Top News

WhatsApp must seek user consent for all data sharing: NCLAT
15 Dec 2025

The National Company Law Appellate Tribunal (NCLAT) has ruled that WhatsApp must seek user consent before sharing data for both advertising and non-advertising purposes.

The ruling came after a plea by the Competition Commission of India (CCI) seeking clarification on the scope of an earlier order.

The tribunal clarified that user consent is mandatory for all data collected and shared by WhatsApp with its parent company Meta, and not just for advertising purposes.

NCLAT's clarification on WhatsApp's privacy policy
Policy scrutiny

The NCLAT had earlier upheld the CCI's finding that WhatsApp's 2021 privacy policy relied on a coerced consent, forcing users to either accept data sharing or lose access to the service.

However, there was confusion over whether this consent requirement applied to all data shared by WhatsApp or only those used for advertising.

The tribunal clarified that the CCI's direction applied across the board.

WhatsApp granted 3 months to comply with order
Compliance deadline

The NCLAT has given WhatsApp three months to comply with its order, as stated in the original ruling.

During the hearing, WhatsApp's lawyers requested more time, arguing that making system-level changes would be a large and complex task.

The tribunal was initially inclined to give it only one month but eventually allowed it three.

Meta and WhatsApp oppose CCI's plea
Opposition

Meta and WhatsApp have opposed the CCI's plea, arguing that the earlier judgment was clear and needed no clarification.

They claimed that data sharing via optional advertising features already respected user's choice and that the CCI was trying to impose new obligations.

However, the tribunal rejected this argument, saying the key issue is user choice at the point where data is collected and shared.

NCLAT's stance on user data rights and consent
Data rights

The NCLAT emphasized that WhatsApp could not claim open-ended rights over user data.

It also noted that restoring the opt-in and opt-out choices removed the coercive "take-it-or-leave-it" nature of the 2021 policy.

The tribunal stressed that any non-essential/advertising-related data sharing could take place only with a user's clear and revocable consent, with the option to opt in or out at any stage.