On February 3, 2026, the Supreme Court of India delivered a strong rebuke to WhatsApp and its parent company Meta Platforms due to worries that the messaging service’s data-sharing policies and privacy policy violate Indian individuals’ fundamental right to privacy. No technological business, no matter how big, can be permitted to “play with” the privacy rights protected by the Indian Constitution, according to a three-judge panel presided over by Chief Justice of India Surya Kant in a strongly worded hearing. In light of ongoing appeals by WhatsApp, Meta, and the Competition Commission of India (CCI) against the National Company Law Appellate Tribunal’s (NCLAT) ruling regarding WhatsApp’s disputed 2021 privacy policy, the court made its comments.
At the heart of the dispute is WhatsApp’s 2021 privacy policy update, which required users to accept expanded data collection and sharing practices within the Meta group in order to continue using the service. The CCI had found that this take-it-or-leave-it approach which tied acceptance of the policy to continued access to WhatsApp amounted to an abuse of dominant position under the Competition Act, 2002. As a result, the CCI imposed a penalty of ₹213.14 crore on Meta and issued remedial directions requiring clearer user consent and prohibiting mandatory data sharing for advertising.
Court’s Strong Warning: Privacy is Inviolable
During the hearing, the Supreme Court emphasised the constitutional importance of the right to privacy and questioned whether WhatsApp’s practices respected that right. Chief Justice Surya Kant stated unequivocally that the court “will not allow you to share a single word of data” with Meta or anyone else without clear and meaningful consent, adding that if Meta cannot comply with Indian privacy norms, it is free to exit the country. The bench rejected arguments from WhatsApp’s legal team that the Digital Personal Data Protection (DPDP) Act which is not yet in force provided sufficient legal cover for their practices.
Solicitor General Tushar Mehta, appearing for the government, described WhatsApp’s privacy policy as “exploitative,” particularly in how it monetises user data for advertising and commercial gain. He highlighted that personal preferences and behavioural data generated through private interactions can be used to drive targeted advertisements, a practice the court characterised as intrusive and unfair to ordinary users. The bench underscored that even if the content of messages is protected by end-to-end encryption, metadata and user patterns can be exploited to infer sensitive information.
The justices also criticised the language and structure of WhatsApp’s opt-in and opt-out mechanisms, describing them as overly complex and inaccessible to average users, including those with limited literacy or digital experience. The bench posed rhetorical questions about how a street vendor, a rural citizen or a daily wage worker would understand and exercise their rights under such convoluted terms. This underscored judicial concern over the fairness of consent models that rely on lengthy, technical policy statements rather than clear, comprehensible choices.
Privacy, Competition and the Future of Data Practices:
The case comes from the CCI’s 2024 ruling, which determined that WhatsApp had made data sharing a requirement for retaining service access and imposed fines and limitations meant to restore user liberty. In late 2025, the National Company Law Appellate Tribunal (NCLAT) upheld the penalty even though it later relaxed other portions of the CCI’s judgment, such as eliminating a five-year ban on exchanging data connected to advertising. The Supreme Court’s intervention strengthens these decisions by indicating that digital privacy is a basic right issue that requires strong protection rather than just being a business concern.
The court is expected to issue interim orders on data privacy on February 9, 2026, as it continues to hear arguments in the case. In the meantime, Meta has been directed to file a clear affidavit providing an undertaking that it will not share WhatsApp user data for advertising or any other commercial purposes pending the final outcome. The bench warned that failing to provide such an undertaking could result in immediate dismissal of Meta’s appeal.
Senior counsel for WhatsApp argued that users have a choice to opt out of data sharing, and emphasised that the platform’s reliance on end-to-end encryption ensures that the content of private messages remains inaccessible to Meta. However, the court remained unconvinced, noting that the current legal and regulatory framework especially the fact that the DPDP Act has not yet been implemented means users are vulnerable if data sharing continues unchecked.
Justice Bagchi, one of the bench members, added to this critique by focusing on how user behavioural data what people do on the platform as opposed to the content of their chats is often analysed and monetised for advertising and commercial targeting. This type of behavioural profiling, the court noted, can be deeply intrusive, especially when used to generate personalised ads shortly after private interactions, such as medical conversations or personal queries shared on WhatsApp.
Broader Implications for Tech Firms and User Rights
The Supreme Court’s strong stance has far-reaching implications for WhatsApp, Meta, and the broader digital ecosystem in India. By prioritising privacy rights, the judiciary is signalling that global tech firms must align their data practices with Indian constitutional principles, not just international norms or business models. The emphasis on preventing exploitation of personal data even in encrypted platforms highlights the evolving challenges of regulating technology giants in a rapidly digitising economy.
Critically, the court’s remarks also touch on the commercial versus constitutional tension inherent in digital platforms: while companies may seek to monetise user data to support free services and advertising models, this cannot be done at the expense of fundamental rights. The Supreme Court has made it clear that no commercial venture, regardless of scale or popularity, can override constitutional protections to which every Indian citizen is entitled.
This case also sets a potential precedent for how other privacy and data protection disputes are handled in India, particularly as the DPDP Act nears implementation. Tech companies operating in India may face tighter scrutiny of consent mechanisms, data sharing practices and the clarity of user agreements going forward. As discussions continue, stakeholders across the industry, regulatory bodies and civil society groups will closely watch how the Supreme Court’s directives chart the future of digital privacy rights in the country.
