WhatsApp's New Privacy Policy from the perspective of

Competition Law
Debayan Bhattacharya

BACKGROUND

Earlier this year, the social media platform WhatsApp announced that it would be making
changes to its privacy policy. This led to a massive controversy, with several experts
speaking out against the move[1], and reports that the Indian government was going to launch
an investigation[3]. The uproar has forced WhatsApp to push the implementation by three
months[4] and consecutively, it launched[5] a campaign to protest against the outrage. At the
heart of the trouble lies the fact that India is WhatsApp’s largest market, and losing its hold
over 400 million users may damage it’s profitability.

Even three months after the outrage, the issue has not been settled. The Competition
Commission of India (“CCI”) ordered an investigation into WhatsApp’s new privacy policy
and its terms and conditions. This was recently challenged by WhatsApp and Facebook in the
Delhi High Court, the judgement of which is currently pending.

This article will be examining the CCI’s decision, its reasoning, and any other antecedent
questions that remain unanswered. However, before all this, we need to briefly discuss what
the changes actually are, as there has been considerable confusion regarding them.

THE UPDATED TERMS AND CONDITIONS

The changes led to a wave of panic and speculation, which obviously resulted in the spread of
misinformation. WhatsApp also came out with its own set of clarifications, but whether it is
comprehensive or not is up to question. WhatsApp had made this new policy mandatory. The
user had to accept these new changes or they would lose access to their chats and would not
be able to use WhatsApp any longer.

The new privacy policy in which it detailed its data sharing practices with Facebook
extensively. The update was mainly to elucidate on its current relationship of data sharing
with Facebook and to promote the ability of businesses on WhatsApp. For example,
WhatsApp clarified that it allows interaction with third-party services or Facebook contents
and clearly stated that it was sharing data with Facebook and third parties pursuant to its
services.[6]

WhatsApp stated that it would allow businesses to use hosting services from Facebook,
through which it could access customer chats. Pursuant to this, the application will share
customer data[8] like phone numbers and transaction information with these businesses. This
will allow businesses to target advertisements and use transaction data to make business
decisions.[9]

However, certain allegations raised about the changes were false. For example,
communication between two consumers, i.e. someone and their friend or family is still end-
to-end encrypted and WhatsApp still cannot intercept texts or snoop on calls. Further, the
new privacy policy does not “expand” WhatsApp’s communications with Facebook, but only
outlines what it has been doing for years.
In summary, alot of misinformation has been present around these changes. Much of this has
been false. At the same time, WhatsApp is not a good faith actor and has been actively
harvesting and processing user data. Here, it was merely being transparent with its practices
and revamping it’s business-related services, in order to become a major e-commerce player.

THE CCI’S ORDER AND DELHI HIGH COURT CASE

On the 24 March, 2021, the Competition Commission of India or CCI ordered a suo motu
th

antitrust investigation into the changes to WhatsApp’s terms and conditions and privacy
policy.[11] The order begins by stating concerns the CCI has regarding the compulsory
acceptance of the changes to the privacy policy. The CCI unequivocally stated that it was
concerned about the mandatory imposition of the new policy on users, and that this was the
rationale behind the investigation.

WhatsApp tried to challenge the CCI’s jurisdiction based on various grounds, such as the
presence of another regulator, that the matter was sub judice in another forum, that the
subject matter was outside the ambit of competition law. We do not need to go into the
reasoning of this, but the CCI rejected all of these preliminary objections and determined that
the investigation could proceed.

The first determination that the CCI had to make was whether WhatsApp had a dominant
position in the relevant market. It identified the “market for Over the Top (OTT) messaging
apps through smartphones in India” to be the relevant market, extensively quoting from its
previous decision in the Harshita Chawla case[13]. The CCI ultimately determined that
WhatsApp had a dominant position in the market, because of global usage data and
“information available in the public domain”. The CCI thus upheld what it had decided in
Harshita Chawla, and said even though that decision is from August 2020, the rise of apps
like Signal has not significantly dented WhatsApp’s position since it is entrenched due to
“network effects”. Network effects are scale effects, i.e. increase in a number of users leads
to an increase in the value of the application for other users, which leads to a corresponding
increase in users, which again leads to an increase in the value. This is compounded and the
result is that the dominant company is effectively entrenched.

The CCI then moved to the heart of the issue: The compulsory nature of the new privacy
policy. The 2016 update to WhatsApp provided users the ability to opt out from sharing
information with Facebook and other third-party apps. However, while WhatsApp says it will
continue the honour the opt-out of the 2016 update, there is no exception carved out in the
2021 update and it seems to apply to all. Therefore, WhatsApp is incorrect when they argue
that the information is “descriptive” as thus amounts to a tangible change in data sharing
practices for many users.

The CCI also complains the new policy is “unduly expansive and disproportionate”.
Transaction and payment data, mobile operator, language, Internet Service Provider, time
zone and lots of other user related information would now be shared with Facebook. Lastly,
the CCI notes that many of the information categories are “unintelligible” and imprecise. 
The information covered under users interacting “with others (including businesses)”,
“service-related information”, “mobile device information”, “payments or business features”
are all undefined.
Thus, because of the mandatory nature of the new policy, the expansive nature of data
collection and imprecise definition of what data will be collected, the CCI made out a prima
facie case that needed further investigation.

Pertinently, the CCI provided a rationale for why privacy policy can come under the contours
of competition law. WhatsApp seems to be targeting the sharing of data in order to use
information from WhatsApp to build user profiles for better development of Facebook’s
products. This data concentration is actually a competitive advantage and can lead to
entrenchment of dominance, and since it is carried out in a manner that prima facie seems
untenable, the CCI has jurisdiction to investigate.

Facebook and WhatsApp challenged[14] this decision in the Delhi High Court, arguing that
the Competition Commission was abusing its suo motu jurisdiction and did not have authority
to try the case, since the Supreme Court was already hearing a similar matter. The CCI
responded that it was not investigating the privacy concerns, but was investigating the
competition aspects of the case. It further argued that prima facie the new policy would be
used to create user profiles in a manner equivalent to “stalking”, and all for the purpose of
targeted advertising. The hearings have concluded and the Delhi High Court has reserved its
judgement.

ANALYSIS

The order raises several interesting questions. First, the Order seems to state in unequivocal
terms that it is investigating proposed changes before they are enforced. However, this runs
against the general consensus surrounding abuse of dominance claims, which traditionally are
brought after abuse of dominant position has occurred.[15] This represents a sea of change in
the way the CCI investigates abuse of market dominance cases, and it is interesting to see
how this will be dealt with going forward.

Second, the CCI has now waddled into the sector of data privacy. While it is obviously a
positive development as data is increasingly being used to create a competitive advantage,
their remain some problems of enforcement. The CCI, for any remedy, will have to rely on
the data privacy laws in the nation to determine infringement and come out with a remedy.
[16] However, the Personal Data Protection Bill has not yet been passed and it is unclear if
and when it will come into force. As a result, the question of remedies and determination of
how law has been violated will be of definitive importance later on.

Third, the CCI order clarifies much of the muddled public debate. WhatsApp’s public release
seems to whitewash the privacy policy updates as non-controversial ones. The CCI astutely
pokes holes in this characterization by pointing out how this new update does not only
‘describe’ the current policy, but is a tangible transformation. Further, the CCI also points out
the fact that many of these ‘categories’ are undefined and consumers do not have an idea of
what sort of data is being funnelled under them. This weakens WhatsApp’s argument that the
data of users is only sent during interactions with businesses. This is a valuable contribution
in itself to the public debate around the changes in the policy.

Ultimately, though, this is a broadly positive move. WhatsApp is undoubtedly the dominant
OTT messaging platform in the country and its imposition of a privacy policy onto
consumers without providing them a chance to opt out reflects the dominance that WhatsApp
has in the market. It is now siphoning off user data for the profitability of Facebook. The
CCI’s order is groundbreaking not only because it provides a forum to challenge the new
policy, but because it breaks with precedent to investigate possible monopolistic acts before
they materialise, highlighting the historic failure of post facto measures to effectively punish
companies that commit antitrust violations. While there are some hiccups and unanswered
questions in the process, the CCI’s reasoning is persuasive and lays out a solid case for a
more detailed investigation.

CONCLUSION

WhatsApp’s new privacy policy has led to a furore and significant controversy in the public
domain. However, despite all the noise, the damage to WhatsApp’s popularity and user base
has been minimal. The CCI’s order to further investigate the changes to the privacy policy are
a welcome development. This is not only because it is willing to enter a new field of law, but
is willing to break with precedent for the broader benefit of consumers. The CCI’s order also
comes as welcome relief to consumers, since WhatsApp was imposing these changes on
consumers, and these consumers do not have any effective forum for recourse. The order is a
very positive change.

However, one of the most unexpected yet welcome contributions of the CCI order is the
clarity it introduces to the exact scope of changes being introduced. WhatsApp and social
media have been involved in a protracted misunderstanding regarding the new changes, and
the CCI order’s greatest contribution in the present is ensuring that the exact problems with
these updates can be highlighted.

The saga is far from over. The Delhi High Court has not made a final decision, and the
Director General’s detailed investigation may absolve WhatsApp at the end of the
investigation. Though there are a few questions that remain unanswered, the move is largely a
positive one, and it will be interesting to see how it plays out.

REFERENCES

[1] Romita Majumdar, ‘Why India’s Industry And Privacy Experts Are Worried About
WhatsApp’s New Privacy Policy?’ Inc42 Plus (7 January, 2021) available at
<https://inc42.com/features/why-industry-and-privacy-experts-are-worried-about-whatsapps-
new-privacy-policy/> last visited 14 April, 2021.

[[3]] FE Online, ‘Trouble mounts for WhatsApp as India starts ‘evaluating’ controversial new
privacy policy update’ The Financial Express (14 January, 2021) available at
<https://www.financialexpress.com/industry/technology/trouble-mounts-for-whatsapp-as-
india-starts-evaluating-controversial-new-privacy-policy-update/2171023/> last visited 13
April, 2021.

[[4]] PTI, ‘WhatsApp delays new privacy policy by three months amid severe criticism’
National Herald (16 January, 2021) available at
<https://www.nationalheraldindia.com/media/whatsapp-delays-new-privacy-policy-by-three-
months-amid-severe-criticism> last visited 14 April, 2021.

[[5]] Anumeha Chaturvedi, ‘New privacy policy will not impact how people communicate
privately with friends or family: WhatsApp’ (09 January, 2021) available at
<https://economictimes.indiatimes.com/tech/technology/new-privacy-policy-will-not-impact-
how-people-communicate-privately-with-friends-or-family-
whatsapp/articleshow/80181783.cms?from=mdr> last visited 13 April, 2021.

[[6]] Tech Desk, ‘WhatsApp updates terms of service and privacy policy: Why you need to
accept it’ Indian Express (Chandigarh, 16 January 2021) available at
<https://indianexpress.com/article/technology/social/whatsapp-new-2021-terms-of-service-
and-privacy-policy-new-changes-accept-or-delete-7134815/> last visited 14 April, 2021.

[[8]] Jagmeet Singh, ‘WhatsApp: Everything You Need to Know About the Controversial
Privacy Policy Update’ Gadget360 (22 February, 2021) available at
<https://gadgets.ndtv.com/apps/news/whatsapp-privacy-policy-update-changes-what-
happens-if-you-dont-agree-details-facebook-data-2376020, last visited April 12, 2021.

[[9]] supra Note 1.

[[11]] In Re: Updated Terms of Service and Privacy Policy for WhatsApp Users, Suo Moto
Case No. 01 of 2021, Competition Commission of India.

[13] Harshita Chawla v. WhatsApp Inc, CCI Case No. 15 of 2020, Competition Commision
of India

[[14]] PTI, ‘Ordered probe of WhatsApp policy on competition aspect: CCI to Delhi High
Court’ Economic Times (13 April, 2021) available at
<https://economictimes.indiatimes.com/news/india/ordered-probe-of-whatsapp-policy-on-
competition-aspect-cci-to-delhi-high-court/articleshow/82048168.cms> last visited April 15,
2021.

[[15]] Board of Control for Cricket in India v. CCI, COMPAT, Appeal No. 17 of 2013; supra
Note 13

[[16]] The Personal Data Protection Bill, 2019, Bill No. 373 of 2019.