2025 (11) TMI 1281 - AT - Law of Competition

Tribunal upholds competition probe into data abuses, confirms privacy as non-price factor, sustains penalty under Sections 4(2)(a)(i) and 4(2)(c)

WhatsApp LLC Versus Competition Commission of India, Prachi Kohli, Internet Freedom Foundation and Meta Platforms, Inc. and Meta Platforms, Inc. Versus Competition Commission of India, Prachi Kohli, Internet Freedom Foundation and WhatsApp LLC

The appellate tribunal held that competition law and data protection law operate complementarily and upheld the competition authority's jurisdiction to ... Abuse of dominant position - using a 2021 privacy policy to impose unfair conditions on users leverage dominance in OTT messaging Apps through smartphone - coercing WhatsApp users to accept allegedly expanded user data collection and sharing with the “Meta group” without an opt-out under the 2021 Update (violating Section 4(2)(a)(i) of the Competition Act, 2002) - sharing WhatsApp user data with Meta companies for purposes other than providing the WhatsApp service, resulting in the denial of access to the alleged market for “online display advertisements in India” (violating Section 4(2)(c) of the Competition Act) - leveraging its alleged dominance in the alleged market for “OTT messaging apps through smartphones in India” to protect its position in the online display advertising market (violating Section 4(2)(e) of the Competition Act). Maintainability of the Appeal - HELD THAT:- Competition law and data protection law operate as complementary, not exclusive, frameworks. While data protection laws like the SPDI Rules and the DPDP Act focus on safeguarding individuals’ personal data and consent, competition law addresses how dominant firms may misuse personal or non-personal data to distort markets, limit consumer choice, or engage in exploitative or exclusionary conduct. We note that both frameworks can apply simultaneously since they answer different questions—privacy law asks whether consent was valid, while competition law asks whether market power was abused through coercive or anti-competitive data practices. The mere overlap in subject matter may not exclude CCI’s jurisdiction, and furthermore, the Hon’ble Supreme Court and Hon’ble Delhi High Court, have already affirmed that CCI can examine competition harms even when privacy issues are also involved - the questions about the maintainability cannot be raised by the Appellant again and again. Privacy as a competition concern||Interplay of competition law with data-protection law (DPDP Act / SPDI Rules) || exclusivity or complementarity-Jurisdiction of CCI - HELD THAT:- There are no conflict between CCI’s jurisdiction under the Competition Act and the authority of data protection regulators under the IT Act or privacy laws. It is also found that CCI is not examining whether WhatsApp’s policy violates privacy statutes but whether WhatsApp’s conduct of requiring users to share data with Meta amounts to an abuse of dominance under Section 4 of the Competition Act - the Commission's jurisdiction encompasses not just overtly anti-competitive economic practices but also extends to unfair data practices that may affect competition dynamics, consumer choice, and market fairness. The DPDP Act’s existence does not make the CCI redundant; rather, both frameworks operate complementarily, where competition regulation addresses practices influencing market power, irrespective of overlap with privacy laws. Moreover, each new policy or conduct (such as the much broader 2021 WhatsApp policy) can merit fresh investigation notwithstanding prior decisions or regulatory action, as markets and business conduct evolve rapidly. Zero-price market economics and appropriate analytical approach - Competition in zero-priced digital products - Privacy of data - as a non-price factor - HELD THAT:- The Competition Commission’s authority extends to digital markets where services are provided at zero price, as the real value lies in the data collected from users. The Commission’s scrutiny is not limited to price-based competition but includes non-price factors such as privacy, quality, and innovation, which are critical in digital markets. The scalable and reusable nature of data allows dominant platforms to reinforce their market position, create entry barriers, and distort fair competition, making it imperative for the Commission to intervene - the legislative framework, including Section 4(2)(a)(i) and Section 4(2)(a)(ii) of the Competition Act, is deliberately broad to capture all forms of abusive conduct, including those involving non-price factors. The Competition Law Review Committee’s findings further support the Commission’s approach, affirming that the Act’s definitions are inclusive enough to encompass data and network effects without requiring amendment. Excluding non-price factors from competition analysis would undermine the Act’s purpose and leave digital markets unregulated, contrary to global regulatory consensus. Therefore, the Competition Commission’s actions in zero- price markets are fully justified and in line with the Act’s spirit and international best practices. Distinctions & overlaps between competition law and data privacy laws - Can CCI decide “privacy” issues? - HELD THAT:- The data-related practices may breach both data privacy and competition law. Data privacy law focuses on personal data processing, safeguarding individual rights and building consumer trust and on the other hand Competition law addresses misuse of both personal and non-personal data, competition-sensitive data, preventing data-driven market dominance, ensuring fair pricing, innovation, and consumer choice. Since 'user data' also includes anonymised and aggregated data, a broader view is essential for assessing competition issues in digital markets. Seen as such, data protection and competition law address data concerns through distinct but complementary tools - there are no repugnancy between the Competition Act and the DPDPA/IT Rules. The regimes address different questions i.e., CCI targets anti- competitive conduct (unfair terms, leveraging, foreclosure), while data protection laws govern privacy compliance and thus, the two laws can operate in parallel. Mere commonality of subject matter does not oust a statutory regulator’s remit. Indian courts including the Hon’ble Supreme Court and the Hon’ble Delhi High Court in this matter itself have affirmed CCI’s jurisdiction to examine competition harms even where privacy/fundamental right issues are also implicated. Validity of consent/ informed consent under competitive coercion - HELD THAT:- The WhatsApp 2021 Policy, unlike its predecessor of 2016, fundamentally undermined user choice and permitted data sharing far exceeding legitimate requirements of WhatsApp, leveraging WhatsApp’s dominance and network effects for exploitative abuse of users The overwhelming evidence shows that WhatsApp's 2021 Policy update imposed an expanded scope of data collection and sharing on users without meaningful choice or ability to opt out, leveraging its dominant market position. Consent was not freely given—users were coerced into a binary choice of accepting invasive terms or forfeiting a vital communication tool. Such conduct constitutes exploitative abuse and undermines competition by giving the dominant platform data and insights inaccessible to rivals, while eroding service quality through forced privacy loss. The Competition Commission is fully justified in its scrutiny and intervention, protecting consumer interests, service quality, and competitive fairness in the digital marketplace. Does Indian Legislative framework include both unfair price and unfair conditions? - HELD THAT:- Section 4 capture all possible forms of abusive conduct -Section 4(2)(a) has two sub-sections, namely, Section 4(2)(a)(ii) dealing with unfair price and Section 4(2)(a)(i) dealing with unfair condition, which indicates the legislative intendment to consider both price and non-price factors - it is unnecessary to amend the Competition Act to specifically include ‘data’ or ‘network effects’ as they same are included within the wide sweep of Sections 2(o) and 19(4), respectively. The CLRC's observation mirrors findings in the impugned order. International jurisprudence - is data privacy a competition concern or not? - HELD THAT:- There are no arguments convincing that the CCI has substituted users' views with its own and the same does not meet the requisite legal standard of effects analysis required to be conducted by the CCI prior to arriving at a finding that Appellants' conduct amounted to imposition of an unfair condition under Section 4(2)(a)(i) of the Competition Act. The Commission has done a detailed qualitative analysis to determine effects caused by conduct of the Appellant as has been noted herein. The Appellants have provided the numbers of users who have joined the 2021 WhatsApp policy over a period of time between its announcement on 4 January 2021 and user information notice for effective date of 7 May 2021 and claims that as of 28th March 2023, 15% users have still not accepted the Update and claims that this belies any argument that the 2021 Update was imposed. On the contrary Commission claims that the mere fact that many users had accepted by 7 May demonstrates abuse and effect. It is noted that the exact numbers are not important in the above noted. It is found Commission’s argument to be convincing. And with respect to growth of Meta's ads revenue it is strong case of the Commission that effects may take place in the future. Relevant markets delineation? - HELD THAT:- The CCI’s delineation respects legislative standards and precedents by focusing on platforms that provide similar services within comparable technological frameworks and user devices, with due consideration of consumer use patterns and competitive constraints. The geographic market was appropriately confined to India, reflecting regulatory jurisdiction and consumer base specifics, aligned with competition law principles regarding geographic market definition. The Commission's approach recognizes network effects, multi-homing behavior, and related digital market dynamics consistent with established competition law methodology for market definition in digital sectors - The delineation facilitates a nuanced abuse of dominance assessment by appropriately segmenting messaging app services from broader digital content markets, ensuring targeted and relevant regulatory scrutiny. Thus, the Competition Commission’s market delineation for OTT messaging apps and online display advertising in India stands as a reasoned, legally sound, and empirically supported foundation for its abuse of dominance analysis. Relevant Market 1 - OTT messaging apps on smartphones in India ||Was it correctly identified? - HELD THAT:- The argument of the Commission is found to be convincing that market cannot be defined as 'the market for consumer communication services', as such definition of the market is very broad and specific targeted product cannot be made for this market and the buyer’s requirements can also be not satisfied by a single product. It is noted note that Meta argued that the geographical market must be global and not limited to India. Appellants' stance is that Competitive and dynamic realities of the market support a global definition of the market. Players typically operate globally, and functionalities of services rarely differ from country-to-country. WhatsApp's product decisions are typically are made on a global basis to offer a consistent user experience across the globe. [Para 47.9 of the Impugned Order]. Rebutting these arguments CCI's Position is that India has unique regulatory environment that significantly impacts the operation of OTT messaging services. Regulatory policies, data privacy laws, and requirements for data localization can differ substantially from those in other countries, affecting how these services are provided and accessed in India. Further, it would be erroneous to include competitors not operating in India in the relevant market based on a global geographic definition. Relevant Market 2 - Market for Online Display Advertising in India || Was it correctly identified? - HELD THAT:- Conditions of competition in the online display advertisement market are homogeneous within India, and thus the relevant market should be defined nationally, not globally. India has a unique regulatory environment that significantly impacts the operation of advertisement industry - No concrete evidence that conditions of competition in the online display advertisement market are homogeneous across the globe has been provided - Providing similar services across the globe or making of product decisions on a global basis, does not mean that competitive constraints are homogenous across the globe - Therefore, the relevant market was finally defined as the 'market for online display advertising in India and we also don’t find any infirmity in such delineation of the relevant market. Dominance in the OTT messaging market - Assessed or not in the relevant market? - HELD THAT:- The Commission has failed to determine that Meta is dominant in the market for “Online Display Advertising in India”. Violation of Section 4(2)(a)(i) - Abuse of Dominance by Appellants – issue of imposition of unfair conditions on users - HELD THAT:- It is inclined to agree with the conclusions of CCI regarding the 2021 Policy that data privacy is a non-price factor in competition analysis as reduced privacy degrades service quality and creates competitive disadvantage for competitors. User consent is not free or voluntary due to lack of choice – a “take-it-or-leave-it” imposition harms both consumers and competition. Despite assurances to the contrary, more than 84% of users had accepted the update by 28.03.2024 due to frequent prompts for acceptance. Purpose of expanded collection and sharing of user data with other Meta companies is not limited to improving WhatsApp’s internal services / functioning, goes beyond what is necessary and gives Appellants insights which smaller competitors cannot replicate. Users expect data not to be shared unnecessarily for not WhatsApp purposes and the 2021 Policy breaches that reasonable expectation. WhatsApp has retained flexibility to unilaterally expand data sharing at its discretion, creating the potential for exploitation without user recourse Resultantly, collection and sharing of user data for non-WhatsApp purposes fulfil the second element of Section 4(2)(a)(i), i.e. imposition of unfair terms. Violation of Sections 4(2)(c) and 4(2)(e) - Denial of market access and leveraging dominance in Market 1 to enter and protect position in Market 2 - HELD THAT:- The Appellants' ability to gather and utilise extensive user data through WhatsApp for digital advertising enables advertisers to create detailed profiles of potential customers and deliver targeted advertisements that align with users' preferences and interests. With access to detailed user profiles and data from multiple platforms, the Appellant (Meta) can promise advertisers the best returns in terms of clicks, engagement, and conversions per dollar spent. This advantage makes Meta the preferred advertising partner for sellers, thereby leveraging its dominance in the OTT app market to reinforce its leading position in digital advertising market. There are no infirmity in the above analysis for advertising and marketing strategy and it is convincing - there cannot be a question of abuse of its dominance in this market. Conclusions on Abuse - HELD THAT:- There is a violation Sections 4(2)(a)(i), 4(2)(c) but not Section 4(2)(e) and by WhatsApp as an enterprise and Meta as a group. Penalty imposed by CCI - HELD THAT:- The Commission imposes a penalty based on the relevant turnover of both Meta and WhatsApp because Meta allegedly enjoys full control over the activities and operations of WhatsApp. The law is clear that this alter ego theory must satisfy a heightened threshold and be supported by evidence that the parent company dominates the subsidiary so fully that they are essentially the same company. Such a determination requires: (i) fraudulent intention; and (ii) complete domination of the affairs of the subsidiary by the parent - The penalty imposed of ₹ 213.14 crore only upon Meta is upheld. The Commission’s order holding breach of Section 4(2)(a)(i) and 4(2)(c) are upheld - The Commission’s order holding breach of Section 4(2)(e) is not sustainable - The directions issued by the Commission to cease and desist is not sustainable and is set aside, the rest of directions are upheld - The penalty imposed of ₹ 213.14 crore only upon Meta is upheld. Appeal allowed in part. ISSUES PRESENTED AND CONSIDERED 1. Whether the Appellate Tribunal may entertain appeals against the Competition Commission's final order under Section 27 and related provisions, given concurrent proceedings before other courts and data-protection regulators. 2. Whether competition law (Competition Act) may validly examine data-protection and privacy-related practices of firms, and the scope of CCI's jurisdiction vis-à-vis sectoral/data-protection regimes (SPDI Rules, DPDP Act). 3. Whether privacy and data-related practices constitute relevant non-price parameters of competition in zero-price digital markets and may be treated as service quality for dominance/abuse analysis. 4. Whether the Commission was required to defer to other judicial/regulatory proceedings or to await data-protection determinations before a competition inquiry. 5. Whether the Commission's market-definition exercises - (a) Market 1: OTT messaging apps through smartphones in India; and (b) Market 2: Online display advertising in India - were correctly delineated. 6. Whether the Commission correctly found dominance in Market 1 and a leading position (or dominance) in Market 2. 7. Whether the 2021 privacy policy update constituted imposition of an unfair condition in breach of Section 4(2)(a)(i) (validity of consent under competitive coercion). 8. Whether cross-platform data-sharing produced denial of market access under Section 4(2)(c) and/or leveraging under Section 4(2)(e) (use of dominance in one market to affect another). 9. Whether the Commission's effects analysis (qualitative vs quantitative; actual vs potential harm) was adequate to sustain findings of abuse. 10. Whether the remedies and penalty imposed were lawful, proportionate, and within CCI's remit (including whether parent and subsidiary turnover may be aggregated for penalty). ISSUE-WISE DETAILED ANALYSIS Issue 1 - Maintainability / Jurisdiction to Proceed Legal framework: CCI exercises powers under Sections 19, 26, 27 and related provisions to investigate and order relief for contraventions of the Competition Act; judicial review available in higher courts. Precedent treatment: Higher courts (Delhi High Court and Supreme Court) refused to restrain CCI from investigating, noting CCI 'should not be restrained from proceeding' though findings must be decided on merits. Interpretation & reasoning: The Tribunal holds that CCI legitimately initiated and completed investigation; parallel proceedings do not oust CCI jurisdiction where competition issues are implicated. Competition law is an independent regime and overlap with privacy law does not automatically displace CCI's remit. Ratio vs. Obiter: Ratio - CCI may proceed notwithstanding parallel privacy litigation; overlap does not render CCI proceedings non-maintainable. (This is treated as binding in this judgment.) Conclusion: Appeals on maintainability grounds dismissed; CCI's inquiry and final order maintainable and reviewable on merits. Issue 2 - Interplay of Competition Law and Data-Protection Law; Limits of CCI's Competence Legal framework: Competition Act targets appreciable adverse effect on competition; SPDI Rules/DPDP Act govern data-protection standards. Precedent treatment: International authorities and CJEU jurisprudence permit competition authorities to consider privacy as a competition parameter, often urging coordination with data protection authorities. Interpretation & reasoning: The Tribunal finds the frameworks complementary - privacy law assesses lawfulness of processing/consent, while competition law examines whether data practices distort competitive dynamics (e.g., coercive consent, foreclosure). CCI's focus was on competitive impact, not on substituting privacy regulators. Ratio vs. Obiter: Ratio - CCI may assess competitive harm arising from data practices even if overlap with privacy regulation exists; it must, however, confine itself to competition questions. Conclusion: No repugnancy; CCI entitled to adjudicate competition harm arising from data practices; findings on privacy-law compliance remain within specialist authorities' competence but do not preclude competition assessment. Issue 3 - Zero-Price Markets and Privacy as Non-Price Parameter Legal framework: Section 2(o) (price includes every valuable consideration); Section 4(2)(a) (unfair conditions) and Section 19(4) (factors for dominance). Precedent treatment: Prior Tribunal decisions recognize data as central in digital markets; international regulators treat privacy/quality as non-price competition dimensions. Interpretation & reasoning: Tribunal accepts that 'zero-priced' services involve payment by data; privacy constitutes service quality and a non-price parameter. Excluding non-price factors from competition analysis would leave digital platforms outside regulatory scrutiny. Ratio vs. Obiter: Ratio - privacy and data practices may be treated as non-price parameters relevant to dominance/abuse analysis in zero-price digital markets. Conclusion: Tribunal affirms CCI's conceptual approach to treat privacy/data as competition parameters in digital markets. Issue 4 - Effects Analysis: Actual vs. Potential Harm and Evidential Burden Legal framework: Section 4 requires abuse of dominant position; jurisprudence requires effects analysis to establish anti-competitive effect. Precedent treatment: Tribunal and COMPAT decisions emphasize effects-based assessment; however, authorities recognize preventive intervention in fast-moving digital markets where harm may be irreversible. Interpretation & reasoning: Tribunal accepts that effects analysis may be qualitative and may rely on market structure, conduct, and third-party evidence rather than compulsory large-scale user surveys in digital dominance contexts. The DG/CCI conducted qualitative effects analysis including competitor and advertiser submissions indicating foreclosure potential; the Tribunal finds this sufficient to support findings of imposition and denial of access. Ratio vs. Obiter: Ratio - an effects-based approach is required, but qualitative evidence from market structure, conduct, and credible third-party statements can suffice where quantitative proof is infeasible and potential harm risks irreversible foreclosure. Conclusion: CCI's qualitative effects analysis was adequate to sustain findings on Sections 4(2)(a)(i) and 4(2)(c); shortcomings in proof of leveraging under Section 4(2)(e) led to reversal on that count. Issue 5 - Relevant Market Delineation (Market 1 and Market 2) Legal framework: Sections 2(t), 2(r), 2(s) and Section 19(7) on market definition parameters (interchangeability/substitutability); geographic market determined by homogeneous competition conditions. Precedent treatment: Digital market analyses require careful functional and device-based assessment; multi-homing and user attention arguments considered but not determinative. Interpretation & reasoning: The Tribunal upholds CCI's delineation of Market 1 as OTT messaging apps through smartphones in India - rejects unduly broad 'user attention' market and distinguishes other communication/video/email services on functional grounds and device linkages. Market 2 (online display advertising in India) was held correctly defined given advertiser behaviour, ad impressions, and revenue metrics with a national geographic scope reflecting homogenous competitive conditions. Ratio vs. Obiter: Ratio - both relevant markets as defined by CCI are upheld as reasoned and grounded in facts. Conclusion: Market definitions sustained. Issue 6 - Dominance in Market 1 and Position in Market 2 Legal framework: Section 4 (dominance definition) and Section 19(4) factors. Precedent treatment: Dominance assessment requires cumulative consideration of Section 19(4) factors (Supreme Court authority). Interpretation & reasoning: Tribunal finds CCI applied Section 19(4) factors (market share via DAU/MAU, network effects, consumer dependence, size/resources, ecosystem effects) and rightly concluded dominance in Market 1. In Market 2 CCI found a leading position (high impressions and revenue) but not dominance; Tribunal agrees on leading position and accepts CCI's metrics for relative market power. Ratio vs. Obiter: Ratio - dominance in Market 1 upheld; no dominance finding in Market 2 but leading position acknowledged. Conclusion: Dominance in OTT messaging sustained; Market 2 leadership acknowledged but not dominance. Issue 7 - Imposition of Unfair Condition (Section 4(2)(a)(i)) - Validity of Consent Legal framework: Section 4(2)(a)(i) prohibits imposition of unfair conditions; consent doctrine under data regimes relevant but competition test focuses on coercion and competitive imbalance. Precedent treatment: Prior dismissal of alleged abuse in 2016 turned on opt-out provision then; absence of opt-out in 2021 materially distinguished. Interpretation & reasoning: Tribunal accepts CCI's finding that the 2021 policy, its rollout (take-it-or-leave-it, prompts, perceived mandatory acceptance), removal of an earlier opt-out, and dominance/network effects produced coercive consent and an unfair condition degrading privacy (service quality). Vague, open-ended data sharing broadened exploitative potential and undermined informed choice. Ratio vs. Obiter: Ratio - 2021 Policy constituted imposition of unfair condition under Section 4(2)(a)(i); consent obtained in the relevant period was vitiated by competitive coercion. Conclusion: Violation of Section 4(2)(a)(i) by the operator of Market 1 upheld. Issue 8 - Denial of Market Access (Section 4(2)(c)) and Leveraging (Section 4(2)(e)) Legal framework: Section 4(2)(c) proscribes practices resulting in denial of market access; Section 4(2)(e) proscribes use of dominance in one market to affect another. Precedent treatment: Courts allow broad interpretation of 'denial of market access'; leveraging requires proof of two distinct markets and causal use of dominance. Interpretation & reasoning: Tribunal upholds CCI's finding that cross-platform data-sharing created entry barriers and effectively denied market access in online display advertising (Section 4(2)(c)), supported by advertiser and competitor evidence and ad-impression/revenue data. However, Section 4(2)(e) was not sustained: the causal leveraging element could not be established sufficiently, and separate-entity legal distinctions precluded robust leveraging finding despite ecosystem concerns. Special corporate-group features were noted but insufficient to sustain Section 4(2)(e). Ratio vs. Obiter: Ratio - Section 4(2)(c) breach upheld; Section 4(2)(e) not sustained. Conclusion: Denial of market access proven; leveraging not established. Issue 9 - Remedies and Penalty: Proportionality and Entity Against Whom Relief May Run Legal framework: Sections 27-28 empower CCI to impose remedies and penalties; amendment to penalty provisions and guidelines applied by CCI. Precedent treatment: Penalty calculation should be proportionate and normally based on relevant turnover of offending entity; veil-piercing requires high threshold. Interpretation & reasoning: Tribunal finds several remedial directions (opt-out, transparency, in-app controls, future-update compliance) fall within competition relief and are upheld. The specific five-year ban on sharing for advertising (247.1) was set aside as disproportionate and unjustified. Penalty of Rs. 213.14 crore imposed on group upheld after CCI's methodology (average relevant turnover, mitigation) reviewed; Tribunal accepts CCI's reasoning to include both entities' relevant turnovers given practical control and ecosystem effects while noting corporate-entity distinctions limit some findings. Application of amended penalty provisions was sustained by Tribunal on interpretive grounds. Ratio vs. Obiter: Ratio - most remedial measures addressing competitive exploitation and user choice upheld; the five-year advertising ban set aside; monetary penalty upheld as proportionate under CCI's methodology. Conclusion: Directions enhancing opt-out/transparency and prohibiting making non-service data-sharing a condition are upheld; absolute time-bound advertising ban removed; penalty affirmed.