Exploitative: CCI Orders Probe Into WhatsApp’s New Privacy Policy

The regulator noted that users will have to mandatorily accept the new terms and policy in their entirety.

WhatsApp has been criticised for implementing its controversial privacy policy

(File Photo: IANS)

India’s antitrust and fair trade regulator Competition Commission of India (CCI) on Wednesday, 24 March, ordered an investigation into WhatsApp’s proposed privacy policy changes.

“WhatsApp has prima facie contravened the provisions of Section 4 of the Act through its exploitative and exclusionary conduct, as detailed in this order, in the garb of policy update,” the order by the body said.

The regulator observed, “The conduct of WhatsApp in sharing of users’ personalised data with other Facebook companies, in a manner that is neither fully transparent nor based on voluntary and specific user consent, appears prima facie unfair to users.”

The body noted that users will have to mandatorily accept the new terms and policy in their entirety.

Responding to the probe ordered by the CCI, WhatsApp said it looks forward to engaging with the Commission and remains committed to end-to-end encryption.

“We look forward to engaging with the CCI. WhatsApp remains committed to protecting people’s personal communications with end-to-end encryption and providing transparency about how these new optional business features work,” A WhatsApp spokesperson told The Quint.

CCI’s Observation

“..the commission is of prima facie opinion that the ‘take-it-or-leave-it’ nature of privacy policy and terms of service of WhatsApp and the information sharing stipulations mentioned therein, merit a detailed investigation in view of the market position and market power enjoyed by WhatsApp,” the order said.

The commission said that the policy was an abuse of dominant position, as users are required to accept the unilaterally dictated ‘take-it-or-leave-it’ terms by a dominant messaging platform in their entirety, including the data sharing provisions therein, if they wish to avail their service.

A thorough and detailed investigation is required to ascertain the full extent, scope, and impact of data sharing through involuntary consent of users, the regulator said.

Therefore, the commission had directed the Director General to start an investigation into the matter under the provisions of Section 26(1) of the Act, providing a period of 60 days within which to complete the investigation and submit the report.