Supreme Court Scrutinizes WhatsApp Data Practices and DPDP Act's Privacy Implications
Contents4
Indian Express - Opinion · 28 Feb 2026 · 2 min read
Prelims · Polity Mains · GS2 Polity and constitution High relevance
The Supreme Court is examining whether WhatsApp's data collection practices violate constitutional privacy rights, while the Digital Personal Data Protection Act (DPDP) 2023 faces challenges for granting excessive government exemptions and weakening RTI safeguards.
Key points
WhatsApp-Meta case: The Supreme Court questioned whether user consent under conditions of market dominance is truly voluntary, suggesting data extraction may constitute theft under Article 21's right to privacy.
Metadata significance: WhatsApp collects extensive metadata including communication patterns and location data, which when combined with Meta's ecosystem creates comprehensive user profiles beyond message content.
CCI action: The Competition Commission imposed a ₹213.14 crore penalty on WhatsApp for anti-competitive practices, though NCLAT later lifted the 5-year data sharing ban while upholding the fine.
DPDP Act shortcomings: The 2023 law weakens RTI protections by removing 'public interest' exceptions for disclosing officials' information, hampering corruption investigations.
Government exemptions: DPDP grants sweeping discretionary powers to state agencies, creating asymmetry in data protection standards between government and private entities.
[GS2-Governance] The case tests institutional capacity to regulate digital monopolies while balancing fundamental rights, connecting to broader debates about platform governance.
[GS3-Technology] The technical aspects of metadata collection highlight challenges in implementing meaningful data protection in an interconnected digital ecosystem.
Constitutional tests: The Court's 'follow the Constitution or leave' ultimatum to WhatsApp sets a precedent for applying fundamental rights to global tech firms operating in India.
Comparative analysis: Indian users lack GDPR-equivalent protections like right to erasure, revealing disparities in global data governance standards.
Way Forward: India needs to establish an independent data protection authority with enforcement powers, amend DPDP to remove government exemptions, and mandate algorithmic transparency for dominant platforms.
Key terms
- Competition Commission of India
- Statutory body under the Competition Act 2002 that regulates anti-competitive practices. Its ₹213 crore penalty on WhatsApp establishes precedent for treating data dominance as market power abuse under Section 4 of the Act.
- K S Puttaswamy Judgment
- 2017 Supreme Court ruling that recognized privacy as a fundamental right under Article 21. Forms the constitutional basis for current data protection debates by establishing informational autonomy as a core privacy component.
- Digital Personal Data Protection Act 2023
- India's first comprehensive data protection law that establishes rights and obligations around personal data processing. Criticized for exempting government agencies from key provisions and diluting RTI safeguards, raising concerns about state surveillance overreach under Article 19(1)(a).
- Metadata
- Data about data - includes information like communication timestamps, device details, and location patterns. While not content itself, metadata can reveal sensitive behavioral profiles, making it protected under the Puttaswamy privacy judgment's 'informational privacy' doctrine.
Practice question
Critically analyze the implications of the Supreme Court's scrutiny of WhatsApp's data practices and the Digital Personal Data Protection Act (DPDP) 2023 for India's digital privacy framework. (250 words, 15 marks)
GS2 15 marks 250 words Mains
Key terms to include: Article 21 Puttaswamy judgment Digital Personal Data Protection Act 2023 Competition Commission of India Metadata GDPR Algorithmic transparency Informational privacy
Answer framework
Introduction
Briefly introduce the context of Supreme Court's examination of WhatsApp's data practices and DPDP Act 2023, highlighting their significance for digital privacy in India.
Constitutional and Legal Implications
Right to privacy under Article 21 (Puttaswamy judgment) and its application to digital platforms.
Challenges of ensuring voluntary consent in dominant market positions.
DPDP Act's exemptions for government agencies and its impact on fundamental rights.
Regulatory and Governance Challenges
Role of Competition Commission of India in regulating data dominance.
Asymmetry in data protection standards between government and private entities.
Need for an independent data protection authority with enforcement powers.
Technological and Global Standards
Significance of metadata collection and its privacy implications.
Disparities between Indian data protection standards and global frameworks like GDPR.
Importance of algorithmic transparency for dominant platforms.
Conclusion
Suggest a balanced approach: strengthening DPDP Act to remove exemptions, enhancing regulatory oversight, and aligning with global privacy standards while ensuring constitutional safeguards.
Fact check
All facts verified