CCI Orders Probe Into WhatsApp's New Privacy Policy; Finds Prima Facie 'Abuse Of Dominance'

In a significant development, the Competition Commission of India on Wednesday ordered a probe into the new privacy policy of WhatsApp, after making a prima facie observation that it was violative of the Competition Act 2000.

"..the Commission is of the considered opinion that WhatsApp has prima facie contravened the provisions of Section 4 of the Act through its exploitative and exclusionary conduct, in the garb of policy update", said the order passed by the CCI.

The CCI observed that the privacy policy terms on sharing of personalised data with Facebook companies was "neither fully transparent nor based on specific, voluntary consent of users".

"On a careful and thoughtful consideration of the matter, the conduct of WhatsApp in sharing of users' personalised data with other Facebook Companies, in a manner that is neither fully transparent nor based on voluntary and specific user consent, appears prima facie unfair to users. The purpose of such sharing appears to be beyond users' reasonable and legitimate expectations regarding quality, security and other relevant aspects of the service for which they register on WhatsApp. One of the stated purposes of data sharing viz. targeted ad offerings on other Facebook products rather indicates the intended use being that of building user profiles through cross-linking of data collected across services. Such data concentration may itself raise competition concerns where it is perceived as a competitive advantage", the 21-page order of the CCI said.

It made a prima facie observation that the policy was an abuse of dominant position resulting in violation of Section 4 of the Competition Act.

"The impugned conduct of data-sharing by WhatsApp with Facebook apparently amounts to degradation of non-price parameters of competition viz.quality which result in objective detriment to consumers, without any acceptable justification. Such conduct prima facie amounts to imposition of unfair terms and conditions upon the users of WhatsApp messaging app, in violation of the provisions of Section 4(2)(a)(i) of the Act".

The anti-trust regulator termed the privacy policy terms "take-it-or-leave-it' terms set by a dominant messaging platform, without providing much information to the users, and observed that the policy prima facie appeared to be "unfair and unreasonable".

"..users are required to accept the unilaterally dictated 'take-it-or-leave-it' terms by a dominant messaging platform in their entirety, including the data sharing provisions therein, if they wish to avail their service. Such "consent"cannot signify voluntary agreement to all the specific processing or use of personalised data,as provided in the present policy. Users have not been provided with appropriate granular choice, neither upfront nor in the fine prints,to object to or opt-out of specific data sharing terms,which prima facie appear to be unfair and unreasonable for the WhatsApp users".

The CCI bench comprising Ashok Kumar Gupta(Chairperson), Sangeeta Verma(Member) and Bhagwant Singh Bishnoi(Member) observed that "a thorough and detailed investigation is required to ascertain the full extent, scope and impact of data sharing through involuntary consent of users".

Accordingly, the Commission directed the Director General ('DG') to cause an investigation to be made into the matter under the provisions of Section 26(1) of the Act. The Commission also directed the DG to complete the investigation and submit the investigation report within a period of 60days from the receipt of this order.

The Commission has clarified that the observations are preliminary in nature and will not amount to a final expression of opinion on the merits of the case. "The DG shall conduct the investigation without being swayed in any manner whatsoever by the observations made herein", the order added as a caveat.

Notably, the order has been passed in a suo moto case taken by the Commission titled "In Re: Updated Terms of Service and Privacy Policy for WhatsApp Users".

WhatsApp LLC and Facebook Inc were arrayed as opposite parties in the case.

The suo moto case was taken by the Commission on January 19, 2021, based on the reports about the new privacy policy update of the messenger platform.

It is also pertinent to note that the Union Ministry of Electronics and Information Technology has taken a stand against the new privacy policy of WhatsApp. In an affidavit filed in the Delhi High Court in response to a PIL challenging the policy, the Centre has urged the Court to restrain WhatsApp from implementing the new policy, pending the passage of the Personal Data Protection Bill.

Abuse of dominance

Section 4 of the Act proscribes abuse of dominance by an entity commanding dominant position in relevant market.

The CCI noted that WhatsApp is dominant in the relevant market for OTT messaging apps through smartphones in India, as was held in an earlier decision.

The Commission further noted that the previous privacy policies of WhatsApp dated 25.08.2016 as well as 19.12.2019 provided users an option to choose not to have their WhatsApp account information shared with Facebook.

However, under the latest policy, this choice is no longer available to users.

In this regard, the CCI observed :

"This(removal of opt-out choice) implies that data of users, including that of those who are not users of any other service within the Facebook family of companies, will now be shared across Facebook Companies. Simply put, it appears that consent to sharing and integration of user data with other Facebook Companies for a range of purposes including marketing and advertising, has been made a precondition for availing WhatsApp service"

This "take-it-or-leave-it" policy of WhatsApp requires further examination as to whether it violates the provisions of the Competition Act.

The Commission also took note of the "strong lock-in effect" for users as regards their dependence on WhatsApp for messaging services. Switching to another platform for users gets difficult and meaningless until all or most of their social contacts also switch to the same other platform. Users wishing to switch would have to convince their contacts to switch and these contacts would have to persuade their other contacts to switch. Thus, while it may be technically feasible to switch, the pronounced network effects of WhatsApp significantly circumscribe the usefulness of the same.

It noted that despite the increased downloads of alternate platforms like Telegram or Signal, the user base of WhatsApp has not suffered significant loss.

The Commission further opined that users, as owners of their personalised data, are entitled to be informed about the extent, scope and precise purpose of sharing of such data by WhatsApp with other Facebook Companies. However, it appears from the Privacy Policy as well as Terms of Service (including the FAQs published by WhatsApp), that many of the information categories described therein are too "broad, vague and unintelligible".

For instance, information on how users "interact with others (including businesses)"is not clearly defined,what would constitute "service-related information", "mobile device information", "payments or business features", etc.are also undefined. At numerous places in the policy, while illustrating the data to be collected, the list is indicative and not exhaustive due to usage of words like 'includes', 'such as', 'For example', etc., which suggests that the scope of sharing may extend beyond the information categories that have been expressly mentioned in the policy.

"Such opacity, vagueness, open-endedness and incomplete disclosures hide the actual data cost that a user incurs for availing WhatsApp services. It is also not clear from the policy whether the historical data of users would also be shared with Facebook Companies and whether data would be shared in respect of those WhatsApp users also who are not present on other apps of Facebook i.e.,Facebook, Instagram, etc", the CCI said in the order.

It further said :

"Further, users are not likely to expect their personal data to be shared with third parties ordinarily except for the limited purpose of providing or improving WhatsApp's service. However, it appears from the wordings of the policy that the data sharing scheme is also intended to, inter alia,'customise', 'personalise' and 'market' the offerings of other Facebook Companies. Under competitive market condition, users would have sovereign rights and control over decisions related to sharing of their personalised data. However, this is not the case with WhatsApp users and moreover, there appears to be no justifiable reason as to why users should not have any control or say over suchcross-product processing of their data by way of voluntary consent,and not as a precondition for availing WhatsApp's services".

"The impugned data sharing provision may have exclusionary effects also in the display advertising market which has the potential to undermine the competitive process and creates further barriers to market entry besides leveraging, in violation of the provisions of Section 4(2)(c) and (e) of the Act.As per the 2021 update to the privacy policy, a business may give third-party service provider such as Facebook access to its communications to send, store, read, manage, or otherwise process them for the business.It may be possible that Facebook will condition provision of such services to businesses with a requirement for using the data collected by them.The DG may also investigate these aspects during its investigation", the order said.

Version of WhatsApp and Facebook

WhatsApp made a preliminary objection and submitted that its current Terms of Service and Privacy Policy as well as the proposed update in the same fall within the purview of the information technology law framework and these issues are currently sub judice before various courts and other fora in India. It further said that the policy update has not been implemented and has been postponed to May 15, 2021. Therefore, it said that the suo moto case was premature.

It further said that the new policy does not expand WhatsApp's ability to share data with Facebook and the said update intends to provide users with further transparency about how WhatsApp collects, uses and shares data. The CCI has asked the DG to examine the veracity of this claim.

Facebook Inc said that it was not a necessary or proper party in the case. Though Facebook admitted that it was the parent company of WhatsApp, it said that both Facebook and WhatsApp are distinct legal entities, and hence it need not be made as a party in the case.

The Commission expressed surprise at this stand taken by Facebook.

"Facebook is a direct and immediate beneficiary of the new updates and in these circumstances, it is egregious that Facebook is feigning ignorance about the potential impact of the updates altogether and avoiding from providing its perspective thereon. In these circumstances, Facebook is proper party in the present matter and its presence is required for effective and complete determination of the issues involved in the present matter. Accordingly, the issue of deletion of its name from array of parties does not arise and the request of Facebook in this regard is rejected", the CCI observed in this regard..

Click here to read/download the order

.