The Competition Commission of India (CCI) has ordered an investigation to ascertain the “full extent, scope, and impact” of data sharing under WhatsApp’s new privacy policy and terms of use that is being implemented with “involuntary consent of users”. WhatsApp has prima facie violated provisions under the Competition Act through its “exploitative and exclusionary conduct” under the garb of a policy update, the Commission said.
WhatsApp’s updates to its privacy policy earlier this year caused uproar, with privacy advocates calling the move out and downloads of privacy-preserving apps such as Signal and Telegram temporarily surging. WhatsApp eventually postponed implementation from January 15 to May 15, 2021. In its order on Wednesday, the CCI said that that the investigation report be submitted within two months. Nothing in the order tantamounts to a final opinion, it added.
According to the CCI, the purpose of data sharing “seems to be beyond users’ reasonable and legitimate expectations regarding quality, security and other relevant aspects” for which users come on WhatsApp. One of the stated purposes of data sharing, to offer targeted ads on Facebook, indicates intentions to build user profiles through cross-linking data collected across services. This can be considered a competitive advantage and raise concerns, the CCI noted.
The competition regulator had taken suo motu cognizance of WhatsApp’s privacy policy updates in January (CITATION), and had sought responses from both WhatsApp and its parent company Facebook India. Facebook had said it should not even be a party to the proceedings since WhatsApp and Facebook are separate legal entities.
According to the CCI, the policy update is effectively mandatory. Earlier, users had the option to choose whether they wanted to share their WhatsApp data with Facebook, which would be a direct beneficiary of the updates. Facebook “feigning ignorance” about the potential impact of the policy update was “egregious”, the regulator said, refusing to leave Facebook out of the proceedings.
Data sharing policy is detrimental to customers: CCI
WhatsApp’s data sharing with Facebook amounts to a degradation of non-price parameters of competition, that is quality, which results in “objective detriment to consumers, without any acceptable justification”.
Such conduct prima facie amounts to imposition of unfair terms and conditions upon the users of WhatsApp messaging app, in violation of the provisions of Section 4(2)(a)(i) of the Act.
Today’s consumers value non-price parameters of services viz. quality, customer service, innovation, etc. as equally if not more important as price. The competitors in the market also compete on the basis of such non-price parameters. Reduction in consumer data protection and loss of control over their personalised data by the users can be taken as reduction in quality under the antitrust law. Lower data protection by a dominant firm can lead to not only exploitation of consumers but can also have exclusionary effects as WhatsApp/Facebook would be able to further entrench/reinforce their position and leverage themselves in neighbouring or even in unrelated markets such as display advertising market, resulting in insurmountable entry barriers for new entrants.
Facebook’s processing of data collected from WhatsApp can be a way to supplement the profiling it does via its own products, by tracking users and their behaviour across locations and devices outside Facebook, the CCI said. WhatsApp’s privacy policy update can have exclusionary effects in the display advertising market, and can undermine competitive processes and create entry barriers in violation of Competition Act, it noted.
Digital markets need closer look through competition lens: CCI
- Subjudice before other courts: WhatsApp said its current Terms of Use and Privacy Policy as well as the proposed update fall within the purview of the information technology law purview and are currently subjudice before various courts in India. It also said that the Indian government and courts are examining the policy update not merely under data protection and privacy laws, but they are accessing whether it conforms with principles of fairness, public policy, and national security considerations.
- Sectoral regulator’s proceedings should be completed first: WhatsApp said that the CCI should not be looking into this matter, citing case law to argue that the Commission should only exercise jurisdiction after proceedings before a sectoral regulator had concluded.
- CCI previously refused to deal with breaches under IT Act: WhatsApp pointed out that in a previous case, the CCI assessed the company’s 2016 terms and privacy policy, and measured the then allegations of data sharing under the IT Act and data protection laws. It had held that alleged violations of IT Act do not fall within its purview. CCI had also said it should not be looking into issues of data localisation and data sharing.
The Commission dismissed WhatsApp’s arguments, noting that:
- WhatsApp failed to point out which sectoral regulator is conducting proceedings regarding the company’s privacy policy update.
- Besides the CCI was viewing the update from the lens of competition law, in an aim to ascertain whether such updates violates Section 4.
- Importantly, the CCI said that it competition law needs to closely examine digital markets.
Further, the Commission is of the considered view that in a data driven ecosystem, the competition law needs to examine whether the excessive data collection and the extent to which such collected data is subsequently put to use or otherwise shared, have anti-competitive implications, which require anti-trust scrutiny
CCI admitted that it had said in a previous case that breaches under the Information Technology Act, 2000 do not fall under its purview, however:
However, in digital markets, unreasonable data collection and sharing thereof, may grant competitive advantage to the dominant players and may result in exploitative as well as exclusionary effects, which is a subject matter of examination under competition law. It is trite to mention that the provisions of the Act are in addition to and not in derogation of the provisions of any other law, as declared under Section 62 of the Act.
CCI’s suo motu cognisance premature since policy has been postponed: WhatsApp
WhatsApp had pushed the proposed policy update to May 15, 2021, after considerable backlash and the government’s intervention. In an earlier matter concerning WhatsApp Pay, the Commission ruled that since WhatsApp Pay had only been launched in the beta version, its actual conduct was yet to manifest in the market and hence the allegation of abuse was premature. Similarly, taking suo motu cognisance of this is also premature, WhatsApp told the CCI.
The Commission said this argument was “misdirected”; because WhatsApp has already announced the policy update, the conduct has already taken place. The May 15 deadline either asks the user to accept the policy or lose full functionality of WhatsApp. Besides, the CCI said, Section 33 of the Competition Act empowers it to intervene even when contravention of Sections 3/4/6 is about to be committed.
No opt out from data sharing with Facebook: CCI
The regulator noted that under WhatsApp’s earlier policies, dated 2016 and 2019, users had the option to not share their account information with Facebook. The latest 2021 policy no longer provides that choice, implying that user data, including those who do not use any of Facebook’s other products, will now be shared across Facebook. It appears that consent to sharing and integrating user data with other Facebook products for purposes including marketing and advertising has been made a “precondition” for using WhatsApp, the CCI said.
The opt-out from data sharing with Facebook was a “critical consideration in deciding against the alleged contravention by WhatsApp”. Since WhatsApp has now removed the opt-out, and users have to mandatorily agree to sharing personal data with Facebook, and further “the policy envisages data collection which appears to be unduly expansive and disproportionate”, it added.
This is borne from the fact that it seeks to capture, amongst others, transactions and payments data; data related to battery level, signal strength, app version, mobile operator, ISP, language and time zone, device operation information, service related information and identifiers etc.; location information of the user even if the user does not use location related features besides sharing information with Facebook on how user interacts with others (including businesses) when using WhatsApp services.
The take-it-or-leave-it nature of WhatsApp’s policy “merit a detailed investigation into the market position and power WhatsApp enjoys”, the CCI said.
WhatsApp has deep network effects: CCI
WhatsApp’s affect on competition is entrenched since it benefits from network effects and is not interoperable. “In India, the network effects have indubitably set in for WhatsApp, which undergird its position of strength and limit its substitutability with other functionally similar apps/platforms,” CCI said.
While it may be technically feasible to switch to other messaging apps, WhatsApp’s network effects limit this, per the regulator. This is evident in the fact that despite increased downloads of Signal and Telegram after WhatsApp’s policy update was announced, WhatsApp’s user base did not see any significant loss, the CCI noted.
WhatsApp’s policy update is broad, vague:CCI
Users are entitled to know about the extent, scope and precise purpose of data sharing by WhatsApp with other Facebook Companies. But the information categories in WhatsApp’s policy update are too “broad, vague and unintelligible”. For instance, what constitutes “service-related information”, “mobile device information”, “payments or business features”, etc. are undefined, the CCI said.
… It is also pertinent to note that at numerous places in the policy while illustrating the data to be collected, the list is indicative and not exhaustive due to usage of words like ‘includes’, ‘such as’, ‘For example’, etc., which suggests that the scope of sharing may extend beyond the information categories that have been expressly mentioned in the policy.
… Further, users are not likely to expect their personal data to be shared with third parties ordinarily except for the limited purpose of providing or improving WhatsApp’s service. However, it appears from the wordings of the policy that the data sharing scheme is also intended to, inter alia, ‘customise’, ‘personalise’ and ‘market’ the offerings of other Facebook Companies. Under competitive market condition, users would have sovereign rights and control over decisions related to sharing of their personalised data.
WhatsApp’s conduct in sharing data is not fully transparent, not based on voluntary and specific user consent, and appears to be prime facie to users, CCI said in its order. The purpose of sharing appears to be beyond users’ reasonable and legitimate expectations regarding quality, security, and other relevant aspects of service for which they register on WhatsApp, it added.
Read more
- CCI dismisses complaint alleging Gmail-Meet integration is anti-competitive
- Competition Commission orders investigation in Google’s App Store and GPay
