A thorough and detailed investigation is required to ascertain the full extent, scope, and impact of data sharing through involuntary consent of users, the regulator said.
The regulator directed its investigation arm, the director general (DG), to complete the probe and submit a report within 60 days.
The order against WhatsApp LLC and parent Facebook Inc. came after CCI took suo motu cognisance of the matter on considering media reports and the potential impact of the policy and terms for WhatsApp users and the market.
According to WhatsApp’s submissions, the 2021 update does not expand its ability to share data with Facebook and intends to provide users with further transparency about how the messaging app collects, uses, and shares data.
The regulator said the veracity of such claims would be examined during the investigation by the DG.
The commission further said that users, as owners of their personalised data, are entitled to be informed about the extent, scope, and precise purpose of sharing of such information by WhatsApp with other Facebook companies.
Such opacity, vagueness, open-endedness, and incomplete disclosures hide the actual data cost that a user incurs for availing WhatsApp’s services, it said.
Besides, the regulator said it is not clear from the policy whether the historical data of users would also be shared with Facebook companies and whether data would be shared in respect of those WhatsApp users, who are not present on other apps of Facebook.
There appears to be no justifiable reason as to why users should not have any control or say over such cross-product processing of their data by way of voluntary consent, and not as a precondition for availing WhatsApp’s services, the commission said.
Users have not been provided with appropriate granular choice, neither upfront nor in the fine print, to object to or opt out of specific data-sharing terms, which prima facie appear to be unfair and unreasonable for them.
On careful and thoughtful consideration of the matter, the conduct of WhatsApp in sharing of users’ personalised data with other Facebook companies, in a manner that is neither fully transparent nor based on voluntary and specific user consent, appears prima facie “unfair to users”, CCI said.
“The commission is of the considered opinion that WhatsApp has prima facie contravened the provisions of Section 4 of the Act through its exploitative and exclusionary conduct, as detailed in this order, in the garb of policy update,” the regulator said.