SC warns WhatsApp, Meta over data policy

The Supreme Court on Tuesday delivered a sharp rebuke to WhatsApp LLC and its parent company Meta Platforms, questioning their data-sharing practices and warning that India would not tolerate the exploitation of citizens’ personal information under the guise of consent.

Hearing appeals filed by Meta and WhatsApp against a Competition Commission of India (CCI) penalty of ₹213.14 crore, the top court said the companies were taking advantage of their dominant market position and undermining constitutional values, particularly the right to privacy.

A three-judge bench led by Chief Justice of India Surya Kant told the companies that if they were unwilling to address concerns around data sharing, they were free to exit the Indian market.

The court was examining challenges to a National Company Law Appellate Tribunal (NCLAT) order that upheld the CCI’s finding against WhatsApp’s 2021 privacy policy, while partially relaxing restrictions on data sharing for advertising purposes. The CCI has also appealed the NCLAT ruling, arguing that allowing data sharing defeats the purpose of the original penalty.

Senior advocates Mukul Rohatgi and Akhil Sibal, appearing for Meta and WhatsApp, informed the court that the ₹213.14 crore penalty had already been deposited. The bench, however, directed that the amount should not be withdrawn until further orders. The bench also expressed concern that consent mechanisms were too complex for ordinary users to understand.

During the hearing, the court repeatedly questioned the validity of user consent in a market where WhatsApp is virtually indispensable.

The court indicated it may impose strict interim conditions unless Meta and WhatsApp give a clear undertaking not to share user data until the matter is finally decided. It allowed the companies to file affidavits explaining their position and asked the CCI to suggest safeguards it believes are necessary. The matter is scheduled to be heard next on February 9, when the Supreme Court will consider whether interim directions are required to protect user data while the case is pending.