"A thorough and detailed investigation is required to ascertain the full extent, scope and impact of data sharing through involuntary consent of users," the fair trade regulator said.
It asked its investigation arm, the Director General (DG), to carry out an investigation into the matter. It also asked the DG to complete the investigation and submit a report within a period of 60 days from the receipt of order.
In its order against WhatsApp LLC and its parent Facebook, Inc., CCI said having considered media reports and the potential impact of the policy and terms for the users of messaging app and the market, the Commission on January 19 decided to take suo moto cognisance of the matter.
CCI said that as per WhatsApp's previous privacy policies, existing users had an option to choose whether they wanted to share their WhatsApp data with Facebook. However, the new policy notification suggests that users will have to mandatorily accept the terms and policy in their entirety including the terms with respect to sharing of their data across all the information categories with other Facebook companies.
Calling WhatsApp a dominant player in the relevant market for OTT messaging apps through smartphones in India, CCI said it appears that consent to sharing and integration of user data with other Facebook companies for a range of purposes, including marketing and advertising, has been made a precondition for availing WhatsApp services.
It also asked the DG to examine the veracity of WhatsApp's claim that the policy update does not expand the messaging app's ability to share data with Facebook and that the update intends to provide users with further transparency about how WhatsApp collects, uses and shares data.
At numerous places in the policy while illustrating the data to be collected, the list is indicative and not exhaustive, which suggests that the scope of sharing may extend beyond the information categories that have been expressly mentioned in the policy, CCI said.
"Such opacity, vagueness, open-endedness and incomplete disclosures hide the actual data cost that a user incurs for availing WhatsApp services. It is also not clear from the policy whether the historical data of users would also be shared with Facebook Companies and whether data would be shared in respect of those WhatsApp users also who are not present on other apps of Facebook i.e., Facebook, Instagram, etc.," the order said.
Under competitive market condition, CCI said, users would have sovereign rights and control over decisions related to sharing of their personalised data. However, it is not the case with WhatsApp users and moreover, there appears to be no justifiable reason as to why users should not have any control or say over cross-product processing of their data by way of voluntary consent, and not as a precondition for availing WhatsApp's services.
It said users have not been provided with appropriate granular choice, neither upfront nor in the fine prints, to object to or opt-out of specific data sharing terms, which prima facie appear to be unfair and unreasonable for WhatsApp users.
Given the pronounced network effects it enjoys, and the absence of any credible competitor in the instant messaging market in India, WhatsApp appears to be in a position to compromise quality in terms of protection of individualised data and can deem it unnecessary to even retain the user-friendly alternatives such as 'opt-out' choices, without the fear of erosion of its user base.
"...the Commission is of the considered opinion that WhatsApp has prima facie contravened the provisions of Section 4 of the Act through its exploitative and exclusionary conduct...," CCI said while ordering the probe.
Responding to the order, a WhatsApp spokesperson said, "We look forward to engaging with the CCI. WhatsApp remains committed to protecting people's personal communications with end-to-end encryption and providing transparency about how these new optional business features work."
Also Read: A year after crash- Investor wealth doubles