Supreme Court Orders WhatsApp to Halt All User Data Sharing

India’s top court has sent an unambiguous message to global digital platforms operating at scale: user trust cannot be conditional.

During a sharp hearing on WhatsApp’s data practices, the Supreme Court rebuked the messaging platform and its parent, Meta, directing WhatsApp to completely stop sharing user data and submit a signed affidavit and undertaking from its management confirming compliance.

The bench, led by Chief Justice of India Surya Kant, was hearing appeals filed by WhatsApp and Meta against a National Company Law Appellate Tribunal (NCLAT) order that upheld a ₹213.14 crore penalty imposed by the Competition Commission of India (CCI) over WhatsApp’s updated privacy policy introduced in 2021.

What unfolded was less a procedural hearing and more a broader examination of how market dominance, user dependency, and data control intersect in India’s digital economy.

A Constitutional Lens on Platform Power

The court’s strongest observations focused on the imbalance between platform power and user choice.

“You were bought by Facebook; tomorrow Facebook will be bought by someone else, and you will transfer the data. You cannot play with the right of privacy of this country,” the CJI said, adding that WhatsApp was making “a mockery of the constitutionalism of this country.”

The bench also rejected the argument that users can simply opt out of data sharing. With WhatsApp holding a near-complete grip over online messaging in India, the court noted that many users, ranging from fruit sellers and domestic workers to rural residents, have little real alternative.

According to the CJI, such users are often “addicted to the system” and cannot reasonably be expected to navigate complex privacy terms.

“You might have taken the data of millions of persons. This is a decent way of committing theft of private information. We will not allow you to use it,” he added.

Why the CCI Case Still Shapes the Debate

At the heart of the case lies the ₹213.14 crore penalty imposed by the CCI in November 2024, which found that WhatsApp had abused its dominant position through a “take-it-or-leave-it” privacy policy.

The policy, rolled out in 2021, stated that users who did not accept the revised terms risked losing access to chats and groups. The CCI ruled that this amounted to unfair conditions under the Competition Act and issued a series of remedial directions, including:

• Prohibiting the tying of service access to data sharing

• Mandating clear opt-in and opt-out mechanisms

• Requiring detailed disclosures on how data is shared across Meta platforms

While the NCLAT later set aside a five-year restriction on advertising-related data sharing and overturned findings related to Meta’s ad ecosystem, it upheld the monetary penalty, keeping the core competition concern intact.

WhatsApp’s Defence and the Court’s Response

Senior advocate Mukul Rohatgi, appearing for WhatsApp, told the court that a Constitution Bench is already examining the privacy policy and that the company has submitted an undertaking stating no user would be barred from the platform for refusing the policy.

WhatsApp also reiterated that messages on its platform are end-to-end encrypted and sought time to submit an affidavit explaining its operations. The court allowed the submission, scheduling the next hearing for February 9.

However, the bench made it clear that encryption alone does not resolve concerns around data exploitation, especially when platform scale limits meaningful consent.

The hearing underscores a broader shift in how India’s judiciary views large technology platforms, not merely as service providers, but as custodians of constitutional rights at a population scale.

For startups and enterprise technology leaders alike, the case is a reminder that data governance is no longer a compliance checkbox. It is fast becoming a core business risk, especially for platforms operating in markets where digital services are deeply embedded in everyday life.

The Supreme Court’s direction to halt data sharing, even temporarily, raises the bar for how consent, competition, and privacy must coexist, particularly in ecosystems dominated by a single player.