4 min readFeb 19, 2026 07:43 AM IST
First published on: Feb 19, 2026 at 07:42 AM IST
Digitalisation of markets has resulted in consumer data being continuously extracted from individuals’ online activities. Cross-market data use generates privacy harms and may also reinforce data-driven market power through targeted advertising, and reduction of consumer surplus by employing personalised pricing.
Regulatory authorities have focused on strengthening users’ rights over personal data. India’s Digital Personal Data Protection Act, 2023 does so through informed consent and rights to access, correct, and erase data. However, the consumer control approach has shortcomings: The equilibrium level of data collection can still be socially excessive, and users may not be able to exercise privacy choices effectively. To be clear, excessive data extraction is a structural phenomenon driven by network effects and the bottleneck position of digital platforms that may create competition and societal harms. Against this backdrop, India’s competition regulator, the Competition Commission of India (CCI), took cognisance of the competition harm in WhatsApp’s 2021 policy update.
The regulator observed that WhatsApp’s privacy policy update imposed a “take it or leave it” condition on users, essentially an adhesion contract, by preconditioning access on sharing of WhatsApp data with all Meta-affiliated companies. The policy update left users with no meaningful choice. The CCI imposed a penalty of Rs 213.14 crore and issued remedies including a five-year ban on data sharing by WhatsApp for advertising purposes, transparency with respect to data sharing, and the provision of an opt-out mechanism.
The National Company Law Appellate Tribunal (NCLAT) upheld the CCI’s decisions on the penalty and the opt-out mechanism, but overturned the ban on data sharing for advertising purposes. The Supreme Court in a recent hearing has challenged the relief granted by NCLAT and questioned the effectiveness of WhatsApp’s opt-out framework.
Whether it is the Court’s recent observation that the consent mechanism is an agreement between “lion and lamb”, or the NCLAT ruling — which partially upheld the CCI’s decision — this marks a watershed moment in India’s digital governance. The decision signals a paradigm shift in the Indian antitrust architecture as it has made privacy and data-related aspects integral to competition law enforcement. A dominant firm’s practice of collecting, combining and sharing data has become increasingly relevant as such data-related practices reinforce market power. The WhatsApp update was a strategy to tie the provision of services in one market to the acceptance of a privacy policy that allowed the bundling of user data across Meta-affiliated markets. The impugned policy arose from the imbalance of power between users and WhatsApp.
When a dominant platform controls essential digital infrastructure, then the notion of consent warrants deeper scrutiny. The CCI’s directives to WhatsApp and Meta not to make WhatsApp access conditional on data sharing attempts to protect competition.
Dominant firms do not always clearly disclose the extent and type of data collected, its purpose and use. This puts the firm in a unique position to gather information, far beyond what is necessary to provide the service. Compromised privacy practice is both exploitative and exclusionary. The regulator’s directives have clearly gone beyond consent and data protection, and attempt to mitigate data-driven market power. It has redesigned not just how users consent but has also reshaped how digital firms operate. NCLAT, however, limited the remedies to the core issue of exploitation by restoring user choice, but did not address the entrenchment question.
A recent policy brief (‘Economics of data-driven markets’, ICRIER) emphasises that regulation should move beyond consent-only frameworks and address data extractivism when network effects are strong and datasets unique or accumulated through entrenched intermediation. The CCI-WhatsApp battle is clearly a pivotal chapter in India’s regulatory evolution as it blends data governance and competition policy, with the court now considering the matter through a rent-seeking lens.
Jakhu is at IIM Bangalore, Malik and Khan are at ICRIER-Prosus Centre
