Supreme Court Defends Consumer Privacy Against WhatsApp and Meta

Court expresses concerns over the 'take it or leave it' policies affecting consumer privacy rights amidst data sharing debates.

Gopi

•February 4, 2026•6 mins read

SC Warns WhatsApp–Meta Against “Decent Way of Committing Theft” of User Data

Not Started

1. Background: Privacy, Digital Platforms, and Judicial Scrutiny

The Supreme Court’s intervention comes amid rising concerns over how large digital platforms monetise user data without meaningful consent. The Bench observed that millions of Indian users — especially those with limited digital literacy — may be unaware of the implications of sharing their personal data. This positions privacy not only as a constitutional right but as a socio-economic vulnerability.

The controversy centres on WhatsApp’s 2021 privacy policy, which the Competition Commission of India penalised with ₹213.14 crore, citing abuse of dominant position and a “take-it-or-leave-it” approach. While Meta and WhatsApp argue that consent and opt-out choices exist, the Court questioned whether such consent is truly informed or voluntary, especially for marginal users.

The Court broadened the debate by highlighting that data has value, not just privacy implications. Judicial remarks noted that behavioural tendencies and user activity can be monetised for advertising, raising ethical concerns about extraction of value without user awareness or compensation.

The governance logic is that privacy protection becomes ineffective if consent mechanisms are opaque or coercive; ignoring this enables monetisation of citizens’ data at scale, weakening constitutional rights and user autonomy.

"We will not allow you to share a single word of people’s personal data… You have addicted consumers." — CJI Surya Kant
"Our private data is not only sold, but commercially exploited." — Solicitor General Tushar Mehta

2. Core Issue: Ethics and Constitutionality of Forced Consent

The Supreme Court questioned the ethicality and constitutionality of compelling users to share their data as a precondition for accessing essential digital communication platforms. The Court emphasised that “opt-out” options are often illusory, especially for rural and low-income users.

The Bench’s concern arises from platform dominance: WhatsApp’s near-universal penetration in India creates limited alternatives, rendering users effectively consent-less. The idea that consent should be “free, informed, specific and unambiguous” is diluted when withdrawal means practical exclusion from digital communication.

The judges also highlighted the asymmetry between platform power and common consumers, especially domestic workers, street vendors, and rural users unable to interpret complex policy wording.

If forced consent becomes acceptable, platforms can exploit network effects to condition access on data extraction, undermining the right to privacy under Article 21 and distorting market competition.

Challenges Highlighted:

Dominant market position creating absence of real alternatives
Complex consent language inaccessible to low-literacy users
Monetisation of behavioural data beyond traditional privacy breaches
No legal framework on data value or rent-sharing
Asymmetry between parent-subsidiary firms enabling cross-entity data use

3. Legal Context: DPDP Act 2023 and Its Limitations

The Court noted that the Digital Personal Data Protection (DPDP) Act 2023 focuses primarily on privacy and lawful processing of personal data, but remains silent on the economic value of data. Justice Bagchi compared India’s framework with the EU’s Digital Services Act, which imposes stricter rules on data use, algorithmic transparency, and advertising.

The judges also raised the concept of “data rent-sharing,” pointing to global examples where data sharing is taxable or subject to heavy penalties. This indicates a lacuna in Indian law regarding compensation, value capture, and user rights over monetised behavioural data.

The Centre was made a party to the case, signalling potential legislative review. The Solicitor General acknowledged that some jurisdictions impose taxes on data sharing and provide higher safeguards.

Failing to address economic dimensions of data risks perpetuating a system where users’ informational vulnerabilities become sources of corporate profit with no regulatory oversight.

Comparative Insights:

EU Digital Services Act regulates:

targeted advertising
algorithmic transparency
value and accountability frameworks
Some jurisdictions impose taxes or damages for data sharing
Indian law currently covers privacy but not data value or compensation

4. Competition Concerns: CCI and NCLAT Findings

The original dispute arose from the CCI’s finding that WhatsApp’s 2021 policy was “manufactured consent” and forced users to accept data sharing for continued access. The regulator held that this constituted abuse of dominance under competition law.

The ₹213.14 crore penalty was upheld by NCLAT, though it set aside the CCI’s direction prohibiting WhatsApp from sharing data with Meta for five years. Meta and WhatsApp appealed to the Supreme Court, expecting relief; instead, the hearing turned into scrutiny of broader constitutional and ethical issues.

The Court’s remarks suggest that dominance enables forced consent and weakens user choice, making this case a landmark intersection of competition law, privacy law, and constitutional rights.

If competition concerns are ignored, dominant platforms can leverage network effects to extract data without genuine consent, undermining both market fairness and citizen rights.

Key Regulatory Findings:

Abuse of dominance via “take-it-or-leave-it” policy
Forced consent for continued access
Cross-entity data sharing between Meta and WhatsApp
End-to-end encryption defended by WhatsApp but insufficient to address meta-data monetisation

5. Larger Constitutional and Ethical Implications

The Court highlighted that privacy violations are more subtle than data leaks; they include behavioural profiling, commercial targeting, and algorithmic micro-influencing. The example of medical consultations followed by targeted advertising illustrates potential intrusions on dignity.

The Court emphasised that users are “not only consumers, but also products,” signalling that data exploitation converts individuals into economic commodities. This aligns with global discourse on surveillance capitalism and informational asymmetry.

The implications extend beyond privacy to digital inequality. Those with low digital literacy are disproportionately vulnerable because they cannot understand or contest these data extraction practices, making consent a formality rather than genuine choice.

Ignoring these ethical concerns risks normalising a digital ecosystem where individual autonomy is traded away for convenience, weakening constitutional protections and widening inequality.

6. Way Forward: Strengthening Policy and Judicial Oversight

The Supreme Court signalled intent to develop jurisprudence that protects privacy, autonomy, and data value. This may include requiring undertakings from companies, mandating transparent consent mechanisms, and embedding user-centric standards in digital governance.

Judicial suggestions to compare Indian law with EU standards indicate potential reforms in transparency, advertising regulation, and data valuation. The case also opens debate on whether platforms should compensate users for monetisable behavioural data.

There is growing need for legislative clarity on rent-sharing, taxation of data flows, and cross-entity data sharing within conglomerates. Coordination between competition law and privacy frameworks will be crucial.

Without such reforms, India risks creating a digital marketplace where data extraction becomes the default business model, compromising rights and consumer welfare.

Potential Reforms:

Strengthen consent architecture (simple, multilingual, opt-in)
Introduce data value/rent-sharing frameworks
Regulate cross-entity data sharing within conglomerates
Align with EU transparency and advertising norms
Enhance competition-privacy coordination
Impose damages or taxes for exploitative data practices

7. Conclusion

The Supreme Court’s stance reflects a decisive shift in recognising data not merely as private information but as an economic asset requiring protection, transparency, and user rights. The case could reshape India’s digital governance architecture by integrating privacy, competition, and ethical standards. Ensuring meaningful consent, regulating data value extraction, and safeguarding vulnerable users will be essential for a rights-centric digital ecosystem.

Quick Q&A

Everything you need to know

The Supreme Court’s observations bring to the fore two interlinked constitutional issues: the right to privacy under Article 21 and the limits of corporate power in a digital economy. Since the Puttaswamy judgment (2017), privacy has been recognised as a fundamental right, placing a positive obligation on the State to protect individuals from both State and non-State actors. The Court’s remarks indicate concern that large digital platforms may be infringing this right through opaque consent mechanisms and extensive data sharing.

Legally, the case exposes gaps in India’s current regulatory framework. While the Digital Personal Data Protection (DPDP) Act, 2023 focuses on privacy and consent, it does not adequately address the economic value of personal data or the downstream commercial exploitation of behavioural information. The Court’s reference to “rent-sharing” and “data value” highlights a shift from viewing data merely as private information to recognising it as an economic asset extracted from users.

Thus, the issue is not limited to WhatsApp alone but raises a broader jurisprudential question: Can consent obtained under conditions of market dominance and lack of real choice be considered constitutionally valid? The Court’s intervention suggests a move towards stricter scrutiny of digital consent and stronger protection for India’s vast base of ordinary users.

The term ‘silent consumers’ refers to millions of users who rely on dominant digital platforms but lack the awareness, bargaining power, or digital literacy to meaningfully understand or challenge complex data policies. The Supreme Court’s emphasis reflects a constitutional concern for substantive equality, recognising that formal consent does not always translate into informed or voluntary consent.

In India, a large proportion of users come from rural areas, informal sectors, and economically weaker backgrounds. As the Chief Justice pointed out, expecting such users to navigate “cleverly crafted” legal language undermines the spirit of informed consent. This creates an imbalance where platforms leverage network effects and market dominance to impose “take-it-or-leave-it” terms, effectively coercing users into data sharing.

Protecting silent consumers is therefore essential not only for safeguarding privacy but also for maintaining trust in digital governance. It aligns with India’s constitutional ethos of protecting the vulnerable and ensuring that technological progress does not come at the cost of fundamental rights.

At a theoretical level, opt-out mechanisms are presented as tools of user autonomy, allowing individuals to withdraw consent if they disagree with data-sharing practices. However, in practice, their effectiveness is questionable, especially in markets characterised by monopoly or near-monopoly conditions. The Supreme Court rightly questioned whether opting out of data sharing is meaningful when it effectively requires opting out of an essential communication service.

From a legal standpoint, consent must be free, informed, specific, and unambiguous. When users are forced to choose between continued access and surrendering personal data, consent becomes coerced rather than voluntary. This concern was echoed earlier by the Competition Commission of India (CCI), which found WhatsApp’s 2021 privacy policy to be an abuse of dominant position.

Therefore, while opt-out mechanisms may satisfy formal compliance, they fail the test of substantive fairness. A more robust framework would require default data minimisation, clear separation of core services from data monetisation, and genuine alternatives for users.

The Court’s focus marks an important evolution in digital rights jurisprudence. Traditionally, data protection laws have centred on privacy—preventing unauthorised access or misuse of personal information. However, modern digital platforms extract immense economic value from user data by analysing behavioural patterns, preferences, and tendencies for targeted advertising and commercial gain.

Justice Bagchi’s observations highlight that even non-private or voluntarily shared data retains economic value. Once aggregated and analysed, such data becomes a powerful commercial resource. Ignoring this dimension allows platforms to legally monetise user behaviour while offering services that appear ‘free’, masking the true cost borne by users.

Recognising data value opens the door to discussions on data ownership, compensation, taxation, and rent-sharing. It also aligns Indian discourse with global trends, particularly in the European Union, where digital regulations address both privacy and market power.

The European Union offers a useful comparative model through instruments such as the General Data Protection Regulation (GDPR) and the Digital Services Act (DSA). Unlike India’s DPDP Act, EU regulations go beyond privacy to address data processing transparency, platform accountability, and the economic exploitation of user data.

Under GDPR, consent must be explicit and revocable without disproportionate consequences. The DSA further imposes obligations on large platforms to mitigate systemic risks arising from data-driven business models. In some jurisdictions, misuse or excessive exploitation of personal data attracts heavy penalties or damages, creating strong deterrence.

By urging comparison with EU standards, the Supreme Court signals that India may need a more comprehensive and innovative regulatory approach—one that balances innovation with user rights and ensures that global tech giants are subject to meaningful oversight.

The case illustrates the growing convergence between privacy law, competition law, and constitutional rights. It shows that data dominance can translate into market dominance, enabling platforms to dictate unfair terms to users. Regulatory silos—where privacy, competition, and consumer protection are treated separately—are increasingly inadequate in addressing such challenges.

For policymakers, the lesson is clear: India needs an integrated digital governance framework that recognises users as both citizens with rights and contributors of economic value. This may involve strengthening the DPDP Act, empowering competition authorities, and enhancing institutional coordination between regulators.

Ultimately, the case underscores that in a digital society, citizens are not merely consumers but stakeholders. Protecting their data, dignity, and autonomy is essential for ensuring that technological growth remains aligned with constitutional values.