The Competition Commission of India has ordered a probe into WhatsApp’s new privacy policy and terms of service. The CCI stated that it is of the opinion that WhatsApp has contravened section 4 of the Competition Act (abuse of dominant position) through its “exploitative and exclusionary conduct,” in the garb of a policy update. This move also comes as the messaging app attempts to push its new in-chat payment feature, the WhatsApp Payments.
India is WhatsApp’s biggest market globally. This order against WhatsApp came after the Commission took suo motu cognisance of the matter in January following media reports and the potential impact of the move. The implementation of the policy, which was to come into effect on February 8, was pushed to May 15 after backlash. Recently, the Union government urged the Delhi High Court to restrain WhatsApp from implementing its new privacy policy and terms of service.
The antitrust regulator stated that a detailed investigation is required to ascertain the full extent, scope and impact of data sharing through involuntary consent of users. It directed its investigation arm, the Director-General, to investigate the matter and submit a report within 60 days.
The commission said the ‘take-it-or-leave-it’ nature of privacy policy and terms of service of WhatsApp and the information sharing stipulations that are mentioned merit a detailed investigation “in view of the market position and market power enjoyed by WhatsApp.” It asked the DG to verify the veracity of WhatsApp’s claim that the 2021 update does not expand its ability to share data with Facebook and that it aims to “provide users with further transparency about how WhatsApp collects, uses and shares data.”
It further added that users are entitled to be informed about the extent, scope and precise purpose of sharing of data by WhatsApp with other Facebook companies. It also termed the information categories in the new privacy policy, terms of service as well as the FAQs published by the company, to be “too broad, vague and unintelligible.”
The CCI said that in various places, the policy was indicative and not exhaustive, which suggested that the scope of sharing “may extend beyond the information categories that have been expressly mentioned in the policy.”
“Such opacity, vagueness, open-endedness and incomplete disclosures hide the actual data cost that a user incurs for availing WhatsApp services. It is also not clear from the policy whether the historical data of users would also be shared with Facebook Companies and whether data would be shared in respect of those WhatsApp users who are not present on other apps of Facebook, that is, Facebook, Instagram, etc,” it added.
The antitrust body said it seems the new policy is looking to also customise, personalise and market the offerings of other Facebook companies. It emphasised that in a competitive market, users would have sovereign rights and control over decisions related to the sharing of their personalised data, but not with WhatsApp. There is no justifiable reason why users should not have control over “such cross-product processing of their data by way of voluntary consent, and not as a precondition for availing WhatsApp’s service.”
It added that WhatsApp sharing data with other companies in a manner “that is neither fully transparent nor based on voluntary and specific user consent” was prima facie unfair to users.
The regulator added that users have not been provided with choice, neither upfront nor in the fine print, to object to or opt-out of specific data sharing terms. This “prima facie appear to be unfair and unreasonable for WhatsApp users,” it said.
The CCI said it gave both WhatsApp and Facebook time to respond to queries. Facebook asked the Commission to exclude the company from being a party to the proceedings, stating that WhatsApp and Facebook are distinct legal entities.
This, the Commission said, is not only evasive but also in “clear non-compliance” with the directions it issued in January. It stated that one of the objectives is to include more information about how WhatsApp partners with Facebook, and that it was surprising that the company was trying to evade comments.
“Facebook is a direct and immediate beneficiary of the new updates and in these circumstances, it is egregious that Facebook is feigning ignorance about the potential impact of the updates altogether and avoiding from providing its perspective thereon. In these circumstances, Facebook is a proper party in the present matter and its presence is required for the effective and complete determination of the issues involved in the present matter,” it said.
A spokesperson from WhatsApp told TNM: “We look forward to engaging with the CCI. WhatsApp remains committed to protecting people's personal communications with end-to-end encryption and providing transparency about how these new optional business features work."
WhatsApp’s privacy policy had said that whatever information WhatsApp collects from the user will be shared with Facebook, including the phone number and basic information that the person keys in when creating a WhatsApp account. It will also collect and share user activity, how often the user uses the app, what features they use, the profile photo, the status and ‘about’ information. In addition, device-level information like the type of device, the mobile network and IP address, among others, too, would be collected.
At the time, it said that this will help Facebook and its other products make suggestions for the users, personalise features and content, help them complete purchases and transactions, and show relevant offers and ads across the Facebook Company Products. This includes services such as Facebook itself, Messenger, Instagram, Facebook Shops and more.