CCI orders antitrust probe against WhatsApp's new privacy policy

The Competition Commission of India (CCI) on Wednesday ordered a probe into the updated privacy policy of WhatsApp for breaching the antitrust law. CCI said that with no fear of erosion of its userbase, Facebook-owned WhatsApp was in a position to compromise quality in terms of protection of individualised data.  

“CCI is of prima facie opinion that the ‘take-it-or-leave-it’ nature of privacy policy and terms of service of WhatsApp and the information-sharing stipulations mentioned therein, merit a detailed investigation in view of the market position and market power enjoyed by WhatsApp,” stated the CCI order.

The investigation comes against the backdrop of WhatsApp’s proposal to update its privacy policy in late December/early January. The update was worded in a way that led users to believe their information was unsafe and not end-to-end encrypted, prompting many to leave the messaging platform. WhatsApp deferred the deadline for the privacy policy update to May 15, from February 8.

However, after what looked like a mass exodus to alternative messaging applications (apps) like Signal, Telegram, and iMessage, WhatsApp was back to being the top messaging app in India by late February.

Citing the initial increase in Signal and Telegram downloads, CCI noted: “However, apparently this has not resulted in any significant loss of users for WhatsApp. Further, the network effects working in favour of WhatsApp reinforces its position of strength and limit its substitutability with other functionally similar apps/platforms.”

This, in turn, causes a  strong lock-in effect for users, making it difficult and meaningless to switch to another platform until all or most of their social contacts also do the same, added CCI.

The investigation has been ordered under Section 26 (1) of the Competition Act, with directions to complete the probe within a period of 60 days from the receipt of its order.

CCI has found the new policy vague and open-ended and said its incomplete disclosures hide the actual data cost a user incurs for availing of WhatsApp services.

One of the main reasons for the criticism of the updated privacy policy was WhatsApp’s data-sharing with parent company Facebook and its subsidiaries.

WhatsApp has reinforced on multiple occasions that the policy does not change personal communication between people, but only impacts the way users interact with WhatsApp business accounts.

“We look forward to engaging with the CCI. WhatsApp remains committed to protecting people's personal communications with end-to-end encryption and providing transparency about how these new optional business features work,” said a WhatsApp spokesperson.

The antitrust watchdog had taken suo motu cognisance of the matter in its ordinary meeting on January 19, on the basis of media reports and the potential impact of the policy and terms for WhatsApp users and market.

WhatsApp and Facebook responded to CCI through separate emails on February 25.

CCI said it found the responses of Facebook to its queries “not only evasive, but in clear non-compliance” of its directions. “Facebook is a direct and immediate beneficiary of the new updates and in these circumstances, it is egregious that Facebook is feigning ignorance about the potential impact of the updates altogether and avoiding from providing its perspective thereon,” the commission said in its 21-page order.

CCI also said it was not clear from the policy whether the historical data of users would also be shared with Facebook companies and whether data would be shared in respect of those WhatsApp users also who are not present on other apps of Facebook.

It said it found WhatsApp’s response that it “…has authorised its legal representatives to act, appear, plead, and file before the commission on its behalf” egregious and inconsistent with general regulations.

In January, India had asked WhatsApp to withdraw its new privacy policy, saying the Facebook-owned messaging platform’s proposed changes “make invasive and precise inferences about users”. The Ministry of Electronics and Information Technology (MeitY) had at the time asked WhatsApp to clarify issues related to its “privacy and data transfer and sharing policies, and general business practices”.

Last week, in response to a public interest litigation, MeitY told the Delhi High Court that WhatsApp “may be restrained from implementing its new privacy policy and terms of service dated January 4 from February 8 or any subsequent date pending adjudication by this court”.