Not anti-advertising, but anti-surveillance capitalism: NCLAT ruling reshapes Meta’s WhatsApp-driven ad ecosystem in India

The National Company Law Appellate Tribunal’s clarification on WhatsApp data sharing has introduced a structural shift in how digital advertising will function in India, particularly for platforms that rely on cross-app data leverage to power performance marketing.

In a ruling with wide ramifications for Meta’s advertising business, the NCLAT has reaffirmed that WhatsApp user data cannot be used for advertising without explicit, purpose-specific, and revocable user consent. Crucially, the tribunal made it clear that advertising-related data use is not exempt from competition law scrutiny, even if access to WhatsApp is not formally conditioned on such sharing.

The decision stems from the long-running dispute between WhatsApp LLC and the Competition Commission of India over WhatsApp’s 2021 privacy policy, which enabled cross-platform data sharing with Meta entities such as Facebook and Instagram. While the tribunal earlier struck down a five-year ban on using WhatsApp data for advertising, it has now corrected an operative error that had diluted disclosure obligations, restoring full transparency requirements across both advertising and non-advertising data use.

The tribunal upheld the CCI’s finding that WhatsApp data sharing strengthened Meta’s position in the online display advertising market by creating structural entry barriers for rival ad-tech players that lack access to comparable first-party communication data. It emphasised that any non-essential data use, including advertising, can occur only with the user’s express and revocable consent, rejecting “take-it-or-leave-it” data terms or open-ended claims over user data.

Why WhatsApp matters to Meta’s ad engine

For Meta, the ruling cuts to the core of how its advertising stack functions in India. WhatsApp is deeply embedded in click-to-WhatsApp ads, conversational commerce, and SME-led performance marketing, all of which have become central to Meta’s growth strategy in the country.

Gowthaman Ragothaman, media veteran and CEO of Saptharushi said WhatsApp is foundational to Meta’s revenue architecture in India. “WhatsApp's revenue is the glue to all Meta’s advertising revenues both directly and indirectly. Particularly for Performance Marketing and even more so for SMEs, WhatsApp advertising has been the most important revenue component,” he said.

The tribunal has now mandated that Meta provide detailed disclosures on what WhatsApp data is shared, how each category maps to an advertising purpose, and how users can opt out at any time. This, experts say, directly affects how data flows between WhatsApp and Meta’s ad targeting, attribution, and optimisation systems.

On whether this exposes vulnerabilities in Meta’s ad stack, Ragothaman said the challenge is less technical and more governance-led. “This all begins with Meta securing consent from the consumer in a very explicit manner, as prescribed by DPDP. I don’t think there is any vulnerability in ad targeting or attribution, but with this ruling, there is definitely need for Meta to maintain a record of processing of consumer consent with all the ads that was served to that consumer,” he said.

Consent architecture becomes the new bottleneck

While Meta has argued that advertising-related data sharing happens only through optional features, the tribunal rejected the notion that optionality weakens the consent requirement. Legal experts say this strikes at the heart of feature-led consent design commonly used by large platforms.

Advocate Prashant Mali, cyber law expert, said the ruling decisively shuts the door on silent data repurposing. “Yes, decisively. The lifting of the ban does not mean a free pass. The NCLAT has made it clear, WhatsApp data cannot be silently repurposed for Meta’s ad engine without fresh, explicit user consent. Internal walls must now actually behave like walls,” Mali said.

He added that the ruling dismantles the legal comfort around bundled or feature-based consent. “The ruling punctures the illusion that bundling ads as a feature equals consent. Consent must be purpose specific, not buried inside platform design. Feature based consent, as a legal crutch, just lost its spine,” he said.

According to Mali, the order is not advisory but enforceable. “Highly binding unless a stay in the Supreme Court, this is not advisory fluff, it is an enforceable compliance standard aligned with constitutional privacy principles and the DPDPA’s consent architecture. Ignore it, and Meta invites regulatory whiplash, even the Data Protection Board would come into action,” he said.

Cross-platform data leverage under pressure

One of the most significant consequences of the ruling is its impact on Meta’s ability to cross-leverage data between WhatsApp, Facebook, and Instagram. “This is the most important point. It will weaken the ability to cross leverage data between WhatsApp, FB and Instagram for sure, as these individual platforms will need to have their consent mechanism and the consumer can choose to revoke consent with one platform and not with the other, within the Meta ecosystem. Not sure Meta will look at a universal consent across all their platforms,” Ragothaman said.

For advertisers, this introduces uncertainty around campaign predictability, particularly for those using custom audiences and first-party data integrations. “For sure, yes. Particularly for those advertisers who transfer or share their data to Meta to create custom audience, this is going to be even worse,” he said.

Mali noted that vague disclosures will now carry regulatory risk. “Vague disclosures are now regulatory red flags. Any ambiguity will be read against Meta, not in its favour, especially during compliance audits or CCI-led follow-ups or even media reporting,” he said.

Prashant Puri, Co-Founder and CEO, AdLift (Liqvd Asia), said the order fundamentally reshapes the balance of power in India’s digital advertising market. “By mandating explicit user consent before WhatsApp data can flow into Meta’s broader ad engine, NCLAT has essentially clipped one of Meta’s strongest wings, frictionless cross-platform data pooling. That will have a direct impact on targeting depth and retargeting efficiency, especially for SMBs that rely heavily on WhatsApp-to-Instagram and Facebook performance loops.

In the short term, we will see brands diversify beyond Meta, double down on first-party data, lean into contextual and consent-led CRM frameworks, and reduce dependence on behavioural profiling. Over time, this accelerates India’s shift toward a privacy-first advertising model where trust and transparency matter as much as scale.

The bottom line is that brands should prepare for higher acquisition costs, cleaner data stacks, and a more competitive landscape where Indian ad-tech players stand to benefit from a more level playing field,” Puri said.

India becomes a structurally different ad market

The ruling also positions India as a uniquely restrictive and compliance-heavy market for behavioural advertising, especially with the upcoming rollout of neutral Consent Managers under the Digital Personal Data Protection framework. “It will not affect the performance efficiency till November 2026, when the neutral and independent Consent Manager comes into effect as per DPDP. This neutral consent manager provides the consumer with an independent destination to revoke or change consent. This will affect Meta significantly,” Ragothaman said.

He added that the impact will extend beyond Meta. “Consent will become paramount for all. Telcos that are using RCS Communications will also be impacted,” he said.

Mali believes the ruling marks a broader philosophical shift in Indian ad-tech regulation. “This ruling shifts power from ad-tech to the user. Behavioural advertising in India is moving from default extraction to earned permission. Expect lower data volumes, higher compliance costs, cleaner consent flows and a brutal reset for lazy ad models built on opacity,” he said.

He also warned that Google could face similar scrutiny. “Google’s ecosystem runs on interlinked consent across Search, YouTube, Android, Maps, Chrome and AdTech. Google’s biggest strength, data unification, is now its biggest liability. Using Gmail or Android signals to optimise YouTube or Display ads without granular, revocable consent risks the same fate as Meta,” Mali said.

Summing up the shift, Mali added, “This is not anti-advertising. This is anti-surveillance capitalism.” The NCLAT has granted WhatsApp three months to comply with the clarified directions, setting the stage for what industry executives expect will be a deeper reset in how data, consent, and competition intersect in India’s digital advertising ecosystem.

Legal closure: compliance risk, not optional reform

Sonam Chandwani, Managing Partner at KS Legal and Associates, said the ruling, when read holistically, operates as a substantive constraint on Meta’s ability to integrate WhatsApp user data into its advertising ecosystem despite the lifting of the five-year prohibition.

She said the tribunal’s explicit rejection of the argument that advertising-related data sharing is optional significantly weakens Meta’s reliance on feature-based or bundled consent frameworks and affirms that any non-essential processing, including advertising and profiling, must be founded on specific, informed, express, and revocable user consent.

Although delivered in appellate proceedings, Chandwani said the clarification carries binding compliance force because it authoritatively interprets statutory consent obligations under the Competition Act in harmony with established data protection principles. The emphasis that WhatsApp cannot assert open-ended or perpetual rights over user data, she added, necessarily compels a restructuring of Meta’s internal data governance, requiring clearly segregated and consent-validated data flows between WhatsApp, Facebook, and Instagram.

Any vagueness or over-generalisation in consent disclosures around WhatsApp-linked advertising, Chandwani warned, would expose Meta to renewed regulatory scrutiny and the risk of further proceedings grounded in inadequate or misleading consent rather than procedural non-compliance.

The NCLAT has granted WhatsApp three months to comply with the clarified directions, setting the stage for a deeper reset in how data, consent, and competition intersect across India’s digital advertising ecosystem.