Competition Commission of India
In Re: Updated Terms Of Service And ... vs Whatsapp Llc on 24 March, 2021
COMPETITION COMMISSION OF INDIA
Suo Moto Case No. 01 of 2021
In Re: Updated Terms of Service and Privacy Policy for WhatsApp Users
Against:
WhatsApp LLC
1601 Willow Road, Menlo Park
California 94025, USA Opposite Party No. 1
Facebook, Inc.
1 Hacker Way, Menlo Park
California 94025, USA Opposite Party No. 2
CORAM:
Mr. Ashok Kumar Gupta
Chairperson
Ms. Sangeeta Verma
Member
Mr. Bhagwant Singh Bishnoi
Member
Order under Section 26(1) of the Competition Act, 2002
1. Recently, it has been reported in various media reports1 that WhatsApp Inc. ('WhatsApp') has updated its privacy policy and terms of service for WhatsApp users. It was inter alia reported that the new policy makes it mandatory for the users to accept the terms and conditions in order to retain their WhatsApp account information and provides as to how it will share personalised user information with Facebook Inc. ('Facebook') and its subsidiaries. Hereinafter, WhatsApp and Facebook are together referred to as the 'Opposite Parties'.
1https://www.business-standard.com/article/companies/whatsapp-mandates-data-sharing-with- facebook-in-updated-privacy-policy-121010601431_1.html;
https://economictimes.indiatimes.com/magazines/panache/whatsapp-updates-privacy-policy-makes- data-sharing-with-facebook-mandatory/articleshow/80135267.cms, etc. S. M. Case No. 01 of 2021 1
2. It is observed that since early January 2021, WhatsApp users started receiving notification from WhatsApp informing them about the new changes in WhatsApp's terms of service and privacy policies. The text of such notification, as reported in media, is as follows:
WhatsApp is updating its terms and privacy policy.
Key updates include more information about:
• WhatsApp's service and how we process your data. • How businesses can use Facebook hosted services to store and manage their WhatsApp chats.
• How we partner with Facebook to offer integrations across the Facebook Company Products By tapping AGREE, you accept the new terms and privacy policy, which take effect on February 8, 2021. After this date, you will need to accept these updates to continue using WhatsApp. You can also visit the Help Center if you would prefer to delete your account and would like more information.
3. Thus, the above notification suggests that in order to be able to use the services of WhatsApp, from 08.02.2021 onwards, users will have to mandatorily accept the new terms and policy in their entirety including the terms with respect to sharing of their data across all the information categories with other Facebook Companies. As per previous privacy policy(ies) dated 25.08.2016 and 19.12.2019, existing users had an option to choose whether they wanted to share their WhatsApp data with Facebook. However, with the latest update, every WhatsApp user has to mandatorily agree to such data sharing with Facebook.
4. Earlier, in 2017, the Commission, while examining the allegations made by the Informant in respect of the privacy policy of WhatsApp in Case No. 99 of 2016 titled as Vinod Kumar Gupta AND WhatsApp Inc. ('Vinod Gupta Case'), noted that WhatsApp had provided an option to its users to 'opt out' of sharing user account information with 'Facebook' within 30 days of agreeing to the updated terms of service and privacy policy.
S. M. Case No. 01 of 2021 25. Having considered the media reports and the potential impact of the Policy and Terms for WhatsApp users and market, the Commission, in its ordinary meeting held on 19.01.2021, decided to take suo moto cognisance of the matter. In the said meeting, the Commission deemed it appropriate to seek response from both WhatsApp and Facebook on certain queries, as specified in the order dated 19.01.2021. Pursuant to the said directions, WhatsApp filed confidential version of its response on 03.02.2021. The Commission in its meeting held on 11.02.2021 considered the same and observed that the same is not in accord with Regulation 35 of the Competition Commission of India (General) Regulations, 2009 (the, 'General Regulations') whereby and whereunder a party seeking confidentiality has to make an application setting out cogent reasons for seeking such treatment along with confidential and non-confidential versions of the information provided and document(s) sought to be filed. The Commission further observed that the response filed by WhatsApp is also not in compliance with Regulation 11 of General Regulations as the same is not signed in terms of the provisions contained therein. In view of the above, WhatsApp was directed to submit its response in compliance with the observations made in this order latest by 25.02.2021. The Commission further observed that despite clear directions in the order dated 19.01.2021 passed by the Commission, Facebook neither responded to the queries raised by the Commission nor moved any application seeking extension of time to comply with the requisitions made by the Commission. In these circumstances, the Commission directed Facebook to submit its response to the queries mentioned in the order dated 19.01.2021 without any delay and in any event latest by 25.02.2021.
6. WhatsApp and Facebook responded to the said directions of the Commission vide separate e-mails dated 25.02.2021.
7. Facebook has inter alia submitted that "....While Facebook is the parent company of WhatsApp, Facebook and WhatsApp are separate and distinct legal entities. It is WhatsApp (not Facebook) that offers and operates WhatsApp's instant messaging service that is the subject of the Hon'ble Commission's Order. Specifically, the 2021 Update is in relation to the Terms of Service and Privacy Policy of the messaging service offered by WhatsApp. In light of the above, Facebook humbly submits that it should not S. M. Case No. 01 of 2021 3 be arrayed as a party to these proceedings, and WhatsApp is the appropriate entity to provide the Hon'ble Commission with the information sought....". The Commission has given careful consideration to the response filed by Facebook and notes that the same is not only evasive but is in clear non-compliance with the directions issued by the Commission vide its order dated 19.01.2021. As one of the avowed objectives of the key updates included more information about inter alia as to how WhatsApp partners with Facebook to offer integrations across the Facebook Company Products, it is surprising that Facebook instead of providing its response thereon, as sought by the Commission, is trying to evade its comments. Facebook is a direct and immediate beneficiary of the new updates and in these circumstances, it is egregious that Facebook is feigning ignorance about the potential impact of the updates altogether and avoiding from providing its perspective thereon. In these circumstances, Facebook is proper party in the present matter and its presence is required for effective and complete determination of the issues involved in the present matter. Accordingly, the issue of deletion of its name from array of parties does not arise and the request of Facebook in this regard is rejected.
8. As far as WhatsApp is concerned, it filed public version of its response dated 03.02.2021 vide its submission dated 25.02.2021. In relation to compliance with Regulation 11 of the General Regulations, it has been submitted that "....Section 35 of the Competition Act, 2002 (Competition Act) allows an enterprise to authorize legal practitioners to present its case before the Hon'ble Commission. This is also consistent with the Hon'ble Commission's past practice in allowing companies to file, plead and appear through their authorized legal representatives who have also been allowed to sign the written submissions on behalf of their client....". It has been further submitted that ".....requiring companies to sign every submission, responses, pleadings, etc. to be filed before the Hon'ble Commission is a cumbersome obligation and may result in a delay of proceedings before the Hon'ble Commission. To avoid any such delay, WhatsApp has authorized its legal representatives to act, appear, plead, and file before the Hon'ble Commission on its behalf, in relation to proceedings in the captioned matter...". For the reasons set out above, WhatsApp requested the Commission to accept its response and other submissions filed on behalf of WhatsApp, in accordance with Section 35 of S. M. Case No. 01 of 2021 4 the Competition Act and the General Regulations". An authorization letter dated 22.02.2021 was also enclosed along with the letter dated 25.02.2021. WhatsApp also filed certain additional submissions detailing the progress in the various proceedings against the update in terms of service and privacy policy before multiple fora as well as the introduction of in-app notifications by WhatsApp to inform its users about the same.
9. The Commission has gone through the response of WhatsApp also and is constrained to note that despite an opportunity having been granted by the Commission, WhatsApp has not only failed to comply with the directions of the Commission but has also taken the pleas which are ex facie untenable. In this regard, the Commission notes that the reference to the provisions of Section 35 of the Act by WhatsApp is thoroughly misplaced. This provision deals with appearance of parties before the Commission. It does not deal with signing of pleadings. In this regard, reference has already been made to the provisions of Regulation 11 of the General Regulations which inter alia provides for signing of replies which are filed pursuant to the directions of the Commission. For felicity of reference, the same is excerpted below:
Signing of information or reference. -
11 (1) An information or a reference or a reply to a notice or direction issued by the Commission shall be signed by-
(a) the individual himself or herself, including a sole proprietor of a proprietorship firm;
(b) the Karta in the case of a Hindu Undivided Family (HUF);
(c) the Managing Director and in his or her absence, any Director, duly authorized by the board of directors in the case of a company,
(d) the President or the Secretary in the case of an association or society or similar body or the person so authorized by the legal instrument that created the association or the society or the body;
(e) a partner in the case of a partnership firm;
(f) the chief executive officer in the case of a co-operative society or local authority;S. M. Case No. 01 of 2021 5
(g) in the case of any other person, by that person or by some person duly authorized to act on his behalf.
(2) A reference shall be signed and authenticated by an officer not below the rank of a Joint Secretary to the Government of India or equivalent in the State Government or the Chief Executive Officer of the Statutory Authority if the same has been received from the Central Government or State Government or Statutory Authority.
(3) Without prejudice to the provisions of this regulation, the counsel may also append his or her signature to the information or reference as the case may be.
10. From the above, it is manifestly clear that the replies have to be filed in accordance with the stipulations made in the aforesaid regulations. No doubt, in terms of Regulation 11(3) of the General Regulations, the counsel may also append his signature but that does not absolve the parties from complying with the requirements of Regulation 11(1) as the facts are required to be verified by the concerned companies/ enterprises/ individuals etc. only. From the response of WhatsApp itself, it is evident that it "...has authorized its legal representatives to act, appear, plead, and file before the Hon'ble Commission on its behalf, in relation to proceedings in the captioned matter". The authorization is conspicuously silent about signing of pleadings. The Commission finds the contention of WhatsApp that compliance with such requirement is a "cumbersome obligation" and "may result in a delay of proceedings before the Hon'ble Commission", as rather egregious and being inconsistent with the General Regulations. The past instance alluded by WhatsApp is of no consequence when the legal requirement is crystal clear. In this regard, the Secretariat is directed to ensure that in future no such pleadings should be accepted which are not signed as per the provisions of General Regulations. To avoid any further delay in the matter, the Commission proceeds to consider the submissions of WhatsApp in the interest of justice with a direction to comply with the requirements of General Regulations immediately and any delay in this regard would be construed as continuing non-cooperation with attendant consequences.
S. M. Case No. 01 of 2021 611. WhatsApp has also made a preliminary objection and submitted that its current Terms of Service and Privacy Policy as well as the proposed update in the same (the, '2021 Update') fall within the purview of the information technology law framework and these issues are currently sub judice before various courts and other fora in India. It has also been averred that the examination of the 2021 Update by courts and the Government of India is not merely limited to data protection/ privacy laws but extends to assessing more broadly whether the 2021 Update is in conformity with principles of fairness, public policy and national security considerations. Furthermore, WhatsApp has averred that the questions set out in the Commission's order are sub judice and therefore, the Commission should not look into the same set of issues. WhatsApp has relied on the decision of the Hon'ble Supreme Court in Competition Commission of India v. Bharti Airtel Limited and others, (2019) 2 SCC 521, and stated that the said decision emphasized the need to maintain comity between decisions of different authorities on the same issues and held that the Commission should only exercise jurisdiction after the proceedings before the sectoral regulator had concluded and attained finality. WhatsApp has also relied on the decision of Hon'ble High Court of Bombay in Star India Private Limited v. Competition Commission of India, 2019 SCC OnLine Bom 3038 and decision of the Commission in Jitesh Maheshwari v. National Stock Exchange of India Limited, Case No. 47 of 2018.
12. WhatsApp has also averred that the Commission has previously, in Vinod Kumar Gupta case, assessed the Terms of Service and Privacy Policy as updated in 2016, and regarded the allegations raised against data sharing related to the Information Technology Act (IT Act) and data protection/ privacy laws, and held that allegations of breach of the Information Technology Act do not fall within its purview. WhatsApp has also relied on the decisions of the Commission in Harshita Chawla v. WhatsApp Inc., Case No. 15 of 2020 ('Harshita Chawla case') as well as XYZ v. Alphabet Inc., Case No. 07 of 2020 to contend that issues related to data localization and data sharing need not be looked in under the Competition law.
S. M. Case No. 01 of 2021 713. In relation to the above mentioned contentions of WhatsApp, the Commission is of the view that the judgments relied by WhatsApp have no relevance to the issues arising in the present proceedings and its plea is misplaced and erroneous. The judgment of the Hon'ble Supreme Court in Bharti Airtel Case has no application to the facts of the present case as the thrust of the said decision was to maintain 'comity' between the sectoral regulator (i.e. TRAI, in the said case) and the market regulator (i.e. the CCI). WhatsApp has failed to point out any proceedings on the subject matter which a sectoral regulator is seized of. Needless to add, the Commission is examining the policy update from the perspective of competition lens in ascertaining as to whether such policy updates have any competition concerns which are in violation of the provisions of Section 4 of the Act. Further, the Commission is of the considered view that in a data driven ecosystem, the competition law needs to examine whether the excessive data collection and the extent to which such collected data is subsequently put to use or otherwise shared, have anti-competitive implications, which require anti-trust scrutiny. The reliance of WhatsApp on Vinod Kumar Gupta and other cases is also misplaced as the Commission has only observed that breach of the Information Technology Act does not fall within its purview. However, in digital markets, unreasonable data collection and sharing thereof, may grant competitive advantage to the dominant players and may result in exploitative as well as exclusionary effects, which is a subject matter of examination under competition law. It is trite to mention that the provisions of the Act are in addition to and not in derogation of the provisions of any other law, as declared under Section 62 of the Act.
14. WhatsApp has averred that 2021 Update has not yet been implemented and its implementation has been postponed to 15.05.2021. It has been submitted that abuse of dominance is a post-facto analysis and the Commission in Harshita Chawla case (supra) held that since WhatsApp Pay had only been launched in the beta version, its actual conduct was yet to manifest in the market and therefore, the allegation of abuse of dominance was premature. Based on the same, WhatsApp has submitted that taking Suo moto cognizance of the 2021 Update is premature. In this regard, the Commission is of the view that the plea is misdirected. In the present case, WhatsApp has already S. M. Case No. 01 of 2021 8 announced its privacy policy and terms of service and, as such, the conduct has already taken place which can be appropriately examined within the purview of Section 4 of the Act. The deadline fixed by WhatsApp, i.e. 15.05.2021 is for acceptance of such updated terms by the users failing which they would not have full functionality of WhatsApp. Thus, in nutshell, the conduct has already occurred, and the time has started running for the users to comply therewith. Pursuant to such policy updates, the users are already getting prompts for acceptance of updated terms and giving of consent thereto by the users, are reflective of the fact that the actionable conduct has already taken place which can be examined by the Commission within the framework of Section 4 of the Act. In this regard, it is also pertinent to mention the provisions of Section 33 of the Act, which empower the Commission to intervene even in respect of acts which are in contravention of the provisions of Sections 3/4/6 of the Act if such acts are about to be committed. A plain reading of the long title to the Act also makes it beyond any pale of doubt that the Commission is obligated to 'prevent' practices having adverse effect on competition. In view of the foregoing, the plea is legally untenable and unsustainable.
15. After addressing the abovementioned procedural issues/preliminary objection(s), the Commission now proceeds to examine the issues on merit to prima facie assess whether the Opposite Parties have violated provisions of Section 4 of the Act.
16. Before adverting to the examination of issues on merit, it would be appropriate to note, in brief, the response submitted by WhatsApp, in response to the clarifications sought by the Commission:
16.1 The primary aim of the 2021 Update is twofold: (i) to provide users with further transparency about how WhatsApp collects, uses and shares data; and (ii) to inform users about how optional business messaging features work when certain business messaging features become available to them.
16.2 2016 Update allowed existing users the option to opt-out of sharing their WhatsApp account information with Facebook Companies for ads and product experiences purposes. WhatsApp is continuing to honour the 2016 opt-out for anyone who had chosen it, and the most recent updates do not change that. If anyone who has S. M. Case No. 01 of 2021 9 previously opted out agrees to the 2021 Update, WhatsApp will acknowledge their agreement to the 2021 Update and also continue to honour the 2016 opt-out. 16.3 Privacy of personal messaging is integral to the growth and vision of WhatsApp.
This commitment to keeping WhatsApp a safe and protected place where people can connect privately has not changed. WhatsApp cannot see users' personal conversations with friends and family because they are protected by end-to-end encryption.
16.4 2021 Update does not expand WhatsApp's ability to share data with Facebook and does not impact the privacy of personal messages of WhatsApp users with their friends and family.
16.5 The 2021 Update provides more specifics on how WhatsApp works with businesses that use Facebook or third parties to manage their communications with users on WhatsApp. Even for users who choose to interact with a business on WhatsApp, the implications of such data sharing are minimal.
17. In light of its averments, WhatsApp has submitted that the 2021 Update raises no concerns from a competition perspective. 2021 Update aims to provide greater transparency by further explaining the collection, usage and sharing of data which users had consented to under the 2016 Update and to inform users about how optional business messaging features work when certain business messaging features become available to them. Therefore, WhatsApp has requested the Commission to refrain from initiating an investigation into WhatsApp's 2021 Update.
18. After briefly reproducing the averments made by WhatsApp, now the Commission would examine the issue on merit. It is noted that Section 4 of the Act proscribes abuse of dominance by an entity commanding dominant position in relevant market. Thus, delineation of relevant market is essential to define the boundaries of the market to ascertain dominance and for analysing the alleged abusive conduct. Recently, the Commission had an occasion to examine the relevant market in the context of business practices of WhatsApp and Facebook in Harshita Chawla case wherein an Information was filed before the Commission alleging inter alia contravention of the provisions of Section 4 of the Act against WhatsApp and Facebook for abusing their dominant S. M. Case No. 01 of 2021 10 position in launching their payment app services. While noting that WhatsApp operates in the 'market for Over-The-Top (OTT) messaging apps through smartphones in India, the Commission made the following observations while delineating the relevant market in the said matter:
"70. The Commission observes that WhatsApp and Facebook are third-party apps broadly providing internet-based consumer communications services. Consumer communications services can be sub-segmented based on different parameters e.g. on the basis of functionality, some apps enable real-time communication in various forms, such as voice and multimedia messaging, video chat, group chat, voice call, sharing of location, etc., while others provide services such as communication with a wider set of people in an impersonal setting such as sharing status and posts. Further, while some consumer communications apps are proprietary in nature, i.e. available on only one operating system such as FaceTime and iMessage service available on Apple's iPhones, while others operate as over-the-top ('OTT') apps offered for download on multiple operating systems, e.g. WhatsApp and Facebook are available on a variety of mobile operating systems, including iOS, Android, Windows Phone etc. Furthermore, the segmentation can also be based on whether a set of consumer communications apps are available for all types of devices, or only for particular type(s) of device e.g. while Facebook is available on smartphones as well as PCs, WhatsApp essentially is a smartphone app. Having said that the Commission is cognizant of the peculiar features which these consumer communication apps possess, where for some functions they may appear substitutable while not so for others, making it all the more challenging to compartmentalize them into water-tight categories. Thus, it is important to identify the primary or most dominant feature(s) of an app to categorise it into a particular relevant market.
71. WhatsApp is primarily an Over-The-Top (OTT) messaging App, linked to a smartphone device and mobile number, which has features of communicating personally, both one-to-one or group. It uses the internet to send and receive text messages, images, audio or video content, sharing of S. M. Case No. 01 of 2021 11 location etc. from one user to another as opposed to the mobile network used for traditional texting/SMSing.
72. Facebook, on the other hand, is a social networking app which connects many users simultaneously. The users can post text, photos and multimedia which is visible to all those other users whom they have agreed to be their 'friend' or with a different privacy setting, with any other user. Users can also use various embedded apps, join common-interest groups, receive notifications of their Facebook friends' activities etc.
73. Thus, even within the OTT consumer communication services market, services provided by OTT service providers may not be substitutable. One of the economic tools widely used by competition authorities for gauging substitutability and for defining relevant market in traditional markets is the SSNIP (Small but Significant Non-transitory Increase in Price) Test. However, given that 'price' is the most significant consideration for application of SSNIP Test, it may be difficult to contextualise substitutability from SSNIP point of view for OTT communication Apps as they do not levy monetary charge on the users.
-----------
75. Taking into consideration these features and the different parameters cited supra, yet not being overly influenced by strict compartmentalisation, the Commission is of the view that the relevant product market in which WhatsApp operates is the 'market for Over-The-Top (OTT) messaging apps through smartphones'. The Commission observes that though in terms of nomenclature this relevant product market appears different from the one proposed by the Informant, it largely covers the same set of players and competition dynamics.
76. As regards the geographic market, the Commission agrees with the Informant that the functionality of OTT messaging apps through smartphones does not differ depending upon the region or country concerned, either in terms of price, functionality or operating system.S. M. Case No. 01 of 2021 12
However, the competitive conditions, regulatory architecture and players may vary in different countries/regions. Since conditions for competition are homogenous in India, the geographic area of India has been taken as the relevant geographic market for the purposes of assessment."
19. Further, in relation to the dominance of WhatsApp in the market for OTT messaging apps through smartphones in India, the Commission in Harshita Chawla case noted that:
"84. Such data shows that WhatsApp messenger is the most widely used app for social messaging, followed by Facebook Messenger in the relevant market delineated by the Commission supra. Further, it is way ahead of other messaging apps like Snapchat, WeChat etc. showing its relative strength. Given that WhatsApp messenger and Facebook Messenger are owned by the same group, they do not seem to be constrained by each other, rather adding on to their combined strength as a group. Moreover, WhatsApp Messenger works on direct network effects where an increase in usage of a particular platform leads to a direct increase in the value for other users--and the value of a platform to a new user will depend on the number of existing users on that platform. Thus, given its popularity and wide usage, for one-to-one as well as group communications and its distinct and unique features, WhatsApp seems to be dominant.
85. The Commission is cognizant that the data relied upon by the Informant cannot be said to be free from infirmities and is based on global usage or users. However, in the absence of concrete data/information available in the Indian context other than the subjective information on popularity of WhatsApp, the Commission is of the view that these trends and results can be used as a proxy. More so, these trends appear to be intuitively in sync with the information available in public domain, which though does not confirm market share/strength of WhatsApp in any quantitative terms, nevertheless point towards its dominance.
86. Further, with respect to the dependence of consumers on the enterprise and countervailing buyer power, WhatsApp undeniably has the advantage of reaping the benefits of network effect. Network effect in turn ensures that S. M. Case No. 01 of 2021 13 customers do not switch to other platforms easily unless there is a new competitor entering the market with an altogether disruptive technology. Moreover, lack of interoperability between platforms is another concern, as a result of which customers may be unwilling to incur switching costs, despite the same being primarily psychological.
87. As regards the barriers to entry, they may arise indirectly as a result of the networks effects enjoyed by the dominant player in the market, i.e. WhatsApp, in the present case. Since networks effects lead to increased switching costs, new players may be disincentivized from entering the market."
20. Based on the above, the Commission concluded that WhatsApp is dominant in the relevant market for OTT messaging apps through smartphones in India. As such, in light of the said holding of the Commission in Harshita Chawla case, there is no occasion to separately and independently examine the issue of relevant market and dominance of WhatsApp therein, when there is no change in the market construct or structure since the passing of the said order in August, 2020 and announcing of the new policy by WhatsApp on January 04, 2021 - which itself seems to emanate out of the entrenched dominant position of WhatsApp in the said relevant market, as detailed in this order. The Commission has also taken note of the recent developments wherein the competing apps, i.e. Signal and Telecom witnessed a surge in downloads after the policy announcement by WhatsApp. However, apparently this has not resulted in any significant loss of users for WhatsApp. Further, as elaborated in detail in succeeding paras, the network effects working in favour of WhatsApp reinforces its position of strength and limit its substitutability with other functionally similar apps/platforms.
21. The Commission has perused the previous privacy policies of WhatsApp dated 25.08.2016 as well as 19.12.2019 wherein the existing users were provided with an option to choose not to have their WhatsApp account information shared with Facebook. The relevant excerpt is as follows:
S. M. Case No. 01 of 2021 14The choices you have. If you are an existing user, you can choose not to have your WhatsApp account information shared with Facebook to improve your Facebook ads and products experiences. Existing users who accept our updated Terms and Privacy Policy will have an additional 30 days to make this choice by going to Settings > Account
22. However, it is evident from the latest policy statement published on WhatsApp website (as extracted in para 2), and as has been widely reported by media, this choice is no longer available to users under the new policy. This implies that data of users, including that of those who are not users of any other service within the Facebook family of companies, will now be shared across Facebook Companies. Simply put, it appears that consent to sharing and integration of user data with other Facebook Companies for a range of purposes including marketing and advertising, has been made a precondition for availing WhatsApp service.
23. In this regard, it is pertinent to note that in Vinod Gupta case (supra), it was alleged that by mandating users to agree with its terms of service and privacy policy as updated in August, 2016, WhatsApp has been sharing information/ data of its users with 'Facebook' which in turn was being used by 'Facebook' for targeted advertisements, in contravention of the provisions of Section 4 of the Act. While closing the matter, the Commission pertinently noted that WhatsApp provided its users an option "...to 'opt out' of sharing user account information with 'Facebook' within 30 days of agreeing to the updated terms of service and privacy policy". However, no such option has been granted to the users under the present policy update.
24. Thus, in Vinod Gupta case (supra), the fact that WhatsApp provided an option to its users to 'opt out' of sharing user account information with 'Facebook' within 30 days of agreeing to the updated terms of service and privacy policy was a critical consideration in deciding against the alleged contravention by WhatsApp. As against this, the new privacy policy has removed the 'opt out' option given to the users and the users have now to mandatorily agree to sharing of their personalised data by WhatsApp with Facebook Companies and further the policy envisages data collection which S. M. Case No. 01 of 2021 15 appears to be unduly expansive and disproportionate. This is borne from the fact that it seeks to capture, amongst others, transactions and payments data; data related to battery level, signal strength, app version, mobile operator, ISP, language and time zone, device operation information, service related information and identifiers etc.; location information of the user even if the user does not use location related features besides sharing information with Facebook on how user interacts with others (including businesses) when using WhatsApp services. All such data collected by WhatsApp would be shared with Facebook Companies for various usages envisaged in the policy.
The Commission also took note of the submission of WhatsApp that it would continue to honour the 'opt-out' option exercised by users during 2016 Update; however, the 2021 Update do not create any carveout for such users who opted for not sharing their information with Facebook.
25. Having considered the overarching terms and conditions of the new policy, the Commission is of prima facie opinion that the 'take-it-or-leave-it' nature of privacy policy and terms of service of WhatsApp and the information sharing stipulations mentioned therein, merit a detailed investigation in view of the market position and market power enjoyed by WhatsApp. The Commission has also taken note of the submission of WhatsApp that 2021 Update does not expand WhatsApp's ability to share data with Facebook and the said update intends to provide users with further transparency about how WhatsApp collects, uses and shares data. The veracity of such claims would also be examined during the investigation by the DG.
26. WhatsApp is the most widely used app for instant messaging in India. A communication network/platform gets more valuable as more users join it, thereby benefiting from network effects. The OTT messaging platforms not being interoperable, communication between two users is enabled only when both are registered on the same network. Thus, the value of a messaging app/platform increases for users with an increasing number of their friends and acquaintances joining the network. In India, the network effects have indubitably set in for WhatsApp, which undergird its position of strength and limit its substitutability with other functionally similar apps/platforms. This, in turn, causes a S. M. Case No. 01 of 2021 16 strong lock-in effect for users, switching to another platform for whom gets difficult and meaningless until all or most of their social contacts also switch to the same other platform. Users wishing to switch would have to convince their contacts to switch and these contacts would have to persuade their other contacts to switch. Thus, while it may be technically feasible to switch, the pronounced network effects of WhatsApp significantly circumscribe the usefulness of the same. The network effects have been reflected when despite increase in downloads of the competing apps like Signal and Telegram, user base of WhatsApp apparently did not suffer any significant loss. As pointed out in Harshita Chawla case (supra), the second largest player in terms of market share in the relevant market of instant messaging and thus the next sizeable alternative available to users is Facebook Messenger, which too is a Facebook Group company. Thus, the conduct of WhatsApp/ Facebook under consideration merits detailed scrutiny.
27. The Commission is of further opinion that users, as owners of their personalised data, are entitled to be informed about the extent, scope and precise purpose of sharing of such data by WhatsApp with other Facebook Companies. However, it appears from the Privacy Policy as well as Terms of Service (including the FAQs published by WhatsApp), that many of the information categories described therein are too broad, vague and unintelligible. For instance, information on how users "interact with others (including businesses)" is not clearly defined, what would constitute "service-related information", "mobile device information", "payments or business features", etc. are also undefined. It is also pertinent to note that at numerous places in the policy while illustrating the data to be collected, the list is indicative and not exhaustive due to usage of words like 'includes', 'such as', 'For example', etc., which suggests that the scope of sharing may extend beyond the information categories that have been expressly mentioned in the policy. Such opacity, vagueness, open-endedness and incomplete disclosures hide the actual data cost that a user incurs for availing WhatsApp services. It is also not clear from the policy whether the historical data of users would also be shared with Facebook Companies and whether data would be shared in respect of those WhatsApp users also who are not present on other apps of Facebook i.e., Facebook, Instagram, etc. S. M. Case No. 01 of 2021 17
28. Further, users are not likely to expect their personal data to be shared with third parties ordinarily except for the limited purpose of providing or improving WhatsApp's service. However, it appears from the wordings of the policy that the data sharing scheme is also intended to, inter alia, 'customise', 'personalise' and 'market' the offerings of other Facebook Companies. Under competitive market condition, users would have sovereign rights and control over decisions related to sharing of their personalised data. However, this is not the case with WhatsApp users and moreover, there appears to be no justifiable reason as to why users should not have any control or say over such cross-product processing of their data by way of voluntary consent, and not as a precondition for availing WhatsApp's services.
29. As pointed out previously, users earlier had such control over sharing of their personal data with Facebook, in terms of an 'opt-out' provision available for 30 days in the previous policy updates. However, the same has not been made available to users this time. Thus, users are required to accept the unilaterally dictated 'take-it-or-leave-it' terms by a dominant messaging platform in their entirety, including the data sharing provisions therein, if they wish to avail their service. Such "consent" cannot signify voluntary agreement to all the specific processing or use of personalised data, as provided in the present policy. Users have not been provided with appropriate granular choice, neither upfront nor in the fine prints, to object to or opt-out of specific data sharing terms, which prima facie appear to be unfair and unreasonable for the WhatsApp users.
30. On a careful and thoughtful consideration of the matter, the conduct of WhatsApp in sharing of users' personalised data with other Facebook Companies, in a manner that is neither fully transparent nor based on voluntary and specific user consent, appears prima facie unfair to users. The purpose of such sharing appears to be beyond users' reasonable and legitimate expectations regarding quality, security and other relevant aspects of the service for which they register on WhatsApp. One of the stated purposes of data sharing viz. targeted ad offerings on other Facebook products rather indicates the intended use being that of building user profiles through cross-linking of data S. M. Case No. 01 of 2021 18 collected across services. Such data concentration may itself raise competition concerns where it is perceived as a competitive advantage. The impugned conduct of data-sharing by WhatsApp with Facebook apparently amounts to degradation of non-price parameters of competition viz. quality which result in objective detriment to consumers, without any acceptable justification. Such conduct prima facie amounts to imposition of unfair terms and conditions upon the users of WhatsApp messaging app, in violation of the provisions of Section 4(2)(a)(i) of the Act.
31. Given the pronounced network effects it enjoys, and the absence of any credible competitor in the instant messaging market in India, WhatsApp appears to be in a position to compromise quality in terms of protection of individualised data and can deem it unnecessary to even retain the user-friendly alternatives such as 'opt-out' choices, without the fear of erosion of its user base. Moreover, the users who do not wish to continue with WhatsApp may have to lose their historical data as porting such data from WhatsApp to other competing apps is not only a cumbersome and time consuming process but, as already explained, network effects make it difficult for the users to switch apps. This would enhance and accentuate switching costs for the users who may want to shift to alternatives due to the policy changes.
32. Today's consumers value non-price parameters of services viz. quality, customer service, innovation, etc. as equally if not more important as price. The competitors in the market also compete on the basis of such non-price parameters. Reduction in consumer data protection and loss of control over their personalised data by the users can be taken as reduction in quality under the antitrust law. Lower data protection by a dominant firm can lead to not only exploitation of consumers but can also have exclusionary effects as WhatsApp/Facebook would be able to further entrench/reinforce their position and leverage themselves in neighbouring or even in unrelated markets such as display advertising market, resulting in insurmountable entry barriers for new entrants.
33. Data and data analytics have immense relevance for competitive performance of digital enterprises. Cross-linking and integration of user data can further strengthen data S. M. Case No. 01 of 2021 19 advantage besides safeguarding and reinforcing market power of dominant firms. For Facebook, the processing of data collected from WhatsApp can be a means to supplement the consumer profiling that it does through direct data collection on its platform, by allowing it to track users and their communication behaviour across a vast number of locations and devices outside Facebook platform. Therefore, the impugned data sharing provision may have exclusionary effects also in the display advertising market which has the potential to undermine the competitive process and creates further barriers to market entry besides leveraging, in violation of the provisions of Section 4(2)(c) and (e) of the Act. As per the 2021 update to the privacy policy, a business may give third-party service provider such as Facebook access to its communications to send, store, read, manage, or otherwise process them for the business. It may be possible that Facebook will condition provision of such services to businesses with a requirement for using the data collected by them. The DG may also investigate these aspects during its investigation.
34. In view of the foregoing, the Commission is of the considered opinion that WhatsApp has prima facie contravened the provisions of Section 4 of the Act through its exploitative and exclusionary conduct, as detailed in this order, in the garb of policy update. A thorough and detailed investigation is required to ascertain the full extent, scope and impact of data sharing through involuntary consent of users.
35. Accordingly, the Commission directs the Director General ('DG') to cause an investigation to be made into the matter under the provisions of Section 26(1) of the Act. The Commission also directs the DG to complete the investigation and submit the investigation report within a period of 60 days from the receipt of this order.
36. Both the Opposite Parties have also sought an opportunity to make oral submissions on its response in a hearing before the Commission. It this regard, it is suffice to note that a three judges Bench of the Hon'ble Supreme Court through its judgment in Competition Commission of India v. Steel Authority of India Ltd., Civil Appeal No. 7779 of 2010 decided on September 09, 2010 has already settled the issue by holding that "...Neither any statutory duty is cast on the Commission to issue notice or grant S. M. Case No. 01 of 2021 20 hearing, nor can any party claim, as a matter of right, notice and/or hearing at the stage of formation of opinion by the Commission, in terms of Section 26(1) of the Act that a prima facie case exists for issuance of a direction to the Director General to cause an investigation to be made into the matter."
37. Lastly, it is noted that WhatsApp has filed its submissions dated 03.02.2021 in two versions viz. confidential as well as non-confidential (filed on 25.02.2021). The confidential versions were kept separately during the pendency of the proceedings. The DG, however, shall be at liberty to examine the confidentiality claims as per law. Further, it is made clear that no confidentiality claim shall be available in so far as the information/ data that might have been used/referred to in this order for the purposes of the Act in terms of the provisions contained in Section 57 thereof.
38. It is also made clear that nothing stated in this order shall tantamount to a final expression of opinion on the merits of the case and the DG shall conduct the investigation without being swayed in any manner whatsoever by the observations made herein.
39. The Secretary is directed to send a copy of this order alongwith the material available on record to the DG forthwith and also to take steps in terms of the direction contained in para 10 of this order for ensuring strict compliance with the General Regulations and to issue a suitable public notice in this regard for future guidance.
Sd/-
(Ashok Kumar Gupta) Chairperson Sd/-
(Sangeeta Verma) Member Sd/-
(Bhagwant Singh Bishnoi) Member New Delhi Date: 24 / 03 / 2021 S. M. Case No. 01 of 2021 21