In a historic decision the Competition Commission of India (CCI) fined Meta Platforms, Inc. (Meta) ₹213.14 crore for abusing its dominant position in the Indian market. This landmark event follows WhatsApp’s 2021 privacy policy covertly pushing users to accept its expanded data-sharing practices without meaningful/ informed consent. This case serves as a testament to the urgent need for stronger digital competition laws and robust data protection frameworks like India’s Digital Personal Data Protection Act, 2023 (DPDPA) along with its much awaited Rules and the proposed Digital Competition Bill (DBC).

Meaningful Consent and a Transient Privacy

Consent is the heart of privacy. It allows users to exercise control over their personal information. It perceives that information when assimilated, is collected, used, processed and shared according to the user preferences and knowledge. While users callously disregard the notion of consent in their day-to-day online activities, it is not just a formality. It is the linchpin of data protection.

The CCI’s findings against Meta pivot on its violation of informed consent. The 2021 WhatsApp privacy policy operated on a ‘take-it-or-leave-it’ model. This approach strikes at the anvil of user autonomy. Meta’s dominant position in the market leaves no room for any meaningful alternatives that the users can switch to. This murky consent, a box ticked under duress or misunderstanding, betrays the very essence of privacy. The exploitation of this loophole highlights a systemic issue: corporate profits triumph over user rights and autonomy.

A Global Push for Accountability

This exploitative behaviour by Big-Tech has been flagged by regulators globally. European Union’s (EU) Digital Markets Act (DMA) aims to regulate gatekeeper platforms that hold considerable market power in the region. In a preliminary finding of June 2024, Apple’s app store policies were under scrutiny of European Commission (EC) for being anti-competitive under the DMA. Apple faces a fine upto 10% of its global revenue, or around EUR 35.7 billion, by March 2025 if the claims are found true. This is not a stand-alone instance. In November 2024, South Korea’s Personal Information Protection Commission imposed a fine of 21.6 billion won on Meta for illegal tracking, collection and sale of users’ data without their consent. Similarly, in 2019, Germany’s Federal Cartel Office, the Bundeskartellamt (FCO), ruled that Meta abused its dominant position in the market by merging user data from Facebook, Instagram, WhatsApp, and third-party sources without informed user consent.Similar penalties have been levied on the tech-giant across a timeline spanning months. So the question remains – Why do Big-Tech companies ignore these penalties?

Despite global regulatory interventions, Big-Tech continues to harvest user data with minimal accountability. The penalties imposed by the relevant regulatory authorities pale against Big-Tech’s daily revenue. In May 2023, European Data Protection Board (EDPB), imposed €1.2 Billion fine on Meta for illegal cross-border data transfers. It is debatable if the severity of such a punishment affects Big Tech’s exploitative practices. They either pay the fines or file instantaneous appeals while continuing to their exploitative activities by taking advantage of regulatory lacunae.

On the opposite spectrum, there is the recent decision of a Russian court having levied $20 decillion fine on Google for blocking state-affiliated media channels. This reflects how frustrated the governments have become in trying to restrict and regulate the Big-Tech which dominates the global markets unbridled.

A Call for Digital Reform

India’s digital ecosystem with over 954 million internet users continues to have a pervasive impact on privacy, competition, and consumer rights. Cases like Meta’s highlight why the DPDPA and DCB are not just regulatory needs but moral imperatives.

While dawning digital laws, governments must ensure consent is meaningful. Users must understand what they are consenting to when they “allow” companies to collect, process, or share their personal data, with clear opt-in and opt-out mechanisms. There should be alternatives that are balanced and operational. Regulators should support smaller, privacy-focused firms to reduce reliance on Big-Tech while bolstering competition. Penalties should be deterrent in nature, perhaps in proportion to profits gained from every violation, which ensures that the cost of non-compliance outweighs the profits earned.

The regulatory framework remains fragmented in India. While the DPDPA promises significant reforms, it must be supplemented with clear rules that are long overdue now. These rules need to align easy consent withdrawal mechanisms; transparency in data collection, usage, storage and overall processing. Data is the backbone of digital platforms and laws like DCB need to address these monopolistic practices that force users into exploitative ecosystems.

A Test of Good Faith

Big Tech’s resistance to regulation raises serious questions: is it in good faith to defend murky consent practices? Can their argument of “user agreement” remain justified in complete ignorance of the fine print or deceptive tactics? We need a legislation that puts user rights ahead of business interests, guarantees that consent is meaningful, and protects privacy. This should not just be a paper mechanism or checkbox for compliance, rather be an enforceable user right. The CCI’s ruling against Meta is a step forward but systemic reforms will ensure its not a mere symbolic victory. A comprehensive law must be put in motion to prioritize user rights and create a level playing field in India’s ever-growing digital economy.

The author of this article is Anamika Shukla, Assistant Professor of Law at Gujarat National Law University and Ms. Aishna Jain, Advocate at Supreme Court and Delhi High Court.

Disclaimer: The views expressed are solely of the author and ETCIO does not necessarily subscribe to it. ETCIO shall not be responsible for any damage caused to any person/organization directly or indirectly.