NCLAT Upholds Meta Penalty, Scraps Five-Year WhatsApp Data-Sharing Ban in Landmark Ruling

New Delhi – In a significant and nuanced judgment with far-reaching implications for India's digital economy, the National Company Law Appellate Tribunal (NCLAT) has delivered its final verdict in the high-stakes dispute between Meta Platforms, WhatsApp, and the Competition Commission of India (CCI). While upholding the CCI's imposition of a ₹213.14 crore penalty for abusive conduct, the appellate tribunal struck down the regulator's most stringent behavioral remedy: a five-year ban on sharing WhatsApp user data with other Meta companies for advertising purposes.

The two-member NCLAT bench, comprising Chairperson Justice Ashok Bhushan and Technical Member Arun Baroka, also set aside the CCI's crucial finding that Meta had leveraged its dominance in the messaging market to unlawfully strengthen its position in the separate market for online display advertising. The ruling provides partial but critical relief to Meta, preserving a core component of its integrated business model in India, its largest market with over 500 million WhatsApp users alone.

"The findings of the Commission so far as they relate to Section 4(2)(e) [leveraging dominance] and the direction in paragraph 247.1 [the five-year data sharing ban] are set aside," the bench declared in its oral ruling. "The rest of the order is upheld."

The decision modifies the CCI’s comprehensive order from November 2024, which had concluded that WhatsApp's 2021 privacy policy update, imposed on a "take-it-or-leave-it" basis, amounted to an abuse of its dominant position under the Competition Act, 2002.

---

The Genesis of the Dispute: A Privacy Policy Update

The legal battle originated from WhatsApp's January 2021 privacy policy update, which mandated that users accept new terms allowing the platform to share certain metadata—such as device information and business interaction details—with its parent company, Meta (then Facebook). This move, which eliminated the limited opt-out option available since 2016, sparked a global backlash over privacy concerns and triggered a suo motu investigation by the CCI.

In its November 2024 order, the CCI found Meta guilty of abusing its dominance by imposing unfair conditions on users. The regulator determined that the policy was exploitative and exclusionary, leveraging WhatsApp's vast user base to entrench Meta's dominance in the digital advertising market. Consequently, the CCI imposed the ₹213.14 crore penalty and several behavioral remedies, headlined by the five-year ban on cross-platform data sharing for advertising.

Meta and WhatsApp immediately challenged the order before the NCLAT. In January 2025, the tribunal granted an interim stay on the data-sharing ban, noting that it could "lead to the collapse of the business model of WhatsApp LLC since the platform is free." However, it required Meta to deposit 50% of the penalty amount pending the final verdict.

---

NCLAT's Legal Reasoning: Decoupling Dominance from Leverage

The cornerstone of the NCLAT's final decision appears to be the distinction it drew between Meta's conduct within the messaging market and its alleged leveraging of power into the advertising market.

By upholding the penalty but striking down the finding under Section 4(2)(e) of the Competition Act, the tribunal has effectively ruled that while the "take-it-or-leave-it" privacy policy was an abusive and unfair imposition on users within the messaging market, the CCI failed to sufficiently prove that this conduct was a direct lever to unlawfully protect or strengthen Meta's position in the distinct online advertising market.

This distinction is a significant victory for Meta, whose counsel argued vigorously that the CCI had misapplied competition law to what was fundamentally a data protection issue. Meta maintained that the 2021 update merely clarified existing data-sharing practices and did not involve sharing sensitive personal data for advertising.

The upholding of the penalty, however, confirms the NCLAT's agreement with the CCI that forcing users to accept onerous, non-negotiable terms constitutes an abuse of dominance. This leaves intact the finding that dominant digital platforms cannot impose unfair conditions on users, a crucial precedent for future cases.

---

Jurisdictional Crossroads: Competition Law vs. Data Protection

A central theme throughout the appellate proceedings was the jurisdictional tension between the Competition Act and India’s evolving data protection framework. Meta's legal team, led by Senior Advocates Kapil Sibal and Mukul Rohatgi, contended that the CCI had overstepped its mandate by adjudicating on privacy concerns that fall under the purview of the forthcoming Digital Personal Data Protection (DPDP) Act.

Senior Advocate Arun Kathpalia, also for Meta, controversially characterized user data as Meta’s "private property," asking, "It’s collected by me, it’s my personal property. Shall I give it to my competitors?" This highlighted Meta's stance that internal data sharing is essential to its business model, which supports millions of small businesses in India.

Conversely, the CCI, represented by Senior Advocate Balbir Singh, argued that its focus was not on individual privacy rights per se , but on how the control and use of data by a dominant player distorts market competition and harms consumer welfare. The CCI pointed out the differential treatment of Indian users compared to their European counterparts, who enjoy greater control under the GDPR, as evidence of deliberate imposition of unfair terms in the Indian market.

Acknowledging this complex regulatory landscape, the NCLAT bench has provided both parties the liberty to seek modifications to the order once the DPDP Act is fully implemented. This forward-looking clause recognizes that the definitive rules governing data sharing in India are still to come and may supersede aspects of this competition-focused ruling.

---

Implications for the Digital Economy and Legal Practice

The NCLAT’s judgment carries profound implications for technology companies, consumers, and regulators in India.

• For Big Tech: The verdict provides a mixed but largely favorable outcome. While the financial penalty stands, the removal of the data-sharing ban allows Meta's integrated advertising ecosystem to continue functioning. It sets a higher bar for the CCI to prove the anti-competitive "leveraging" effect of data practices in adjacent markets.

• For Competition Law: The ruling refines the application of abuse of dominance provisions to digital platforms. It affirms that non-price factors like unfair terms and diminished user choice are valid grounds for intervention under competition law. However, it also signals a degree of judicial restraint in imposing sweeping behavioral remedies that could fundamentally alter a company's business model.

• For Data Privacy: The decision underscores the urgent need for the full implementation of the DPDP Act. By deferring to the future data protection regime, the NCLAT highlights the limitations of using competition law as a proxy for comprehensive privacy regulation. Privacy advocates may view the removal of the data-sharing ban as a setback for consumer protection.

• For Legal Practitioners: The case will become a key reference point in TMT, antitrust, and privacy law. It provides critical insights into how Indian appellate bodies are interpreting the nexus of data, dominance, and competition. Future litigation will likely focus on the evidentiary standards required to prove leveraging under Section 4(2)(e).

Reacting to the verdict, a Meta spokesperson stated, "While we await the written order, we continue to reiterate that WhatsApp’s 2021 privacy policy update did not change the privacy of people’s personal messages, which remain end-to-end encrypted."

The complete written judgment is yet to be released, and its detailed reasoning will be scrutinized by legal experts. The path forward remains open, as either party could potentially appeal the NCLAT's decision to the Supreme Court. Furthermore, the impending enforcement of the DPDP Act promises a new chapter in the regulation of data-driven businesses in India, ensuring that the debate over data, privacy, and competition is far from over.