The Competition Commission of India (CCI), in September 2025, went strongly against the giant Meta Platforms Inc., parent to all three WhatsApp, Facebook and Instagram for abusing its dominant position in the Indian market. The order scrutinised WhatsApp's 2021 privacy policy amendment which mandated users to accept broad data sharing permissions with Meta's other platforms for continued use of WhatsApp. CI found that the policy imposed unfair conditions, foreclosed competition and leveraged WhatsApp's dominance in the messaging arena into adjacent markets such as online advertising.
Relevant Legal Framework
The legal framework for abuse of dominance under the Competition Act, 2002 rests primarily on three pillars. First being the definitions of relevant market, relevant geographic market and relevant product market being Sections 2(r)1, 2(s)2 and 2(t)3 respectively. Second is the prohibition on abuse of dominance under Section 44 of the Act. Third and an important one is for determination of abusive conduct which is aided by factors for determining dominance given under Section 195 of the Act.
Questions to Consider
Before turning to each issue individually, it is worth pausing to understand the nature of the questions raised in the CCI's order against Meta. The case is not merely about the technicalities of a privacy policy or the quantum of a monetary penalty. At its heart, it asks how Indian competition law should respond to the realities of a data-driven economy. Traditional CCI inquiries were concerned with price, output and market shares. But here, the product is ostensibly free, the service is digital and the competitive parameter in dispute is the quality of privacy offered to users.
- Is WhatsApp Dominant?
Dominance under Section 19(4) of the Act was established on the basis of WhatsApp's market share of over 95% penetration in India. This reasoning is consistent with the CCI's approach in Google Android6 case of 2018, where network effects created barriers to entry. However, the possibility of consumers using multiple messaging apps could have weakened the said finding but CCI rejected it given the level at which WhatsApp is embedded in the communication arena in India.
- Does the Alleged Privacy Policy Impose Unfair
Conditions?
The ‘take it or leave it' nature of the privacy policy update compelled users to be onboard with extensive data sharing which the CCI held to be an unfair condition under Section 4(2)(a)(i)7 of the Act. This reasoning finds support in the rather pivotal 2014 case of DLF8. The CCI also drew from European precedent, notably the Bundeskartellamt v. Facebook9 case, where data exploitation was treated as an abuse of dominance. Though CCI justified its jurisdiction, a key question was whether privacy parameters in particular fall within the ambit of competition law or are better left to data protection regimes.
- Does the Alleged Data Sharing Foreclose Market
Access?
The CCI reasoned that Meta's ability to combine its platforms' data entrenched its strength in digital advertising creating barriers for competitors and amounting to denial of market access under Section 4(2)(c)10 of the Act. This is in line with the Google Shopping case11 where preferential treatment of Google's own services foreclosed rivals. Yet, in the present case, the CCI emphasised more on potential harm than evidence of actual harm.
- Is CCI Overstepping into Privacy Regulation?
Meta argued that issues of privacy fall within the jurisdiction of the IT act and the Digital Personal Data Protection Act and not the competition law. The Supreme Court has also upheld this argument in Bharti Airtel v. CCI12 wherein it was held that the CCI must steer clear where sectoral regulators already have primary jurisdiction. However, the CCI distinguished the present case by holding that privacy concerns do become competition law concerns when they stem from abuse of dominance.
- Was the Penalty Justified?
In Excel Crop Care v. CCI13, the principle of ‘relevant turnover' which guides the computation of penalties was laid. Under Section 27(b)14 of the Act, a cap on imposing penalty which cannot be more than ten percent of the average turnover for the last three preceding financial years is set.
- Sustenance of Behavioural Remedies
The CCI upholding principles of CCI v. Coal India Ltd.15 prohibited data sharing between WhatsApp and Meta for five years. This is in line with the powers of CCI under Section 27(d)16 of the Act which empowers behavioural remedies. This is much complicated than it seems though given the aspects of extraterritoriality which yet need clarity.
Broader Implications for Businesses in India
The Meta–WhatsApp penalty is more than just a warning to one company—it sends ripples across the entire Indian business landscape. For startups and young tech firms, the order is a double-edged sword. On the positive side, it shows that regulators are ready to step in and limit the power of entrenched giants, creating breathing space for smaller players in sectors like adtech, fintech and digital communication. But there's a flip side too: if new businesses try to build growth models around aggressive data collection or ‘all-or-nothing' consent, they may one day find themselves under the same spotlight.
The lesson is simple build compliance into your products from the start, and make sure users are genuinely choosing how their data is used. For the big digital platforms, the message is even clearer. The way you design consent screens, privacy policies and user choices is no longer just a matter of data protection law, its ambit has spread over other legislations too. With both the CCI and the Data Protection Board under the DPDP Act watching, there's a real risk of double scrutiny. Companies can't afford to treat these as separate silos and competition and privacy will need to be managed together through stronger governance structures.
Smaller businesses and traditional firms going digital won't escape the ripple effects either. They may never face a direct CCI probe but if Meta or Google are forced to change how they run their ad platforms, SMEs will feel the difference in advertising costs and contract terms. Staying alert to these shifts and being ready to adapt commercial strategies will be essential.
Investors too will have to rethink how they evaluate deals. Data policies are now firmly part of the risk checklist. For foreign firms entering India, the decision underlines how far CCI's reach can potentially extend. Even if a company's servers and policies are offshore, it can be pulled into proceedings if its actions affect Indian consumers. Global businesses will need to localize their compliance strategies and align them with Indian regulatory expectations.
Above all, the order highlights a cultural shift in compliance. Companies need to adopt practices like data-mapping, privacy-impact assessments and keeping records of why particular data is collected. And the stakes are high under Section 27 of the Act, penalties can run up to 10 percent of turnover even if no direct price harm is proven. In short, the future belongs to businesses that can build trust while staying ahead of regulatory expectations.
Conclusion
The CCI's penalty against Meta marks a turning point in Indian competition law, extending the scope of Section 4 into the domain of data exploitation. While controversial, the order aligns India with global trends that recognize privacy as a competition parameter. For Indian businesses, the message is clear, data practices must withstand not only privacy law scrutiny but also competition oversight. Whether upheld or overturned on appeal, the order reshapes compliance expectations in India's digital economy. Startups, platforms, SMEs, investors and foreign entrants alike must integrate competition law considerations into their data governance. In India today, data is dominance and privacy is competition.
Footnotes
1. § 2(r), The Competition Act, 2002
2. § 2(s), The Competition Act, 2002
3. § 2(t), The Competition Act, 2002
4. § 4, The Competition Act, 2002
5. § 19, The Competition Act, 2002
6. In re Google LLC (Android), Case No. 39 of 2018, Competition Commission of India (2018)
7. § 4(2)(a)(i), The Competition Act, 2002
8. DLF Ltd. v. Competition Commission of India, Appeal No. 20 of 2011, Competition Appellate Tribunal (2014)
9. Bundeskartellamt v. Facebook Inc., Case No. B6-22/16, Fed. Cartel Office (Ger.) (2019)
10. § 4(2)(c), The Competition Act, 2002
11. In re Google Inc., European Commission Case AT.39740 (2017)
12. 2 SCC 521 (2019)
13. 8 SCC 47 (2017)
14. § 27(b), The Competition Act, 2002
15. In re Coal India Ltd., Case No. 03 of 2012, Competition Commission of India (2014)
16. § 27(d), The Competition Act, 2002
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
