WhatsApp's 'Take-it-or-leave-it' Policy Under Scanner After SC rap India's apex court pulls up WhatsApp and its parent company Meta over its user data sharing practices.

WhatsApp's data and privacy policies are back in the spotlight after the Supreme Court of India made a stern observation that the instant messaging company "cannot play with the right of privacy of citizens."

Heart of the matter is WhatsApp's privacy policy update in 2021 over how it was handling users' data with other Meta groups of platforms. Following the roll-out, WhatsApp came under regulatory scrutiny. Later, the Competition Commission (CCI) of India imposed a penalty of INR 213.14 crore on WhatsApp and the parent firm over alleged misuse of dominant market position. Interestingly, the National Company Law Appellate Tribunal (NCLAT) too upheld the decision.

India's apex court said that WhatsApp was deploying a "take-it-or-leave-it" privacy policy, prompting users to either choose the policy or lose access to the service entirely. It also noted that the consent mechanism was not drafted in a manner that an everyday person can easily comprehend.

"..."Where is the question of opting out? This is decent way of committing theft of private information…" the court is quoted as saying.

Even as the case is ongoing, the outcome is likely to have a large implication on WhatsApp as well as a lot of other internet companies.

Malcolm Gomes, Chief Operating Officer at Privy by IDfy, tells Entrepreneur India that what the Court is signalling, quite unmistakably, is that consent cannot be engineered through complexity. When data sharing terms are buried in long, opaque policies that an average data principal cannot realistically understand, consent becomes usage friction rather than a meaningful exercise of data principal rights.

This intervention pushes data fiduciaries, particularly significant data fiduciaries, away from checkbox driven compliance and towards clarity, prominence, and intelligibility. In practical terms, the purpose of data collection will need to be simpler, more contextual, and clearly separated from bundled acceptance flows that rely on user fatigue rather than informed consent, he added.

Gomes also noted that the court appears to be drawing a firm and necessary line that access to a dominant communication platform, operated by a significant data fiduciary, cannot be conditional on the surrender of core data principal rights.

He also highlighted that services like WhatsApp are no longer optional utilities in India, they are embedded in daily economic, professional, and social life. The message here is that market dominance cannot be used by a data fiduciary to coerce consent, and that data principals should not be forced to choose between staying connected and retaining control over their personal data.

"This nudge from Supreme Court will drive digital platforms towards transparency and simplicity in terms of privacy terms offered. In case the users cannot comprehend what they are consenting to, then consent cannot be viewed as anything meaningful. The emphasis now is on plain language, layered notices and user-friendly interpretations instead of legal documents that are piled up. In the future, platforms may be expected to show that consent is informed, accessible, and is appropriately understood by regular users. Such a change makes the trust much more reliable and privacy protection is no longer a mere procedure," Tarun Wig, Co-founder & CEO, Innefu Labs told Entrepreneur India.

Having said that, it's important to note that WhatsApp has remained a free service for years. For Meta, the challenge has been to monetise the platform without sabotaging its free proposition. Over the years, Meta has introduced WhatsApp for Business, and recently advertisements. The addition of advertisements, however, raises several privacy concerns.

A possible ban on data sharing for targeted advertising on free platform business models may have a huge impact on the internet economy.

"If data sharing for targeted advertising is restricted, significant data fiduciaries will have to decouple growth from surveillance driven monetisation. This does not make free services unviable, but it does compel a serious rethink of how value is created and captured by data fiduciaries. We are likely to see a shift toward contextual advertising, paid features, enterprise services, and privacy preserving monetisation models. India could emerge as an important test market for proving that scale does not have to come at the cost of data principal rights," Gomes said.

Wig adds that stricter data-sharing policies will most likely make messaging platforms shift towards privacy-respecting business models. This may involve applying more contextual services, enterprise offerings, value-added features or privacy-preserving technologies instead of comprehensive behavioural profiling.

Many digital ecosystems worldwide are already heading towards data minimisation and responsible monetisation. This transition will increase the long-term user confidence and sustainability and align commercial innovation in line with privacy expectations.

The privacy concerns, however, are not unique globally. Even as India has just come up with its privacy laws, the development of privacy frameworks across the world has been uneven, and in many cases, has been influenced by local regulations and enforcement mechanisms. The European Union has been highly protective of data standards at a young age with GDPR, which of course led to increased compliance transparency in their country.

As mentioned-above, India is also building its own privacy and data governance system and transparency, accountability, and user approval are also strengthening. With India still asserting its constitutional and regulatory role on the issue of privacy, the global technology companies are likely to apply similar and high standards of data protection to the Indian users too. The wider trend is towards convergence, with the rights of the user being respected across markets, supported by clear regulation and responsible platform behaviour.