Think back to the day you first downloaded WhatsApp. A privacy policy appeared: Dense, legal, long. You scrolled to the bottom, ticked the box, and moved on. What you likely did not know was that by accepting, you agreed to let the platform share your phone number, profile name, photo, and usage patterns with Facebook’s group companies. Not to protect you, but to build a behavioural profile for advertisers. WhatsApp maintained that your messages remained encrypted. What it was less forthcoming about was everything else: The metadata, the signals, the digital traces that, assembled, can reveal more about a person than the messages themselves.
That invisible transaction is now before the Supreme Court of India. In 2021, WhatsApp updated its privacy policy, replacing any opt-out with a stark ultimatum: Accept cross-platform data sharing, or stop using the app. The Competition Commission of India imposed a penalty of Rs 213.14 crore and a five-year bar on sharing user data for advertising. Meta challenged this before the National Company Law Appellate Tribunal, which upheld the penalty but struck down the ban.
Meta then appealed to the Supreme Court, which has been sharply unsympathetic, calling the practice a “decent way of committing theft of private information” and a “mockery of constitutionalism”. The Chief Justice observed that opting out of WhatsApp is akin to “opting out of the country,” capturing precisely why consent within a monopoly is not real consent. The Court has since warned Meta to cease data sharing or face dismissal of its appeal and “very strict conditions”.
What makes this more than a regulatory dispute is the deeper question the Court has raised. Justice Bagchi shifted the debate from privacy to value: If the behavioural data of Indian users fuels billions in advertising revenue, who owns the profits?
This is the logic of surveillance capitalism, a term coined by scholar Shoshana Zuboff for an economic system in which human behaviour is harvested and sold without compensating those from whom it originates. The Solicitor General’s observation that users are “not only consumers, but also products” captures the growing discomfort with the myth of the “free” internet. India’s law is largely silent on who profits from data once collected. The Court’s reference to “rent-sharing” suggests that silence is no longer tenable.
The problem runs deeper than profit. Consider why you ended up on WhatsApp. Just because everyone you knew was already there. Economists call this path dependency: Once enough people commit to a platform, leaving becomes prohibitively costly, and the original choice ceases to be a choice. That is how Big Tech consolidates power: Not through force, but by making itself impossible to leave.
This question has already been answered elsewhere. WhatsApp’s 2021 update created a two-tier system based on geography. Users in the European Union (EU) and the United Kingdom, protected by the General Data Protection Regulation (GDPR), were not required to accept the new data-sharing terms. Everywhere else, including India, the update was mandatory. The dividing line was regulatory, not technological. WhatsApp applied stricter standards where the law demanded it.
The EU built its framework in layers. The GDPR, in force since 2018, governs how companies collect and use personal data, requires informed consent, and grants users the right to access, correct, and delete their data. India’s Digital Personal Data Protection Act (DPDP) of 2023 shares some of this DNA, but has yet to be fully operationalised, with implementing rules still pending notification. The architecture may look similar on paper; the institutional muscle behind it is not.
Where the comparison grows more uncomfortable is in what comes after the privacy law. The EU recognised that a company could comply with data rules and still cause significant harm through market dominance. Two further instruments address this.
The Digital Services Act (DSA) bans targeted advertising based on sensitive personal data, prohibits all profiling-based advertising directed at children, and explicitly outlaws dark patterns (the deliberately confusing interface designs that nudge users into consenting to things they do not understand). What the Supreme Court criticised in WhatsApp’s consent mechanism, the DSA has already prohibited in Europe. India has no equivalent protection.
The Digital Markets Act (DMA) goes further. It designates dominant platforms as “gatekeepers”, companies so large that they control access to entire markets. In September 2023, the European Commission designated Meta as a gatekeeper across Facebook, Instagram, WhatsApp, Messenger, and its advertising services. The qualifying threshold is 45 million monthly active users in the EU. WhatsApp crossed that figure in India years ago, yet no equivalent designation exists under Indian law.
Article 5 of the DMA prohibits gatekeepers from combining personal data across platforms without explicit, penalty-free consent, a restriction absent from the DPDP Act. The DMA also mandates interoperability: Users on competing messaging platforms must be able to communicate directly with WhatsApp users, structurally reducing switching costs and making competition real. India has no such mandate. The DPDP Act applies identical rules to all apps regardless of scale, treating WhatsApp and a start-up as equivalent actors in a market that is anything but equal.
The lesson is not to copy European law wholesale. The GDPR, DSA, and DMA emerged from a specific legal and political tradition, and transplanting them without adaptation raises legitimate questions of fit. But the underlying logic is universal: Privacy law alone cannot protect citizens when the entity collecting their data also controls the infrastructure they cannot live without. India needs not just a law that tells Meta how to handle data, but a framework that limits what it can do with its market power.
The Supreme Court has sensed this. The question is whether the legislature and the executive are willing to follow where the judiciary is pointing.
Bhargava is a Public Policy student, and Kaushik teaches Economics at FLAME University, Pune. Views are personal
