WhatsApp Faces March 16 Consent Deadline as India's Supreme Court Challenges Meta Data Sharing

A Deadline to Restore User Choice

WhatsApp has committed to changing its data consent arrangements in India by March 16, 2026, after Supreme Court scrutiny of a privacy policy affecting an estimated 853 million users. The changes would allow people to refuse data sharing with other Meta companies for purposes beyond providing WhatsApp services while retaining access to the messaging platform.

As of March 1, the deadline is approaching, but the underlying legal battle is still pending. Meta and WhatsApp are challenging competition findings and a penalty of Rs 213.14 crore, approximately $25 million. The Competition Commission of India (CCI) is pursuing its own appeal over an appellate decision that removed a ban on sharing WhatsApp data for advertising.

The dispute concerns WhatsApp's 2021 privacy policy, which required users to accept broader data sharing terms to continue using the service. An earlier arrangement had allowed existing users to opt out of sharing information for advertising. Removing that choice brought the relationship between privacy, commercial consent and market power into the courts.

Chief Justice Surya Kant warned during proceedings earlier in February that WhatsApp and Meta could not interfere with Indians' fundamental right to privacy. Describing the court's position, he said the companies would not be allowed to:

play with

He also warned against treating constitutional protections in a way that would:

make a mockery

India's reliance on WhatsApp gives the dispute a reach beyond an ordinary disagreement over an app's terms. Families use it to communicate, businesses use it for transactions, and government services also operate through the platform. The case brings global technology companies into direct conflict with national regulators seeking control over the protection of citizens' digital rights.

The immediate outcome is a commitment to restore meaningful choice. The Supreme Court has yet to decide the substantive appeals over the competition findings and the remedies imposed on the companies.

What Changed in the 2021 Policy?

WhatsApp announced updated terms of service and privacy policies on January 4, 2021. The rules required users to consent to sharing account information, including phone numbers and contact details, with Facebook and its subsidiaries for commercial advertising and marketing purposes.

The initial acceptance deadline was February 8, 2021. Public backlash and regulatory pressure led WhatsApp to extend it to May 15. The central concern remained the same: users faced accepting the terms or losing access to a service deeply embedded in everyday communication.

The 2016 framework had treated existing and new users differently. Existing users could retain privacy settings that limited advertising data sharing, while new users accepted broader terms. The 2021 update removed the more detailed consent mechanism that let people distinguish between sharing information to improve the service and sharing it for commercial advertising.

That change brought WhatsApp more closely into Meta's wider data system. Information gathered from messaging patterns could inform targeted advertising on Facebook and Instagram, including for people who had never directly engaged with those platforms. Targeted advertising means selecting advertisements using information about a person's interests or behaviour.

Digital rights activists challenged the policy in the Delhi High Court, arguing that it violated the fundamental right to privacy recognised by the Supreme Court in its landmark 2017 ruling. Petitioners argued that sharing private data across Meta services allowed WhatsApp to build comprehensive user profiles without meaningful regulatory oversight.

The Internet Freedom Foundation, an intervenor in the proceedings, focused on metadata. This is information about communications, such as whom a person contacts and how frequently, rather than the words inside a message. Its concern was that communication patterns can reveal sensitive details even when message content remains encrypted.

Why a Competition Watchdog Entered the Dispute

The CCI began investigating in March 2021. Its intervention marked the first time India's competition regulator explicitly treated privacy as a form of competition that does not depend on price. A service can be free to use while still competing on the quality of its privacy protections.

In its November 2024 order, the commission found that WhatsApp's privacy policy created an imbalance between what the company knew and what users understood. The CCI described the policy as:

vague, broad, and open-ended

The commission concluded that this information gap disadvantaged users and prevented them from making informed decisions about alternative services. It found that Meta was dominant in the market for messaging applications operating over the internet, with an estimated 853 million WhatsApp users in India and no comparable rival matching its reach or network effects.

Network effects explain why the size of a messaging service matters. The service becomes more useful as more of a person's family members, colleagues, customers and contacts use it. Moving to another app may therefore depend on persuading other people to move too, making a nominal choice between services harder to exercise.

The CCI found both exploitative and exclusionary abuse of dominance under Sections 4(2)(a)(i), 4(2)(c) and 4(2)(e) of the Competition Act, 2002. In straightforward terms, its findings concerned unfair conditions imposed on users, restrictions on competitors' access to the online display advertising market, and the use of messaging dominance to protect advertising interests.

The commission imposed a Rs 213.14 crore penalty. It also ordered WhatsApp to stop sharing user data with Meta entities for advertising purposes for five years and to introduce transparent mechanisms allowing users to opt out.

How Privacy Became a Competition Issue

The CCI's approach connected the treatment of personal information with consumer welfare. Under a view that separates competition and data protection, privacy questions belong principally to privacy regulators. Under the approach adopted here, weakening privacy can also harm consumers when a dominant company uses its position to impose terms they cannot realistically resist.

Germany's Bundeskartellamt took a related approach in 2019, finding that Facebook abused its dominance through excessive data collection across its services. The European Court of Justice affirmed that ruling in July 2023. The Indian decision drew inspiration from that connection between market power and data practices.

India's Digital Personal Data Protection Act, 2023, provides another potential legal basis for examining how companies use personal information. Direct reliance on specific provisions of that law could strengthen future enforcement, alongside the competition principles used in this case.

WhatsApp has indicated that it has begun preparing plans to comply with the Act. The present court dispute, however, centres on the competition findings and the directions arising from the CCI investigation.

From the CCI Order to the Supreme Court

Meta and WhatsApp challenged the CCI order before the National Company Law Appellate Tribunal (NCLAT). In November 2025, the tribunal delivered a split outcome: it upheld the financial penalty but set aside the five year prohibition on sharing data for advertising.

The tribunal said the guiding principle should be to remove exploitation by restoring user choice. In setting out its approach, the NCLAT referred to the:

core principle

Under its decision, collection of data that is unnecessary for the service but intended for advertising could occur only with express consent that users could later withdraw. The remedy therefore shifted from a blanket prohibition to a requirement for genuine, reversible permission.

Meta and WhatsApp took the case to the Supreme Court in January 2026, seeking to overturn the remaining penalties. The CCI filed a cross appeal challenging the NCLAT's decision to permit continued data sharing for advertising.

The key events span five years:

• January 4, 2021: WhatsApp announced its updated terms and privacy policies.
• February 8, 2021: The initial deadline for accepting the terms, later extended to May 15.
• March 2021: The CCI began its investigation.
• November 2024: The CCI imposed the Rs 213.14 crore penalty and ordered restrictions on data sharing.
• November 2025: The NCLAT upheld the penalty but removed the five year advertising data sharing ban.
• January 2026: Meta and WhatsApp appealed to the Supreme Court, while the CCI challenged the removal of the ban.
• February 3, 2026: The Supreme Court heard arguments and raised concerns about market power and privacy.
• March 16, 2026: WhatsApp's promised deadline for compliance with the consent directions.

What the Supreme Court Required

The February 3 hearing was conducted by a bench comprising Chief Justice Surya Kant and Justices Joymalya Bagchi and Vipul M Pancholi. The judges expressed concern that WhatsApp's dominance effectively forced users to accept terms they could not negotiate.

The bench described the situation as a monopoly misusing personal information. In discussing forced data sharing, it used the phrase:

decent way of committing theft of private information

The judges also expressed concern about people unaware of how their personal communications could be used for targeted advertising, referring to them as:

silent customers

Senior Advocate Kapil Sibal, appearing for Meta and WhatsApp, assured the bench that WhatsApp would fully comply with the NCLAT's directions concerning user consent by March 16, 2026.

Following that undertaking, the court disposed of the interim applications seeking stays of the tribunal's order. A stay would have paused the operation of that order while the case continued. The companies were directed to file compliance affidavits with the CCI, formally setting out their compliance.

The substantive appeal remains pending. For users, the immediate consequence is the promised implementation of consent controls. For the companies and the regulator, the wider contest over the legality of the competition findings continues.

What Users Should Be Able to Control

WhatsApp's affidavit to the Supreme Court said that sharing user data with other Meta companies for purposes beyond providing WhatsApp services would not be made a condition of access to the service in India.

The company said it would notify users so they could opt out of data sharing. It also promised a prominent tab in the app's settings where people could review or modify their choices. Future policy updates would comply with these requirements.

The practical change is the separation of two decisions: whether to use WhatsApp and whether to permit data sharing for other purposes. Under the consent framework, declining the second should leave the first available.

The NCLAT's requirement that consent be express and revocable means permission must be given and can later be withdrawn. The promised settings control matters because a person's decision about sharing information may change after they begin using a service.

WhatsApp also asserted that data sharing with other Meta companies for advertising occurs only when users choose optional features. According to the company, no such sharing takes place when those features remain unused.

Encryption and Metadata Raise Different Concerns

WhatsApp maintains that personal messages are protected by end-to-end encryption, which keeps their content from being accessed by Meta employees or third parties. Encryption protects the contents of a communication, while the metadata discussed in this case concerns information surrounding that communication.

The Internet Freedom Foundation has argued that details about communication patterns, group memberships and interaction frequency can expose sensitive information about health, relationships and political activity. Its concern is that profiling can rely on those surrounding details even when the messages themselves remain encrypted.

WhatsApp's technical assurances have also faced scrutiny through recent lawsuits in the United States. Those lawsuits allege that Meta staff can access message content under certain conditions. The allegations have prompted calls for independent audits of WhatsApp's implementation of the Signal protocol, the technical system used for its message encryption.

The company's position remains that its encryption protects personal message content. The Indian dispute also addresses the separate question of what permission users give for data to move between WhatsApp and other Meta services.

The Argument Over Advertising and Alternatives

Digital rights activists argue that WhatsApp functions as essential infrastructure in India and should not use its network effects to extract personal data where users lack meaningful alternatives. They say coercive consent particularly harms vulnerable people who rely on the app for services such as healthcare consultations and financial transactions.

The commercial argument runs in a different direction. Digital rights activist Nikhil Pahwa argues that advertising is a legitimate business model that sustains free internet services. He suggests that people uncomfortable with data sharing can move to alternatives such as Signal or Telegram.

Pahwa also argues that preventing WhatsApp from sharing data with Meta would logically require similar restrictions on Google's integrated services. His position places the dispute within a broader question about how companies combine information across products.

Other industry observers argue that expecting Meta to keep WhatsApp free of advertising and without monetisation indefinitely ignores the commercial purpose of its acquisition. In that view, the purchase was a strategic decision intended to unlock business value rather than a philanthropic act.

The NCLAT's remedy allows a route for advertising related data collection while requiring user permission. The CCI's appeal seeks to challenge the removal of its five year restriction. Those positions leave the Supreme Court considering how far user choice should go in addressing the power of a dominant platform.

March 16 is the next concrete deadline. WhatsApp's undertaking requires it to put consent arrangements into practice, while the pending appeals will determine the broader legal outcome of the privacy and competition battle.

Key Points

• WhatsApp has promised to comply with user consent directions in India by March 16, 2026.
• The case concerns the 2021 policy that removed an advertising data sharing opt out previously available to existing users.
• The CCI found abuse of dominance and imposed a Rs 213.14 crore penalty, approximately $25 million, in November 2024.
• The regulator estimated WhatsApp's Indian user base at 853 million.
• The NCLAT upheld the penalty in November 2025 but removed the five year advertising data sharing ban, requiring express consent that users can withdraw.
• WhatsApp says users will receive notices and a prominent settings control, and that sharing beyond service purposes will not be a condition of access.
• Meta, WhatsApp and the CCI have appeals pending before the Supreme Court.
• The dispute connects privacy protections, user choice and competition in messaging and online advertising.