This update has been prepared to set out the key observations of the Competition Commission of India (“CCI”) In Re: Updated Terms of Service and Privacy Policy for WhatsApp Users against WhatsApp LLC and Facebook, Inc., Suo Moto Case No. 01 of 2021 dated 24 March 2021.
Background
The CCI was of the opinion that WhatsApp LLC has prima facie contravened the provisions of Section 4 of the Competition Act, 2002 (the “Act”). The CCI has ordered a detailed investigation to ascertain the full extent, scope and impact of data sharing deeming the consent of its users to be involuntary as a shift out of WhatsApp is difficult due to the network effects of WhatsApp. One way to explain the spirit of the network effect of a dominant player is: “everyone I know is on WhatsApp and so leaving it is difficult as it involves getting my contacts to move – and so I have to accept the new terms of use and privacy policy”).
The CCI noted that since January 2021, WhatsApp LLC started sending notifications to its users which required its users to consent to the updated Terms of Service and Privacy Policy in order to continue using WhatsApp (“WhatsApp Notification”). A prominent feature of the WhatsApp Notification was the change in terms with respect to sharing of the user data with other companies of Facebook Inc., which is the holding company of WhatsApp LLC. It was noted that the previous privacy policies had an option for existing users to choose whether they wanted to share their WhatsApp data with Facebook.
Consent is binary: if one agrees, one uses the service and if not, one is “free” to not use the service. A less potent shade of this is the “opt-out” which allows a user to choose to not accept an aspect and still continue. An earlier case involving WhatsApp was won on because the altered term was an “opt-out”.
The CCI order was not favourable for WhatsApp because the modifications were in nature of “take-it- or-leave-it” rather than “opt-out”.
CCI Observations
Dominance and relevant market:
The CCI noted that WhatsApp operates in the “market for Over-The-Top (OTT) messaging apps through smartphones in India”. For this, the CCI relied on its decision in Harshita Chawla v. WhatsApp Inc., Case No. 15 of 2020 [paragraph 75]. Therefore, the issues of relevant market and the dominance of WhatsApp were not independently analyzed by the CCI in this case.
Opt-out clause:
The absence of a meaningful opt-out was the single largest deciding factor in this case.
This is evident from the CCI order in Vinod Kumar Gupta and WhatsApp Inc., Case No. 99 of 2016, which also involved a similar issue: here the ruling had been different because factually WhatsApp then had provided an option to its users to „opt out‟ of sharing user account information with “Facebook‟ within 30 days of agreeing to the updated terms of service.
In the present case, the CCI viewed the absence of such an opt-out clause to be of a “take-it-or-leave-it nature”. The CCI noted that WhatsApp has strong “network effects‟ in paragraphs 26 and 31 of the order, reproduced below for ease of reference:
“26. Users wishing to switch would have to convince their contacts to switch and these contacts would have to persuade their other contacts to switch. Thus, while it may be technically feasible to switch, the pronounced network effects of WhatsApp significantly circumscribe the usefulness of the same.
…
- Moreover, the users who do not wish to continue with WhatsApp may have to lose their historical data as porting such data from WhatsApp to other competing apps is not only a cumbersome and time consuming process but, as already explained, network effects make it difficult for the users to switch apps.”
The CCI observed that strong “network effects‟ of WhatsApp calls an inevitable lock-in effect for users and then switching to another service is of little practical value because all or most of their social contacts will remain on WhatsApp.
Open-ended nature of data collection:
Another observation of the CCI was with respect to the open-ended nature of data to be collected in the privacy policy. Terms like „includes‟, „such as‟ and „for example‟ created in the opinion of the CCI “vagueness, open-endedness and incomplete disclosures”. The WhatsApp privacy policy was unclear on whether the historical data of the users will also be shared to users who are not present on other Facebook companies (such as Facebook itself and Instagram). The relevant paragraph is extracted below:
“27. … It is also pertinent to note that at numerous places in the policy while illustrating the data to be collected, the list is indicative and not exhaustive due to usage of words like “includes‟, “such as‟, „For example‟, etc., which suggests that the scope of sharing may extend beyond the information categories that have been expressly mentioned in the policy. Such opacity, vagueness, open-endedness and incomplete disclosures hide the actual data cost that a user incurs for availing WhatsApp services.”
Avoiding terms such as “includes” in its privacy policy is a key takeaway from this order.
Reasonable expectations of privacy and future markets:
A doctrine that was employed was reasonable expectation of personal use, that is, the purpose of such data sharing appears to be “beyond users‟ reasonable expectations regarding data quality and security and other relevant aspects of the service for which they register on WhatsApp”.
The concept of data quality mentioned in this order was linked to low protection as well as to ripple effects (“exclusionary effects”). The CCI mentioned potential exclusionary effects in particular how such data sharing will enable WhatsApp/ Facebook to leverage their dominant position in related as well as unrelated market. This is an interesting application of Section 4(2)(e) of the Act which deals with usage of “dominant position in one relevant market to enter into, or protect, other relevant market”. The CCI order stated:
“Lower data protection by a dominant firm can lead to not only exploitation of consumers but can also have exclusionary effects as WhatsApp/Facebook would be able to further entrench/reinforce their position and leverage themselves in neighbouring or even in unrelated markets such as display advertising market, resulting in insurmountable entry barriers for new entrants.”
Addition of parties:
There was an important issue of process involving the implication of Facebook in the proceedings. Facebook represented that it should not be included as a party to the CCI case because Facebook and WhatsApp are distinct entities. The CCI did not accept this submission primarily because the WhatsApp Notification was about sharing data of the users with Facebook. The CCI held that “Facebook is a direct and immediate beneficiary of the new updates”. CCI noted that “it is egregious that Facebook is feigning ignorance about the potential impact of the updates altogether and avoiding from providing its perspective thereon”.
Conclusion
This CCI order presents an opportunity for all entities- potentially dominant in their relevant markets or not- to exercise caution when altering a privacy policy or an existing term or condition. Wherever practicable, an “opt-out” clause within a time limit will reduce the chances of an adverse inference. It is also clear from this CCI order that an entity can be made a party to a CCI proceeding if it is a “direct and immediate beneficiary” of the situation. Finally, open-ended terms such as “including” and “for example” are best avoiding in terms and policies involving data share. India has a code on privacy policy in rules under the Information Technology Act, 2000 which were not mentioned in the CCI order possibly because the grounds were core to competition and not a violation of the IT Act.