WhatsApp, Meta Agree to Comply With NCLAT Privacy Order

WhatsApp and its parent company, Meta Platforms Inc., on Monday informed the Supreme Court that they will comply with the National Company Law Appellate Tribunal’s directions by March 16, including enhanced privacy and consent safeguards related to data sharing for advertising.

Appearing for both companies, Senior Advocate Kapil Sibal submitted that they would not press pleas seeking a stay on the tribunal’s order. He recorded an undertaking that Meta would adhere to the NCLAT ruling and would file an affidavit clarifying which categories of user data are shared and which are not.

A bench led by Chief Justice of India Surya Kant, along with Justices Joymalya Bagchi and Vipul M Pancholi, dismissed the stay applications as “not pressed”, while keeping issues in the main appeal open. The court also directed Meta to submit a compliance affidavit before the Competition Commission of India in line with the NCLAT’s directions.

Background

The proceedings arise from appeals against the NCLAT’s November 2025 judgment, which substantially upheld a Rs 213.14 crore penalty imposed by the Competition Commission of India CCI on WhatsApp over its 2021 privacy policy.

The CCI had found that the updated policy expanded compulsory data sharing with other Meta companies under a “take-it-or-leave-it” model, amounting to unfair conditions on users.

While upholding the penalty, the NCLAT set aside a separate CCI direction that barred WhatsApp for five years from sharing user data with other Meta group entities for advertising purposes. The tribunal held that a blanket prohibition was unwarranted if users were given meaningful opt-in and opt-out choices.

Subsequently, on December 15, 2025, the NCLAT clarified that its remedial directions would apply to user data collection and sharing for all non-WhatsApp purposes, including advertising and non-advertising uses. It granted WhatsApp three months, until mid-March 2026, to comply.

The CCI has filed a cross-appeal before the Supreme Court challenging the removal of the five-year prohibition on advertising-related data sharing. That issue remains under consideration.

Privacy Concerns

During an earlier hearing on February 3, a three-judge bench cautioned technology platforms against compromising citizens’ privacy in the name of data sharing. The court observed that companies operating in India cannot “play with the right to privacy of citizens”, stressing that not “a single digit” of user data should be shared in violation of privacy norms or public interest.

The bench also questioned how ordinary users, unfamiliar with legal terminology, are expected to navigate complex privacy policies. Concerns were raised over the commercial use of behavioural data for targeted advertising.

The regulatory scrutiny in India mirrors developments in the European Union, where the Digital Markets Act requires designated “gatekeepers”, including Meta, to obtain explicit consent before combining personal data across core services. The framework prohibits cross-using or merging data from separate services without clear user approval, including for personalised advertising.

Alongside this, the General Data Protection Regulation imposes stringent conditions on lawful processing, transparency and user rights over personal data.

Also Read: ‘You Can’t Play With Privacy’: SC Slams WhatsApp, Meta Over Data Sharing