In a significant development for digital privacy in India, the National Company Law Appellate Tribunal (NCLAT) has underscored that WhatsApp cannot collect or share user data without obtaining clear and meaningful consent from its users. The ruling reinforces the principle that users must be given a genuine choice before their personal information is processed or shared across platforms within the Meta group.

Background: The 2021 Privacy Policy Under Scrutiny

The case stems from WhatsApp’s 2021 privacy policy update, which triggered widespread concern among Indian users over data sharing with parent company Meta. The Competition Commission of India (CCI) had previously flagged the policy for potentially forcing users into a “take-it-or-leave-it” situation, arguing that such practices could amount to abuse of dominant market position.

NCLAT’s Key Observations on Consent

In its observations, the appellate tribunal stressed that consent must be freely given, specific, informed, and unambiguous. According to NCLAT, continued use of a service alone cannot be treated as implied consent when users are not provided with a real opt-out or alternative. This interpretation places a higher compliance burden on digital platforms operating at scale.

Implications for WhatsApp and Meta

The ruling effectively limits WhatsApp’s ability to automatically integrate user data with Meta’s broader advertising and business ecosystem in India. Any such data collection or sharing would now require explicit approval from users, potentially reshaping how Meta monetises WhatsApp in one of its largest global markets.

Impact on India’s Digital and Startup Ecosystem

Legal experts believe the decision could have ripple effects across India’s app economy. Large digital platforms may need to revisit consent flows, privacy notices, and data-sharing agreements. For Indian startups, the ruling offers a clearer benchmark on how user consent should be structured to remain compliant with competition and data protection norms.

Alignment With India’s Evolving Data Protection Framework

The NCLAT’s stance also aligns with India’s broader push toward stronger data protection and user rights. While the country continues to refine its digital personal data governance framework, the tribunal’s ruling signals that competition law will play a parallel role in regulating data-driven business models.

What Happens Next

WhatsApp may still explore legal remedies or policy adjustments to align with the ruling. However, for users, the message is clear: consent is no longer a formality but a mandatory requirement for data collection and sharing in India’s digital marketplace.