Factual background of the case

The case was initiated on a suo moto basis where the Competition Commission of India (CCI) found the privacy policy update of WhatsApp in 2021 in prima facie violation of the Competition Act, 2002. The content of the update was that the users have to either consent to cross-sharing of their data on WhatsApp with other Meta group of companies such as Facebook and Instagram, or stop using WhatsApp at all. The Commission held that the ‘take-it or leave-it’ nature of the policy leaves consumers at a disadvantage thereby requiring detailed consideration of the matter. The suo moto matter was then clubbed with two separate complaints filed by one Prachi Kohli and non-profit organisation Internet Freedom Foundation on similar issues at a later date.

CCI order

The Commission in its 156-page order has found a case of violation of section 4 of the Act, i.e. abuse of dominance, against WhatsApp and Meta. The CCI, first established its jurisdiction on matters related to data protection and delineated two ‘relevant markets (RM)’, i.e. ‘OTT messaging apps through smartphones’ and ‘online display advertising’ in India, for consideration. While the CCI held WhatsApp dominant in the first RM, i.e. market for OTT messaging apps through smartphones in India, the second RM was defined to identify competitive constraints on the business operations of Meta.

The assessment of the Commission revolved around the fact that the main objective of the WhatsApp privacy policy update in 2021 was to ensure that Meta is able to monetise the vast WhatsApp user database through sale of advertisements on other platforms such as Facebook and Instagram. As far as establishing a case of abuse is concerned, the Commission duly focused on the ‘consumer welfare’ standard while noting its findings. The CCI held that the ‘take-it or leave-it’ privacy policy left the users with no alternative but to accept expansive data collection terms thereby undermining their autonomy and violating provisions of the Act. Additionally, the cross-sharing of user data between WhatsApp and other Meta group of companies gives them an unfair advantage in the advertising market to the detriment of competitors thereby further violating the law. It then subsequently imposed a penalty of ~INR 213 crore along with some behavioural remedies.

Analysis

Jurisprudential value

The unique jurisprudential value of this decision lies in the question whether the competition authority could exercise its jurisdiction in India on matters related to personal data protection subject to market power of the data fiduciary. The question is of importance as the Indian competition authority till the date of this order wasn't able to take a clear position on this issue. For instance, the Commission, even though, observed that privacy violation, when happening at a policy level, may very well be a competition concern in one of its market studies, it added a rider that there is a converse thought that data protection violation is inherently a consumer protection issue. In such a case, reliance paid by the CCI on the Excel crop care decision was reassuring which held that ‘consumer welfare’ ought to weigh in various factors such as better choice, good quality and lower prices under competition lawwhich fits well in the facts of the case. To be doubly sure on its jurisdiction in the given case, the Commission duly highlighted the part that the allegations also pertain to cross-use of non-personal data.

Theory of harm

As far as the theory of harm is concerned, the Commission has developed the same to the requisite legal standard. It is now well established through international precedent that cross-utilisation of data by a dominant firm qualifies as an abuse under antitrust law. One aspect, though, which remains unaddressed is the question around profiling of users. This factor is important given the granular nature of personal data available when it comes to the usage of products such as Facebook and WhatsApp. The harm caused in such a scenario could be much more serious as compared to restricted effects as measured by the CCI in the given order on one of the relevant markets. This was, indeed, one of the considerations when it came to reviewing the Facebook-WhatsApp merger under the EU law.

Impact on DCB and ex-ante regulation discourse

The timing of the decision is equally important. The order is passed when the Draft Digital Competition Bill (DCB), 2024 is pending with the government for consideration. The DCB, in essence, puts an ex-ante regime in place on the lines of the Digital Markets Act (DMA) in the EU for the tech companies to comply. One of the substantive provisions of the DMA is a ban on cross-utilisation of data, a practice which has been brought to the core in this matter. It remains yet to be seen whether this contravention order would have any impact on the DCB. The Commission took almost four years to dispose this case. Even though much of the delay could be attributed to Meta which indulged in multiple rounds of forum shopping, this is important simply because the purpose of enactment of ex-ante rules and the need for faster disposal of cases is common, i.e. ensure timely course correction of the market.

Policy implications

There are a couple of policy implications of the decision as well. First is on the delineation of relevant markets. The second relevant market as defined by the DG, in concurrence with the CCI, is ‘online display advertising’ in India. This may not reflect the current market dynamics, or to put it in other words - how regulatory action is converging in other jurisdictions. The evidence is increasingly emerging in the favour of a narrower RM, i.e. ‘online display advertising on social media’ in the given facts, as the purpose of delineating the RM is to identify competitive constraints on the firm. While the net beneficiary of this omission is naturally Meta Group which escaped the finding of dominance and subsequent liability in the second RM, it is unclear whether this was an oversight on the part of the Commission, or a conscious pass given to the company given the overarching objective of digitising the Indian economy in which Meta’s line of products play a key role.

The other implication is the redaction of key information from the public version of the order. While the general practice is to just omit commercially sensitive information such as number of active users, percentage of available market share and growth observed over years for the companies, the Commission has gone beyond and foreclosed even the total turnover of the Respondent in this case. For instance, it is unknown whether the total penalty imposed on Meta Group, i.e. ~INR 213 crore, constitute 1% or 4% of the total revenue of the company. This is an abbreviation of the existing standards at the CCI.

Way forward

Meta has already declared that it is going to appeal the decision. It wouldn't be the monetary fine which would be as concerning to the company as other behavioural remedies such as stoppage on cross-sharing of data across group companies. The company might have its best shot on two counts, i.e. pro-competitive effects of combining data obtained through various lines of business resulting in enhanced user experience and application of effects-based approach under ‘As-Efficient-competitor (AEC) test’ for any finding of contravention to materialise. The jurisprudence on both the issues, though, is unsettled. For now, the scale seems titled in the favour of the Commission.