WhatsApp must seek user approval before sharing data with Meta, rules NCLAT

The appellate tribunal has clarified that WhatsApp must obtain explicit and revocable user consent before sharing any data with Meta entities, covering both advertising and non-advertising uses, while granting the platform three months to implement required changes.

The National Company Law Appellate Tribunal (NCLAT) on Monday clarified that WhatsApp is required to seek user consent before sharing any form of user data with Meta companies, irrespective of whether the data is used for advertising or other purposes. The clarification was issued after the Competition Commission of India (CCI) sought greater certainty on the scope of the tribunal’s earlier ruling delivered on November 4.

A bench headed by NCLAT Chairperson Justice Ashok Bhushan said the requirement of consent applies uniformly to all data collected and shared by WhatsApp with its parent company Meta, removing any ambiguity surrounding the earlier order.

Background to the dispute

The matter traces back to WhatsApp’s 2021 privacy policy update, which required users to accept expanded data-sharing terms or risk losing access to the messaging service. The CCI had previously ruled that this amounted to coerced consent and imposed a ₹213.14 crore penalty on Meta Platforms and WhatsApp, along with restrictions on data sharing.

While the NCLAT upheld the regulator’s finding that the policy was exploitative, it set aside the CCI’s five-year ban on data sharing for advertising purposes. However, differing interpretations of the ruling prompted the CCI to approach the tribunal seeking clarification.

User choice at the core of ruling

Rejecting arguments from Meta and WhatsApp that no clarification was needed, the tribunal emphasised that user choice must exist at the stage where data is collected and shared. It held that WhatsApp cannot claim unrestricted rights over user data and must offer users a genuine opt-in and opt-out mechanism.

The NCLAT said that restoring meaningful user choice removes the “take-it-or-leave-it” nature of the 2021 policy. It further ruled that any non-essential or advertising-related data sharing must be backed by clear, voluntary, and revocable consent.

Compliance timeline and broader implications

During the hearing, WhatsApp sought additional time to implement system-level changes, citing operational complexity. While the tribunal initially considered a shorter deadline, it ultimately allowed three months for compliance, in line with the original order.

In its observations, the tribunal reiterated that users must retain control over what data is collected, how it is used, and for how long. The clarification strengthens regulatory oversight of digital platforms and reinforces consent as a foundational principle governing data-sharing practices in India’s digital economy.