CCI sets stage for showdown with WhatsApp over privacy policy update

On March 24, the Competition Commission of India (CCI) issued an order initiating a formal investigation into whether the updates to WhatsApp’s privacy policy announced in January 2021 amounted to anti-competitive behaviour. While this was not the first instance of competition law being invoked to regulate big tech, the well-argued and cogent order by the CCI marks a significant positive development for Indian regulatory action.

WhatsApp announced an update to its privacy policy in January 2021, which deepens its integration with its parent company Facebook, particularly in the realm of business messaging features. The update also provided greater specificity on the kinds of data that are collected by WhatsApp.

In response to initial media reports and commentary, WhatsApp took the defence that the update does not expand its ability to share data with its parent company, and it is merely a clarification of changes that were brought in through the 2016 update to its privacy policy. This update was the subject of proceedings before the CCI, which ultimately allowed the changes. In 2021, however, the decision to initiate an investigation takes it to the heart of WhatsApp’s public defence and assumes great significance.

The order, which runs into 21 pages, is worthy of discussion for three reasons: the order enshrines into law recent developments in policy and academic thinking; it signals the CCI’s willingness to fully utilise its regulatory toolkit against global technology companies; and finally, it shows the way forward for regulating technology monopolies in a theoretically consistent manner.

Bringing the law up to speed

The accusation that the competition law is an antiquated framework for regulating the digital economy has found many takers in the past few years. This accusation is, in part, well-founded. The competition law evolved over the years to rely on a certain view of how the market is structured, a view which was challenged by digital platforms. In this traditional understanding, competition in the market is said to suffer when ‘consumer welfare’ suffers. The measure of consumer welfare is largely based on the price and volume of goods.

In the past decade, many scholars have made the case that this framework, grounded in the neoclassical economic framework, fails to capture the specific anti-competitive effects of digital platforms. Particularly, these platforms often offer services for free by relying on advertising as a revenue stream; or entities are often willing to bear losses while they establish their market power. Therefore, the abuse of dominant market power by a digital platform may not always be reflected in the price of a product. Instead, this requires that the competition law consider other parameters in order to assess the impact of actions by dominant entities on competition.

Also read: Restrain WhatsApp from implementing new privacy policy, Centre urges HC

This understanding is reflected in regulatory action in many European jurisdictions. For example, privacy has been understood to be a non-price parameter of competition, implying that breaches of privacy norms result in consumer harm. This has been legally accepted in some European proceedings, such as by the European Commission, which examined the Facebook-LinkedIn merger.

This understanding is reflected in the CCI’s own materials. For example, the CCI’s market study of the telecom sector in India noted that an “abuse of dominance can take the form of lowering the privacy protection and therefore fall within the ambit of antitrust, as low privacy standard implies lack of consumer welfare.”

In addition to the larger academic point about digital platforms, many commentators in India pointed to the competition law as a potentially useful framework for addressing the issue of WhatsApp’s 2021 update. A spate of commentaries such as those by the Centre for Internet and Society, Smriti Parsheera writing in The Quint, and Jai Vipra writing in The Federal, noted that at the heart of the 2021 update is a competition law issue about user choice.

These strands of academic and policy thinking have found recognition in the CCI’s order. The order, in paragraph 30, almost word-for-word reflects the understanding of the CCI’s telecom sector market study. The order sets out a cogent scheme for thinking through the competition law: Digital platforms, like WhatsApp, can occupy a dominant position due to high network effects and the difficulty of switching to alternatives.

This dominant position can be used to impose conditions on users, which include conditions about the treatment of their data. Given that users are not given a choice to accept or reject these conditions, and that they cannot easily switch to alternatives, this would result in lower privacy protection for users. A lower standard of privacy for users amounts to lower quality for consumers without justification. This, for the CCI, is ‘consumer harm’ and should be measured as a ‘non-price parameter of competition’.

The lack of an opt-out for users in the 2021 update allowed the CCI to anchor its proceedings around this scheme and distinguish the present case from the CCI’s 2016 order.

The order goes on to explicitly state that its observations should not colour the ongoing investigation. Nevertheless, the order employs particularly progressive reasoning that should influence the development of jurisprudence pertaining to digital platforms in India.

An attack on many fronts

The order is interesting not just because it employs fresh legal reasoning, but also because it is a bold order which signals the CCI’s willingness to put skin in the game. WhatsApp, as a global technology company, has adopted a near-uncompromising public defence of its update. While it was forced to defer the update by three months to May 2021 to suppress the initial disaffection with the platform, the company has insisted that the update does not amount to an unfair exercise of its position.

Also read: SC issues notice to FB, WhatsApp on new privacy policy norms

This insistence has manifested in various forms: WhatsApp has dedicated significant efforts and resources in ‘informing and educating’ users about its privacy policy; its public communications have repeatedly stated that the 2021 update is essentially the same as the 2016 update and that the outrage is merely misinformation; and finally, despite various calls to withdraw the policy, the company has stood its ground and only granted a deferral.

It seems quite clear that WhatsApp will not voluntarily take back the update, and from a hard-nosed business perspective, there is no reason for them to. Facebook’s investment in WhatsApp for the sum of US$19 billion makes sense when you consider the possibilities of integration between the two apps. In fact, executives of the company have publicly stated that the goal is to “make Instagram the storefront, and Whatsapp, the cash register”.

It is then interesting that the CCI has chosen to pose a direct challenge to the cornerstone of the business strategy of the world’s largest technology company. While the investigation will ultimately determine whether any action is taken or not, the harsh tone of the order suggests a willingness to take coercive action or make bold determinations of WhatsApp’s conduct. Either will test the ability of the Indian nation-state’s legal apparatus in controlling the behaviour of large technology companies.

An awareness of this dynamic also perhaps explains the CCI’s approach in this order. Building on earlier determinations made by the CCI in cases about Whatsapp, particularly, from the Harshita Chawla case, the order adopts the understanding that WhatsApp is dominant in the market for over-the-top messaging apps through smartphones in India. This reliance on previous jurisprudence allows the order to cut straight to the heart of the issue without making fresh determinations of relevant markets or of dominance.

In its proceedings, the CCI is also fairly uncompromising in its utilization of the provisions of the Competition Act, 2002. At various stages in the order, the CCI summarily rejects procedural and technical objections that the conduct in question has not yet taken place, or that Facebook should not be made a party to the proceedings.

Even more interesting is the reference to the display advertising market in paragraph 33 of the order. The order notes that the concentration of data with Facebook can create barriers of entry to other players and exclusionary effects in the market for digital advertising. This is particularly striking given that the display advertising market was not directly in question in these proceedings, and even the “relevant market” for the purpose of these proceedings was defined only with reference to over-the-top messaging apps through smartphones.

If anything, this reference is a forewarning of things to come – given that calls for antitrust inquiries in the display advertising market have consistently been made globally and domestically. Particularly in the aftermath of Australia’s News Media Bargaining Code and the responses to it, the display advertising market may emerge as a soft spot for global technology companies from a regulatory perspective. The CCI’s reference to this market may be tangential to these proceedings, but its significance ought not be understated.

Regulating bigness

The epithet big tech itself betrays the primary challenge with effective regulation of global technology companies – their size. Many responded to the outrage to WhatsApp’s update with skepticism. After all, WhatsApp is not alone in employing a data-extractive business model. According to this chain of reasoning, the modern internet is built around the idea of collecting user data for the purpose of microtargeting advertisements. To single out WhatsApp is to ignore the fact that the rules of the game are designed to promote the very thing that WhatsApp is accused of, it argues.

This reasoning goes on to state that the real problem is the lack of robust data protection regulation, which should generally limit companies’ ability to collect and share data. It is not wrong to suggest that strong data protection legislation and well-defined ideas of purpose limitation may also address the problems with the 2021 update. Yet, this is only a partial truth.

We need a data protection legislation which protects user interests. Yet, one must not lose sight of the fact that WhatsApp is not any other application on the internet. It is perhaps the most socially embedded digital platform in India, having achieved this in an amazingly quick time. Moreover, for millions of Indians, it is near unimaginable to think of life without WhatsApp. This is precisely the kind of dilemmas for which competition law was developed and exists.

By employing the correct tool for the correct situation, the Indian state has shown a degree of maturity in its understanding of the legal architecture of markets. Significantly, the order was passed in pursuance of a suo motu decision to engage with this issue.

Ultimately, this is a standoff that may determine how the dynamic between nation-states and technology companies gets rebalanced. It seems CCI has put all its cards on the table. It remains to be seen how the behemoth responds to this.

Aniruddh Nigam is a Research Fellow at the Centre for Applied Law and Technology Research, Vidhi Centre for Legal Policy. Views are personal.