The article discusses the critical issue of user consent for data sharing on digital platforms in India, focusing on WhatsApp and its parent company, Meta Platforms Inc. The Supreme Court of India’s inquiry into the validity of user consent on platforms with limited alternatives is highlighted as a pivotal moment.
The Genesis of Controversy: WhatsApp’s 2021 Privacy Policy Update
The current legal challenge stems from significant modifications to WhatsApp’s privacy policy in 2021, which differed from its 2016 version. These changes mandated the sharing of user data with Meta, removing the previous opt-out mechanism and raising concerns about user data sharing.
The 2016 WhatsApp Privacy Policy
- Offered existing users a 30-day window to opt-out of sharing account information with Facebook (Meta) for purposes like friend suggestions or targeted advertising.
- New users did not have this specific opt-out for expanded data usage.
- This policy indicated a degree of user control over data.
The “Take-It-Or-Leave-It” Mandate: The 2021 WhatsApp Privacy Policy
Rolled out in January 2021 and effective from May 2021, this update made data sharing with Meta companies mandatory for all users. The Competition Commission of India (CCI) identified this coercive approach, lacking an opt-out, as a critical deviation from the 2016 policy.
Enhanced Transparency (and Heightened Scrutiny)
The 2021 policy provided more granular details on data processed and its purposes. It clarified that IP addresses and phone number area codes could infer general location. It explicitly detailed categories of information shared with other Meta entities: phone numbers, transaction data, interaction patterns, device information, and IP addresses.
Business Interactions and Evolving Data Usage
The policy clarified that businesses using WhatsApp features could leverage message content for their own marketing, including advertising on Facebook. Personal, end-to-end encrypted chats between individuals remained private, but metadata (who users message, when, and from where) is still collected and is not end-to-end encrypted.
The Supreme Court’s Resounding Stance on Data Privacy in India
The Supreme Court of India has taken a firm stance against WhatsApp and Meta, asserting that commercial interests cannot infringe upon citizens’ fundamental right to privacy.
“The Supreme Court characterized the ‘take-it-or-leave-it’ nature of the 2021 policy as coercive, likening it to a ‘decent way of committing theft of private information.'”
Judicial Scrutiny of Dominant Platforms
- The court questioned the validity of free consent when users have virtually no viable alternatives on critical communication platforms.
- The Supreme Court has repeatedly emphasized that the right to privacy is a fundamental constitutional right, as established by the Puttaswamy judgment.
- Opting out of WhatsApp is seen as akin to “opting out of the country” in digital communication, rendering consent illusory.
Unpacking the “Take-It-Or-Leave-It” Dilemma
The core of the Supreme Court’s scrutiny is whether consent can be “meaningful” when presented as an ultimatum on platforms like WhatsApp, which hold near-monopoly status in India.
The Nuances of Obtaining WhatsApp Privacy Policy Meaningful Consent
The Indian legal framework, particularly the Digital Personal Data Protection Act, 2023 (DPDPA), defines consent as “free, specific, informed, unconditional, and unambiguous.”
- Challenges to Consent: The “take-it-or-leave-it” model challenges the “free” and “unconditional” aspects.
- Test of Principles: This legal battle tests how consent principles apply to a consolidated digital market.
The Competition Commission of India’s Intervention
In 2024, the CCI imposed a penalty of ₹213.14 crore (approx. USD 25.25 Million) on Meta and WhatsApp. The CCI found the 2021 policy to be an abuse of WhatsApp’s dominant market position.
The Appellate Journey: NCLAT and the Supreme Court Appeals
NCLAT partially upheld the CCI’s findings in 2025, retaining the financial penalty. During Supreme Court proceedings, Meta argued that not all user data is shared, citing end-to-end encryption. However, the bench noted that the DPDPA 2023 is not fully in force until 2027, emphasizing the need for immediate judicial intervention.
Understanding Meaningful Consent in the Digital Age: The DPDPA 2023 Context
The DPDPA 2023 establishes a comprehensive legal framework:
- Free: Voluntarily given, without coercion.
- Specific: Tied to clearly defined processing purposes.
- Informed: Clear, plain language notice accessible in regional languages.
- Unambiguous: Requires explicit affirmative action.
Beyond Policy Wording: Broader Implications
The Supreme Court’s questioning signals to all major tech companies that market dominance does not permit circumventing fundamental rights. It could incentivize the development of more privacy-centric business models and genuine innovation in obtaining user consent.
Conclusion
The legal battle surrounding WhatsApp’s 2021 privacy policy is a profound examination of digital rights. As India moves towards the DPDPA 2023, the judicial pronouncements will serve as a guiding light, ensuring commercial innovation aligns with constitutional values and citizens’ privacy is protected against exploitation.
About the Author
