Beyond Privacy - Framing Coercive Data Collection As Antitrust Harm In CCI V. Meta Platforms

Author: LawSphereX

Category: Corporate & Insolvency

Published: 2026-08-23T18:29:28.896685+00:00

Updated: 2026-08-26T17:11:48.352+00:00

BEYOND PRIVACY: FRAMING COERCIVE DATA

COLLECTION AS ANTITRUST HARM IN CCI V. META

PLATFORMS

Rishab Ramakrishna, O.P. Jindal Global University

ABSTRACT

This paper analyses the Competition Commission of India’s (CCI) investigation into Meta Platforms Inc and the subsequent 2025 ruling of the National Company Law Appellate Tribunal (NCLAT) arising from WhatsApp’s 2021 privacy policy update. Meta argued that the CCI lacked jurisdiction, contending that data-sharing conduct falls exclusively within data protection legislation. This paper rejects that argument and contends that the intervention was a defensible and necessary application of competition law, because coercive data collection by a dominant firm constitutes a form of antitrust harm that data protection frameworks are structurally illequipped to address.

The paper analyses three dimensions of the dispute: the jurisdictional relationship between competition law and data protection as parallel and complementary frameworks; the theory of market foreclosure under Section 4(2)(c) of the Competition Act 2002 as reformulated by the NCLAT after it set aside the original Section 4(2)(e) leveraging finding; and the characterisation of the take-it-or-leave-it consent mechanism as an unfair condition under Section 4(2)(a)(i). The paper argues that the NCLAT’s partial reversal of the CCI’s order, including the setting aside of the five-year data-sharing ban, produces a more doctrinally coherent and durable enforcement framework than the original order, by grounding liability in the group’s aggregate conduct and anchoring relief in a proportionate, consent-based remedy.

The paper also considers the subsequent Supreme Court proceedings, in which the Chief Justice characterised WhatsApp’s consent model as a form of theft of private information.

Introduction In a time marked by the clash between global tech giants and national regulators, the Competition Commission of India’s (CCI) investigation into Meta Platforms Inc1 and the subsequent 2025 ruling by the National Company Law Appellate Tribunal (NCLAT)2 constitute a pivotal moment for digital market regulation. The case began with a suo motu inquiry by the CCI into WhatsApp’s 2021 privacy policy update and its requirement that WhatsApp users share data with Meta’s broader corporate group. Meta argued that the issue was one of data privacy alone, falling exclusively under India’s Digital Personal Data Protection Act 2023 or the Information Technology Act 2000. The CCI countered that once a data-sharing policy is deployed by a market-dominant firm to foreclose competition and exploit consumers, it crosses from privacy regulation into antitrust territory.

This paper argues that the CCI’s intervention was not a jurisdictional overreach but a necessary and defensible application of competition law in a data-driven economy. A framework that confines data-extraction conduct entirely to a data protection authority creates a regulatory blind spot, as it ignores the structural market distortions that data dominance generates and leaves no remedy for the harm to the competitive process. By characterising the degradation of user privacy as a non-price parameter of competition and identifying coercive data collection as the mechanism for entrenching market power, the CCI identified a form of antitrust harm that is both novel and well-grounded in the statute. 3 That said, the case’s trajectory through the NCLAT complicates any simple narrative of vindication.

The tribunal upheld the CCI’s core findings under Section 4(2)(a)(i)4 and Section 4(2)(c)5 of the Competition Act 2002, but set aside the Section 4(2)(e)6 leveraging finding and the five-year blanket ban on data sharing. These partial reversals are analytically significant and deserve honest engagement, as they reveal both the limits of the traditional leveraging framework in ecosystem markets and the courts’ preference for targeted, proportionate remedies over structural prohibitions. This paper analyses three dimensions of the dispute in

1 In re Updated Terms of Service and Privacy Policy for WhatsApp Users, Suo Motu Case No. 01 of 2021

(Competition Comm’n of India Nov. 18, 2024) [hereinafter CCI WhatsApp Order]. 2 WhatsApp LLC v. Competition Comm’n of India, Competition Appeal No. 1 of 2025 (Nat’l Co. Law Appellate Tribunal Nov. 4, 2025) [hereinafter NCLAT Judgment].

3 Competition Act, 2002, § 4 (India).

4 Competition Act, 2002, § 4(2)(a)(i) (India).

5 Competition Act, 2002, § 4(2)(c) (India).

6 Competition Act, 2002, § 4(2)(e) (India).

turn: the jurisdictional boundary between competition law and data protection; the theory of harm under Section 4(2)(c)7 as reformulated by the NCLAT; and the coercive consent mechanism under Section 4(2)(a)(i)8. The paper’s original contribution is to demonstrate that the NCLAT’s partial reversal, far from undermining the CCI’s approach, actually produces a more doctrinally coherent and durable framework for regulating data-driven abuses of dominance in platform markets. I. The Jurisdictional Fault Line: Competition Law and Data Protection as Parallel

Frameworks The first central tension in this dispute is the jurisdictional boundary between antitrust enforcement and specialised data protection frameworks. Meta argued that the CCI overstepped its statutory mandate, asserting that scrutiny of its 2021 Privacy Policy fell strictly under data protection legislation, specifically the Information Technology Rules 2011 and the Digital Personal Data Protection Act 2023. 9 From this perspective, a competition authority lacks the legal remit to oversee how user data is extracted and processed. This argument must be rejected on both statutory and structural grounds. The CCI’s explicit mandate10 under the Competition Act 2002 is to prohibit the abuse of a dominant position.

11The regulator’s role in this case was not to police the legality of the privacy policy itself but to assess its economic effects on market structure, namely whether a market-dominant entity coercively enforced data-sharing terms to foreclose competition and exploit consumers. By framing the degradation of user privacy as a non-price parameter of competition, the CCI placed Meta’s conduct squarely within its antitrust jurisdiction. 12 The two regulatory frameworks ask fundamentally different questions and are therefore complementary rather than mutually exclusive. The OECD policy paper on the intersection between competition and data privacy articulates this relationship precisely, observing that competition law and data privacy law share ‘family ties’ in their common objective of protecting individual welfare. 13 When companies build

7 Competition Act, 2002, § 4(2)(c) (India).

8 Competition Act, 2002, § 4(2)(a)(i) (India).

9 CCI WhatsApp Order, supra note 1, at 10.

10 Competition Act, 2002, pmbl. (India).

11 CCI WhatsApp Order, supra note 1, at 73.

12 NCLAT Judgment, supra note 2, at 37.

13 Carolina Abate, Giuseppe Bianco & Francesca Casalini, The Intersection Between Competition and Data

market power on the collection and processing of data, their handling of such data becomes a concern not only for data protection authorities but also for competition authorities. The NCLAT affirmed this explicitly: while data privacy law asks whether individual consent was obtained in compliance with legal standards, competition law asks whether a company’s conduct has distorted competition or misused market power.14 The existence of the DPDP Act

2023 does not render the CCI redundant, as both frameworks operate in parallel, addressing

different dimensions of the same conduct. 15 This position is now the global consensus. The Grand Chamber of the Court of Justice of the European Union confirmed in Meta Platforms Inc v Bundeskartellamt16 that when assessing abuse of dominance, violations of data privacy rules can form an integral part of the competition law assessment. The OECD has noted the successful application of Section 19a of Germany’s Competition Act to prohibit Meta’s practice of combining user data across multiple services without consent, recognising that such practices simultaneously exploit consumers and disadvantage competitors. 17 The CCI’s intervention in the WhatsApp case is therefore not a jurisdictional anomaly but a progressive and necessary alignment with established international antitrust standards for data-driven markets. II.

Data as a Fortress: Aggregation, Market Foreclosure, and the NCLAT Reformulation

Traditionally, firms have competed on the basis of production and distribution capacity. In platform markets, however, competitive advantage has shifted decisively toward data.18 The CCI argued that Meta’s mandatory pooling of WhatsApp user data with its other platforms

created an unassailable advantage that stifles competition in the digital advertising market.19 This advantage is driven by strong network effects and dynamic economies of scale, producing a snowball effect in which the gap in data holdings between the market leader and smaller competitors continuously widens.20 Privacy 8 (OECD Competition Committee Discussion Paper, 2024).

14 NCLAT Judgment, supra note 2, at 19.

15 NCLAT Judgment, supra note 2, at 37–38.

16 Meta Platforms Inc v. Bundeskartellamt, Case C-252/21, EU:C:2023:537 (Grand Chamber, Court of Justice of the E.U. July 4, 2023). 17 OECD, Competition Policy in Digital Markets: The Combined Effect of Ex Ante and Ex Post Instruments in G7 Jurisdictions 8 (OECD Publishing 2024), https://doi.org/10.1787/80552a33-en .

18 Koh Chun Yik, Research on Anti-Monopoly Regulation of Data Merge in the Era of Data-Driven

Competition, 8 Peking U. L.J. 63, 63 (2020).

19 CCI WhatsApp Order, supra note 1, at 133.

20 Mads Breum Wittrup & Karoline Lund Jakobsen, Data-Driven Competition: Network Effects, Economies of

The continuous accumulation and combination of user data by large platforms allows these entities to exponentially strengthen their market power and facilitate foreclosure strategies. 21 The CCI’s investigation corroborated this structural harm with extensive third-party evidence. 22 Snap submitted that Meta’s data advantage, combined with the 2021 Policy, forecloses effective entry for smaller firms. 23 Inuxu and Xapads stated that Meta’s access to WhatsApp’s data would render it the undisputed leader in digital advertising, forcing competing businesses to ‘suffocate’ on data inequality and creating a commercially unviable playing field. 24 Meta’s defence, that data is non-rivalrous and available from third-party brokers25, was considered and rejected.

As the joint Franco-German competition authority study noted, privacy policies must be assessed from a competition standpoint when data serves as a primary input, and third-party data is systematically less valuable than first-party data generated through direct user interaction. 26 Within its walled garden, Meta generates unique behavioural and social insights that competitors cannot replicate. 27 The NCLAT affirmed the Section 4(2)(c)28 theory of harm but introduced a critical legal nuance. The CCI had originally found violations under both Section 4(2)(c), the denial of market access, and Section 4(2)(e), leveraging dominance from one market to protect position in another. The NCLAT upheld the former but set aside the latter.

29 The Section 4(2)(e) finding was set aside on a specific and narrowly drawn ground: Meta and WhatsApp are distinct legal entities, and Meta was not found to be dominant in the online display advertising market, only a leading player given the competition from Google and others. 30 The leveraging provision requires dominance in the originating market and its exercise to protect position in a second market. Because Meta’s dominance was established only in the Scale and Market Foreclosure 16 (Master’s Thesis, Copenhagen Bus. Sch. 2019), https://researchapi. cbs. dk/ws/portalfiles/portal/59801859/687835_Master_Thesis_116429_116585. pdf .

21 OECD, supra note 17, at 7.

22 NCLAT Judgment, supra note 2, at 64–66.

23 Id. at 65–66.

24 CCI WhatsApp Order, supra note 1, at 117–118; NCLAT Judgment, supra note 2, at 64.

25 Meta Platforms Inc v. Competition Comm’n of India, Competition Appeal No. 2 of 2025, at 151 (Nat’l Co. Law Appellate Tribunal Nov. 4, 2025). 26 Bruno Lasserre & Andreas Mundt, Competition Law and Big Data: The Enforcers’ View, 4 Antitrust & Pub. Policies 5, 5 (2017).

27 CCI WhatsApp Order, supra note 1, at 138.

28 Competition Act, 2002, § 4(2)(c) (India).

29 NCLAT Judgment, supra note 2, at 157.

30 NCLAT Judgment, supra note 2, at 153–154.

OTT messaging market through WhatsApp, and not in the advertising market, the Section 4(2)(e) route was technically unavailable. 31 It is important to emphasise that this is a legal impediment arising from corporate structuring and not an exoneration of the underlying conduct. The NCLAT itself acknowledged that the economic reality, being 100% ownership, common executives, and WhatsApp’s lack of standalone financial statements, meant WhatsApp operated effectively as an agent of Meta. 32 The NCLAT’s response to this gap was doctrinally significant. It held that Section 4(2)(c), which prohibits an ‘enterprise or group’ from ‘indulging in practice or practices resulting in denial of market access in any manner’,33 can be established independently of Section 4(2)(e) and does not require the enterprise to hold dominance in the market where denial occurs.

Since Meta exercises complete control over WhatsApp, and since the statute expressly applies to a ‘group’, the collective data-sharing practices of the Meta group satisfy the Section 4(2)(c) standard even in the absence of formal dominance in the downstream advertising market. 34 The NCLAT confirmed that cross-platform data sharing increases Meta’s advantage and creates conditions in which rivals cannot effectively compete for advertisers. 35 This reformulation is the most important doctrinal contribution of the case. Indian competition jurisprudence has now recognised that ecosystem-driven market foreclosure, where dominance in one market produces exclusion in an adjacent one through data integration, can be reached under Section 4(2)(c) even when traditional leveraging analysis fails because of corporate structure.

This is a more nuanced and ultimately more durable holding than a straightforward Section 4(2)(e) finding would have been, because it is grounded in the group’s aggregate conduct rather than a single entity’s formal market position. 36 III. The Illusion of Choice: Coercive Consent as Abuse of Dominance

The case against Meta is not limited to the economic consequences of data aggregation but also concerns the mechanism by which that data was extracted. The 2021 WhatsApp policy update was presented to users on a ‘take-it-or-leave-it’ basis: acceptance of expanded data-sharing

31 Id. at 155–156.

32 NCLAT Judgment, supra note 2, at 155.

33 Competition Act, 2002, § 4(2)(c) (India).

34 NCLAT Judgment, supra note 2, at 155.

35 Id. at 155.

36 Id.

terms with the Meta group was a condition for continued use of the service, with no opt-out option. When a platform with strong direct network effects makes continued access contingent on broad consent, the resulting ‘choice’ is structurally coerced rather than freely given. The NCLAT affirmed that WhatsApp users were compelled to accept expanded data-sharing terms with Meta without the option to opt out, leaving them no genuine choice but to consent or forgo the service. 37 This lock-in effect is compounded by the ‘privacy paradox’: even users who express concern about privacy do not act on it, a consequence of information asymmetries and a structural absence of meaningful alternatives created by dominant platforms. 38 The degradation of privacy is thus not merely a welfare harm to individual users.

It is the instrument by which market power is exercised, because it extracts data that competitors cannot access and entrenches the dominant firm’s position. The CCI found that the architecture of consent in the 2021 policy was designed to minimise resistance. The ‘Accept’ button was rendered prominently, a sense of urgency was created by a compliance deadline, and the policy’s implications for cross-platform data sharing were not surfaced clearly. 39 These techniques are instances of what Stucke has termed ‘dark patterns’, being interface designs that manipulate, subvert, or impair user autonomy and decision-making in ways that systematically favour the platform. 40 Larsson’s empirical work has similarly demonstrated that the complexity and opacity of data collection and processing architectures make it practically impossible for the average user to make an informed, independent choice.

41 Under Section 4(2)(a)(i) of the Competition Act, an abuse occurs where a dominant enterprise directly or indirectly imposes an unfair or discriminatory condition in the purchase or sale of goods or services. 42 The NCLAT held that the mandatory data-sharing condition satisfied both elements of this provision: there was an ‘imposition’ through the take-it-or-leave-it rollout and an ‘unfair condition’ through the extraction of consent to cross-platform data sharing without a meaningful opt-out. 43 The tribunal expressly recognised privacy degradation as a non-price

37 NCLAT Judgment, supra note 2, at 137.

38 Wolfgang Kerber, Digital Markets, Data, and Privacy: Competition Law, Consumer Law and Data

Protection, 11 J. Intell. Prop. L. & Prac. jpw150, jpw156–jpw157 (2016).

39 CCI WhatsApp Order, supra note 1, at 74.

40 Maurice E. Stucke, Addressing Personal Data Collection as Unfair Methods of Competition, 38 Berkeley Tech. L.J. 753, 753 (2023). 41 Stefan Larsson, Putting Trust into Antitrust? Competition Policy and Data-Driven Platforms, 36 Eur. J. Commc’n 391, 399 (2021).

42 Competition Act, 2002, § 4(2)(a)(i) (India).

43 NCLAT Judgment, supra note 2, at 137–138.

parameter of competition, giving it the same analytical status as price, quality, or output. This approach is consistent with the most developed international precedents on the topic. Germany’s Bundeskartellamt found that Facebook’s method of obtaining consent was inadequate and invalid because users were required to consent to comprehensive data collection as a condition of accessing all Facebook services, constituting an abuse of dominance. 44 Similarly, the Italian Competition Authority fined WhatsApp for exercising undue influence by compelling users to accept its terms of use in full without genuine choice, finding that such a take-it-or-leave-it mechanism was commercially coercive in the context of a platform with no real substitute.

45 As Lancieri and Sakowski have observed, the overarching principle across these cases is that where users must accept terms because they lack real alternatives, there is no free or independent consent, and data protection law and antitrust law converge in condemning the practice. 46 IV. Remedies and the Principle of Proportionate Correction

The CCI’s original remedial order combined financial penalties with structural and behavioural measures. It imposed a five-year ban prohibiting WhatsApp from sharing user data collected on its platform with other Meta companies for advertising purposes,47 and levied a financial penalty of Rs 213. 14 crore on Meta for violation of Section 4 of the Competition Act. 48 On appeal, the NCLAT subjected these remedies to proportionality scrutiny and found the fiveyear blanket ban to be disproportionate. The tribunal noted that the CCI’s order provided no reasoned basis for the duration of five years and that the ban’s logic was internally inconsistent with the CCI’s own theory of harm. 49 The core regulatory principle, as the NCLAT reasoned, is to remove exploitation by restoring genuine user choice, meaning users must retain the right to decide what data is collected and for what purposes.

50 Once users are given a meaningful opt-out, a blanket prohibition on data sharing becomes redundant as it prohibits even 44 Yuna Ko, Unfair Competition: Big Data and the Fight over Data Privacy, 52 Ga. J. Int’l & Comp. L. 230,

230 (2024).

45 Autorità Garante della Concorrenza e del Mercato (AGCM), Provvedimento n. 27432, Case A514,

Facebook/WhatsApp (May 12, 2017). 46 Filippo Lancieri & Patricia M. Sakowski, Competition in Digital Markets: A Review of Expert Reports, 26 Stan. J.L. Bus. & Fin. 65, 85 (2021).

47 NCLAT Judgment, supra note 2, at 157.

48 NCLAT Judgment, supra note 2, at 183–184.

49 NCLAT Judgment, supra note 2, at 164.

50 Id. at 164–165.

consensual sharing and is therefore more restrictive than necessary to address the identified abuse.51 This reasoning reflects a mature and doctrinally coherent approach to digital antitrust remedies. A prohibition on all data sharing, regardless of consent, would not restore competition but

would simply substitute one form of market distortion for another. The proportionate response is to eliminate the coercive mechanism, namely the absence of opt-out, rather than to prohibit the underlying activity. The NCLAT’s formulation therefore corrects the CCI’s overreach at the remedy stage without disturbing the liability findings. The monetary penalty of Rs 213. 14 crore was upheld in full,52 and the directive requiring WhatsApp to provide all Indian users with a prominent, easily accessible in-app opt-out from cross-platform data sharing was affirmed as the principal behavioural remedy. 53 This establishes the opt-out model as the preferred instrument for addressing coercive consent abuses in Indian competition law, prioritising the restoration of user agency over categorical prohibitions.

Conclusion The CCI v Meta litigation has produced three durable principles for Indian digital antitrust enforcement. First, competition regulators have jurisdiction to scrutinise privacy policies where their deployment by a dominant firm causes market distortions, operating in parallel with and complementary to data protection frameworks. 54 Second, cross-platform data aggregation by a corporate group can constitute a denial of market access under Section 4(2)(c) even without formal dominance in the downstream market, provided the group’s collective conduct creates insurmountable entry barriers for rivals. 55 Third, a take-it-or-leave-it consent mechanism imposed by a dominant platform constitutes an unfair condition under Section 4(2)(a)(i), and the degradation of user privacy is a cognisable non-price parameter of competition.

56 The NCLAT’s partial reversal of the CCI’s order, setting aside the Section 4(2)(e) finding and the five-year data-sharing ban, should not be read as a setback. The Section 4(2)(e) reversal is

51 Id. at 164–165, 183.

52 NCLAT Judgment, supra note 2, at 183–184.

53 NCLAT Judgment, supra note 2, at 158, 163.

54 NCLAT Judgment, supra note 2, at 41–42.

55 NCLAT Judgment, supra note 2, at 151–152.

56 NCLAT Judgment, supra note 2, at 138.

a legal technicality arising from corporate structuring and not an endorsement of the underlying conduct. The NCLAT’s Section 4(2)(c) reformulation is, if anything, a more analytically robust basis for future enforcement because it reaches the conduct through the group relationship rather than requiring formal dominance in the downstream market. The remedy modification likewise strengthens the enforcement framework by anchoring it to a proportionate, consentbased model that is more likely to survive further appellate scrutiny. The significance of the case was further amplified when it reached the Supreme Court of India in early 2026.

During cross-appeals, the Chief Justice characterised WhatsApp’s consent model as a ‘decent way of committing theft of private information’ and scrutinised whether vulnerable consumers could genuinely navigate or opt out of policies designed to extract maximum data. The Court also extended the discourse to the economic value of metadata and behavioural data, acknowledging that while WhatsApp messages are encrypted, the data extracted from user behaviour forms the foundation of Meta’s advertising ecosystem. 57 Meta and WhatsApp have formally undertaken before the Supreme Court to implement the CCI’s behavioural remedies, including the in-app opt-out, by 16 March 2026. The implications extend well beyond a single platform’s privacy policy.

The case signals a profound reorientation of antitrust enforcement for an era in which data accumulation, rather than productive capacity, determines competitive advantage. By confronting these dynamics directly, India has established itself as a significant jurisdiction in global digital regulation alongside the EU and Germany. The enforcement action demonstrates that traditional competition frameworks remain highly effective when adapted to non-price parameters, and that market fairness and meaningful data protection are not competing objectives but mutually dependent ones. 57 WhatsApp LLC v. Competition Comm’n of India, Civil Appeal arising out of Competition Appeal No. 1 of 2025 (Supreme Court of India Jan. –Feb. 2026) (oral proceedings), https://www. scobserver. in/journal/sc-comesdown-heavily-on-whatsapp-and-meta-over-take-it-or-leave-it-privacy-policy/.