In a significant decision that reinforces digital privacy rights, the National Company Law Appellate Tribunal (NCLAT) has mandated that WhatsApp must secure explicit consent from its users before sharing any of their data with its parent company, Meta. This ruling, delivered on December 16, 2025, upholds a previous directive from India's competition watchdog and sets a crucial precedent for data handling by technology platforms operating within the country.
The Core of the NCLAT Verdict
The appellate tribunal dismissed the appeal filed by WhatsApp LLC and its parent entity, Meta Platforms Inc., against an order from the Competition Commission of India (CCI). The CCI had initially found the messaging giant's 2021 privacy policy update to be exploitative and lacking in transparency. The NCLAT bench, comprising Justice Yogesh Khanna and Alok Srivastava, firmly stated that WhatsApp cannot share user data for any purpose without obtaining clear and voluntary consent.
This ruling directly addresses the controversial practice where data from WhatsApp users—including transaction data, mobile device information, and IP addresses—was being shared with Meta for targeted advertising and other purposes. The tribunal emphasized that the "take-it-or-leave-it" approach of the 2021 policy update was not acceptable. Users must be given a genuine choice, and their consent cannot be assumed or bundled into a single acceptance of terms and conditions.
Background and the CCI's Investigation
The legal journey began when the CCI took suo moto cognizance of WhatsApp's updated privacy policy in March 2021. The commission launched a detailed investigation, concluding that the policy was anti-competitive and violated user privacy. A key finding was that WhatsApp was leveraging its dominant position in the instant messaging market to force users into agreeing to terms that allowed extensive data sharing with Meta.
The CCI's order, which the NCLAT has now upheld, required WhatsApp to cease this practice. The tribunal noted that the data-sharing arrangement between WhatsApp and Meta created a "data advantage" for the broader Meta ecosystem, including Facebook and Instagram, potentially stifling competition from smaller rivals who do not have access to such vast, interconnected user data.
Implications for Users and the Tech Industry
This judgment marks a pivotal moment for digital rights in India. For the over 500 million WhatsApp users in the country, it means regaining a measure of control over their personal information. Moving forward, WhatsApp will be legally obligated to implement a clear and separate consent mechanism specifically for data sharing. Users should expect to see new prompts or settings that allow them to opt-in or opt-out of having their data shared with Meta for purposes like ad targeting and product development.
The ramifications extend beyond a single company. The NCLAT's decision sends a strong signal to all technology firms operating in India that bundling consent or using dominant market position to extract broad data permissions will not be tolerated. It reinforces the principle that user consent must be specific, informed, and unambiguous. This ruling could influence ongoing policy discussions around India's Digital Personal Data Protection Act and how it is implemented, setting a high bar for compliance.
While the NCLAT did not impose any additional monetary penalties on top of the CCI's earlier fine, the legal and operational cost for WhatsApp to redesign its data practices will be substantial. The company must now demonstrate to Indian authorities that it is in full compliance with this consent-based framework, a process that will be closely watched by regulators and privacy advocates worldwide.
