Consent is binary: if one agrees, one uses the service and if not, one is “free” to not use the service. A less potent shade of this is the “opt-out” which allows a user to choose to not accept an aspect and still continue. An earlier case involving WhatsApp was won on because the altered term was an “opt-out”.
The CCI order was not favourable for WhatsApp because the modifications were in nature of “take-it- or-leave-it” rather than “opt-out”.
Dominance and relevant market:
The CCI noted that WhatsApp operates in the “market for Over-The-Top (OTT) messaging apps through smartphones in India”. For this, the CCI relied on its decision in Harshita Chawla v. WhatsApp Inc., Case No. 15 of 2020 [paragraph 75]. Therefore, the issues of relevant market and the dominance of WhatsApp were not independently analyzed by the CCI in this case.
The absence of a meaningful opt-out was the single largest deciding factor in this case.
This is evident from the CCI order in Vinod Kumar Gupta and WhatsApp Inc., Case No. 99 of 2016, which also involved a similar issue: here the ruling had been different because factually WhatsApp then had provided an option to its users to „opt out‟ of sharing user account information with “Facebook‟ within 30 days of agreeing to the updated terms of service.
In the present case, the CCI viewed the absence of such an opt-out clause to be of a “take-it-or-leave-it nature”. The CCI noted that WhatsApp has strong “network effects‟ in paragraphs 26 and 31 of the order, reproduced below for ease of reference:
“26. Users wishing to switch would have to convince their contacts to switch and these contacts would have to persuade their other contacts to switch. Thus, while it may be technically feasible to switch, the pronounced network effects of WhatsApp significantly circumscribe the usefulness of the same.
- Moreover, the users who do not wish to continue with WhatsApp may have to lose their historical data as porting such data from WhatsApp to other competing apps is not only a cumbersome and time consuming process but, as already explained, network effects make it difficult for the users to switch apps.”
The CCI observed that strong “network effects‟ of WhatsApp calls an inevitable lock-in effect for users and then switching to another service is of little practical value because all or most of their social contacts will remain on WhatsApp.
Open-ended nature of data collection:
“27. … It is also pertinent to note that at numerous places in the policy while illustrating the data to be collected, the list is indicative and not exhaustive due to usage of words like “includes‟, “such as‟, „For example‟, etc., which suggests that the scope of sharing may extend beyond the information categories that have been expressly mentioned in the policy. Such opacity, vagueness, open-endedness and incomplete disclosures hide the actual data cost that a user incurs for availing WhatsApp services.”
Reasonable expectations of privacy and future markets:
A doctrine that was employed was reasonable expectation of personal use, that is, the purpose of such data sharing appears to be “beyond users‟ reasonable expectations regarding data quality and security and other relevant aspects of the service for which they register on WhatsApp”.
The concept of data quality mentioned in this order was linked to low protection as well as to ripple effects (“exclusionary effects”). The CCI mentioned potential exclusionary effects in particular how such data sharing will enable WhatsApp/ Facebook to leverage their dominant position in related as well as unrelated market. This is an interesting application of Section 4(2)(e) of the Act which deals with usage of “dominant position in one relevant market to enter into, or protect, other relevant market”. The CCI order stated:
“Lower data protection by a dominant firm can lead to not only exploitation of consumers but can also have exclusionary effects as WhatsApp/Facebook would be able to further entrench/reinforce their position and leverage themselves in neighbouring or even in unrelated markets such as display advertising market, resulting in insurmountable entry barriers for new entrants.”
Addition of parties:
There was an important issue of process involving the implication of Facebook in the proceedings. Facebook represented that it should not be included as a party to the CCI case because Facebook and WhatsApp are distinct entities. The CCI did not accept this submission primarily because the WhatsApp Notification was about sharing data of the users with Facebook. The CCI held that “Facebook is a direct and immediate beneficiary of the new updates”. CCI noted that “it is egregious that Facebook is feigning ignorance about the potential impact of the updates altogether and avoiding from providing its perspective thereon”.