SC Pulls Up WhatsApp, Meta Over Data Sharing, Questions ‘Opaque’ Privacy Policies

The Supreme Court on Tuesday warned WhatsApp and its parent company Meta, regarding the platform’s data-sharing practices and the opacity of privacy policies.

Hearing appeals filed by Meta Platforms and WhatsApp against a ruling of the National Company Law Appellate Tribunal (NCLAT), the court cautioned that users’ personal data cannot be used for commercial gain. The NCLAT had upheld a ₹213.14 crore penalty imposed by the Competition Commission of India (CCI) over WhatsApp’s 2021 privacy policy.

A bench comprising Chief Justice of India (CJI) Surya Kant, Justice Joymalya Bagchi, and Justice Vipul Pancholi admitted the appeals but made it clear that it would closely scrutinise WhatsApp’s data practices. “You cannot play with the privacy of our country. We will not allow you to share even a single digit of our data,” the CJI warned.

The court was also hearing a cross-appeal by the CCI challenging the NCLAT’s decision to permit Meta and WhatsApp to share user data for advertising purposes, despite upholding the monetary penalty. The regulator has argued that such data sharing is central to WhatsApp’s abuse of dominance in India’s messaging market.

CJI Kant observed that privacy policies framed by global technology companies were often “so cleverly worded” that ordinary citizens could not understand their true implications. He added that WhatsApp’s dominance left users with little choice, describing the platform as having created a monopoly and “making a mockery of constitutionalism” by undermining the fundamental right to privacy.

When senior advocate Akhil Sibal, appearing for WhatsApp, argued that users had the option to opt out of the 2021 policy, the bench questioned the meaningfulness of such consent. “Will a poor woman selling fruits on the street understand your policy? Will your domestic help understand it?” the CJI asked, describing the practice as a “decent way of committing theft of private information”.

The court said it would not proceed further unless Meta and WhatsApp gave an undertaking that users’ personal data would not be used. Senior advocate Mukul Rohatgi, representing Meta, informed the bench that the penalty amount had already been deposited and a Constitution Bench was separately examining WhatsApp’s privacy policy. He also referred to assurances that users would not be barred for refusing to accept the 2021 policy.

Rohatgi cited the Digital Personal Data Protection Act, 2023, which allows time for compliance until May 2027, though Justice Bagchi noted that the law is yet to come into force. Solicitor General Tushar Mehta, appearing for the government, submitted that personal data was not only being sold but also commercially exploited.

Justice Bagchi said the court would examine how WhatsApp monetises behavioural data for targeted advertising, noting that every silo of data has commercial value. CJI Kant echoed this concern, recounting his own experience of receiving targeted advertisements shortly after getting health-related WhatsApp messages.

Meta’s lawyers maintained that WhatsApp messages are end-to-end encrypted and inaccessible even to the platform. However, the bench also pointed out gaps in India’s data protection regime, observing that, unlike European regulations, the DPDP Act does not address the commercial value of shared data.

Facing sustained questioning, Meta agreed to file an affidavit explaining its data practices. The court accepted the proposal, adjourned the matter to next week, and impleaded the Ministry of Electronics and Information Technology as a party to the case.