / Scope

  • Millions of Indian WhatsApp users may gain stronger protections against forced data sharing.
  • The ruling could redefine consent standards for dominant digital platforms.
  • Future regulation may address not just privacy, but data value, rent-sharing, and monetisation.

Outlook

The Supreme Court has admitted the appeals and will consider interim directions shortly. Its final ruling could become a landmark precedent, reshaping how global technology companies operate in India and accelerating a shift toward stricter digital sovereignty and consumer-centric data governance.

Sources

Adv. Rohan Talreja

Adv. Rohan Talreja

About Author

An Advocate with a professional focus on cyber law, information security, and data protection. His work centres on data protection compliance under India’s Digital Personal Data Protection Act, 2023 and the EU General Data Protection Regulation (GDPR), along with cybersecurity governance and legal risk management. He has experience in contract compliance and the drafting and negotiation of commercial, master service, and vendor agreements. His writing explores the intersection of cyber law and technical cybersecurity, particularly in areas of data privacy, cybercrime, regulatory compliance, and emerging cyber risks, offering practical and policy-oriented insights.

Leave a Reply

Your email address will not be published. Required fields are marked *