CCI orders detailed probe in WhatsApp's new privacy policy

The Competition Commission of India (CCI) on Wednesday ordered a detailed probe into WhatsApp's new privacy policy and terms of services, saying the firm contravened the provisions of competition laws through its exploitative and exclusionary conduct in the garb of policy update.

"A thorough and detailed investigation is required to ascertain the full extent, scope and impact of data sharing through involuntary consent of users," the fair trade regulator said.

It asked its investigation arm, the Director General (DG), to carry out an investigation into the matter. It also asked the DG to complete the investigation and submit a report within a period of 60 days from the receipt of order.

In January, WhatsApp had come out with an update in its privacy policy and terms of services that required users to agree to sharing of their data of chat with business accounts, payments and transaction information with its parent company Facebook and third parties associated with it. After criticism from users over sharing of their data, the company postponed the rollout of the policy update to May 15 from February 8.  

In its order against WhatsApp LLC and its parent Facebook, Inc., CCI said having considered media reports and the potential impact of the policy and terms for the users of messaging app and the market, the Commission on January 19 decided to take suo moto cognisance of the matter.

CCI said that as per WhatsApp's previous privacy policies, existing users had an option to choose whether they wanted to share their WhatsApp data with Facebook. However, the new policy notification suggests that users will have to mandatorily accept the terms and policy in their entirety including the terms with respect to sharing of their data across all the information categories with other Facebook companies.

Calling WhatsApp a dominant player in the relevant market for OTT messaging apps through smartphones in India, CCI said it appears that consent to sharing and integration of user data with other Facebook companies for a range of purposes, including marketing and advertising, has been made a precondition for availing WhatsApp services.

"...the Commission is of prima facie opinion that the 'take-it-or-leave-it' nature of privacy policy and terms of service of WhatsApp and the information sharing stipulations mentioned therein, merit a detailed investigation in view of the market position and market power enjoyed by WhatsApp," the order said.

It also asked the DG to examine the veracity of WhatsApp's claim that the policy update does not expand the messaging app's ability to share data with Facebook and that the update intends to provide users with further transparency about how WhatsApp collects, uses and shares data.

The competition watchdog said that users, as owners of their personalised data, are entitled to be informed about the extent, scope and precise purpose of sharing of such data by WhatsApp with other Facebook companies. "However, it appears from the Privacy Policy as well as Terms of Service (including the FAQs published by WhatsApp), that many of the information categories described therein are too broad, vague and unintelligible."

At numerous places in the policy while illustrating the data to be collected, the list is indicative and not exhaustive, which suggests that the scope of sharing may extend beyond the information categories that have been expressly mentioned in the policy, CCI said.

"Such opacity, vagueness, open-endedness and incomplete disclosures hide the actual data cost that a user incurs for availing WhatsApp services. It is also not clear from the policy whether the historical data of users would also be shared with Facebook Companies and whether data would be shared in respect of those WhatsApp users also who are not present on other apps of Facebook i.e., Facebook, Instagram, etc.," the order said.

Under competitive market condition, CCI said, users would have sovereign rights and control over decisions related to sharing of their personalised data. However, it is not the case with WhatsApp users and moreover, there appears to be no justifiable reason as to why users should not have any control or say over cross-product processing of their data by way of voluntary consent, and not as a precondition for availing WhatsApp's services.

It said users have not been provided with appropriate granular choice, neither upfront nor in the fine prints, to object to or opt-out of specific data sharing terms, which prima facie appear to be unfair and unreasonable for WhatsApp users.

Given the pronounced network effects it enjoys, and the absence of any credible competitor in the instant messaging market in India, WhatsApp appears to be in a position to compromise quality in terms of protection of individualised data and can deem it unnecessary to even retain the user-friendly alternatives such as 'opt-out' choices, without the fear of erosion of its user base.

"...the Commission is of the considered opinion that WhatsApp has prima facie contravened the provisions of Section 4 of the Act through its exploitative and exclusionary conduct...," CCI said while ordering the probe.

Responding to the order, a WhatsApp spokesperson said, "We look forward to engaging with the CCI. WhatsApp remains committed to protecting people's personal communications with end-to-end encryption and providing transparency about how these new optional business features work."

Also Read: After just 38% sale in telecom auctions, 5G spectrum prices likely to be reduced

Also Read: Hiring activity picks up pace; IT sector leads the pack

Also Read: A year after crash- Investor wealth doubles