Karmanya Singh Sareen v. Union of India: the WhatsApp privacy policy litigation

The facts in brief

On 25 August 2016, WhatsApp announced a revised privacy policy. The revision dismantled the firewall that the platform had assured Indian users existed when WhatsApp was acquired by Facebook in 2014 — the commitment that user metadata, contact-list information and usage analytics would not flow to the parent company. The new policy created an integrated data-sharing pathway across the Facebook group, with a 30-day opt-out window for the limited subset of users who happened to read the consent screen carefully enough to identify the toggle.

Two law students — Karmanya Singh Sareen and Shreya Sethi — filed W.P.(C) 7663/2016 in the Delhi High Court the next day. Their prayers were broad: restrain WhatsApp from sharing data with Facebook, direct the Union to enact comprehensive data-protection legislation, and read substantive privacy obligations into Articles 19 and 21 of the Constitution. WhatsApp's defence rested on two pillars: the consent was contractual and freely given; and a foreign private platform is not a "State" amenable to Part III obligations.

The division bench of Chief Justice G. Rohini and Justice Sangita Dhingra Sehgal disposed of the writ on 23 September 2016. The bench refused to recognise a substantive privacy claim — privacy was not yet judicially established as an Article 21 right, that question was already pending before a nine-judge bench in K.S. Puttaswamy v. Union of India — but moulded an equitable remedy reflecting the asymmetric power of the click-wrap relationship.

Petitioners filed SLP (C) No. 804 of 2017. On 5 April 2017, a three-judge bench of J.S. Khehar, C.J., N.V. Ramana, J., and Dr D.Y. Chandrachud, J., admitted the SLP and administratively listed it before a five-judge Constitution Bench, recording that the privacy questions were of constitutional importance. On 6 September 2017 — a fortnight after the nine-judge bench in Puttaswamy declared privacy a fundamental right — the matter began to be heard by a Constitution Bench composed of Dipak Misra, C.J., A.K. Sikri, J., Amitava Roy, J., A.M. Khanwilkar, J., and Mohan M. Shantanagoudar, J. It remains seised of the matter.

A parallel strand opened in March 2021 when WhatsApp pushed a fresh policy update. The Competition Commission of India ordered a s.26(1) investigation; Delhi High Court (Navin Chawla, J., 22 April 2021) refused to interfere; the division bench of Satish Chandra Sharma, C.J., and Subramonium Prasad, J., on 25 August 2022 dismissed WhatsApp and Meta's appeals against the CCI probe; and the Supreme Court dismissed Meta's SLP on 14 October 2024.

The constitutional question

Three questions sat in front of the Delhi High Court. First, whether Article 21 reaches a private platform's data-handling practices in the absence of state action — the horizontal-application question. Second, whether a click-wrap consent transaction is a permissible substitute for constitutional consent, or whether the imbalance of bargaining power between an individual user and a dominant messaging platform vitiates the consent. Third, whether the absence of comprehensive personal-data-protection legislation requires the writ court to step into the legislative void with declaratory or mandamus relief.

Before the Supreme Court, the question shifted shape after Puttaswamy. The Constitution Bench is now considering whether the platform-side data-sharing architecture survives a proportionality analysis under the four-fold Puttaswamy test — legality, legitimate aim, suitability and necessity, and balancing — and what the doctrinal home of data-protection-style obligations looks like when applied to a dominant foreign intermediary.

What the Court held

The Delhi High Court order

The bench refused the broad constitutional prayer. Privacy was not yet recognised as a fundamental right under Article 21 — that question was reserved before the nine-judge bench in Puttaswamy. A foreign private platform was not "State" within Article 12 and so not amenable to direct horizontal application of Article 19 or 21. Click-wrap consent, the bench held, is in substance a contractual matter primarily governed by the Indian Contract Act, 1872 — not a constitutional transaction.

But the bench moulded narrow equitable relief reflecting the transition cost of the policy change. WhatsApp was directed to delete the data of all users who chose to delete their accounts before 25 September 2016. For users who chose to continue with the new policy, the data already accumulated up to 25 September 2016 was ring-fenced from being shared with Facebook. The court also directed the Union and TRAI to consider whether statutory regulation of OTT messaging services was warranted — a seed that germinated into the Justice B.N. Srikrishna Committee process and ultimately the Digital Personal Data Protection Act, 2023.

The Supreme Court reference and the five-judge bench

The 5 April 2017 admission order recorded that the privacy issues warranted Constitution Bench scrutiny and administratively listed the matter before a five-judge bench. The 6 September 2017 sitting heard preliminary objections on bench formation — WhatsApp argued that administrative listing was not a formal Article 145(3) reference and that the bench was not properly constituted. The Constitution Bench has not ruled on the preliminary objection in a reasoned final order.

The bench's most consequential interim direction — recorded during the 2021 policy-update offshoot — was that WhatsApp must publicly notify users that they are not compelled to accept the 2021 policy, and that service-degradation for non-acceptance is not permitted until a statutory data-protection framework operationalises.

The CCI strand

The Delhi High Court division bench on 25 August 2022 held that CCI investigation under s.4 of the Competition Act, 2002 was not pre-empted by the IT Act framework. Forced acceptance of integrated data-sharing across Meta group companies was a potential abuse of dominance — a "take-it-or-leave-it" tying arrangement. Facebook was a "proper party" under the group-economic-entity doctrine. The Supreme Court refused to interfere on 14 October 2024. CCI's Director General report in November 2024 found a prima facie contravention; a penalty of ₹213 crore and a five-year data-sharing prohibition were imposed. Meta's appeal is pending before the NCLAT.

The doctrinal architecture

The case sits at the intersection of three doctrinal strands that the Indian courts have not yet fully reconciled.

First, horizontal application of fundamental rights. The Delhi High Court refused horizontal application in 2016 because privacy was not yet a fundamental right and because WhatsApp was not "State". After Puttaswamy, the second branch of that reasoning remains live — Article 12 has not been read expansively to include dominant private platforms — but the doctrinal pressure has shifted. A dominant intermediary handling intimate communications of hundreds of millions of users sits uncomfortably in the same Article 12 category as a small private contractor.

Second, contractual consent versus constitutional consent. Click-wrap consent is asymmetric by design: the user lacks meaningful exit, the platform drafts the terms, and the disclosure architecture is engineered to nudge acceptance. Puttaswamy's proportionality test — particularly the legitimate-aim and necessity prongs — sits awkwardly with the proposition that a user-clicked acceptance is the end of the constitutional inquiry.

Third, the statutory void. From 2016 until 2023, there was no comprehensive personal-data-protection statute. The writ courts therefore faced an uncomfortable choice: either read constitutional obligations directly into the platform relationship, or defer to a yet-to-be-enacted statute. The Delhi High Court chose deference with a narrow equitable remedy. The DPDP Act, 2023 — notified on 11 August 2023 with Rules notified in November 2025 — now occupies the statutory space. The doctrinal question is whether the DPDP framework moots the constitutional challenge or merely supplies the procedural substrate on which constitutional review continues.

The competition-law strand introduces a fourth dimension. The Delhi High Court division bench in 2022 read the data-sharing architecture as a tying arrangement actionable under Section 4 of the Competition Act, importing market-power analysis into what had been framed as a privacy dispute. The CCI's November 2024 penalty crystallises that reading.

What was not decided

The 2016 order did not decide whether horizontal application of Article 21 reaches dominant digital platforms — that question is still open before the Constitution Bench. It did not decide whether click-wrap consent satisfies the Puttaswamy proportionality requirements — Puttaswamy had not yet been decided. It did not adjudicate cross-border data-flow regulation, which was deferred to the legislative process.

The Constitution Bench has not pronounced on whether DPDP Act, 2023 moots the constitutional challenge, whether the CCI proceedings can run in parallel with the constitutional proceedings (the Delhi High Court division bench said yes; the Supreme Court has not articulated a coordination doctrine), or whether the DPDP framework applies retrospectively to the 2016 and 2021 policy changes.

The Karnataka High Court's X Corp v. Union of India litigation on Section 69A blocking, the Bombay High Court's Kunal Kamra v. Union of India decision on the IT Rules 2023 Fact Check Unit, and the pending Delhi High Court consolidated challenge to the IT Rules, 2021 all orbit adjacent questions but none has yet supplied the doctrinal architecture for platform-side data-handling that Karmanya Singh Sareen was filed to obtain.

After the judgment

The case became the headwaters of Indian data-protection jurisprudence. The Justice B.N. Srikrishna Committee on Data Protection, constituted in July 2017, expressly drew on the Karmanya Singh Sareen record in framing its terms of reference. The committee's July 2018 report produced the draft Personal Data Protection Bill, 2018 — which became the PDP Bill, 2019, was withdrawn in August 2022, and ultimately re-emerged as the Digital Personal Data Protection Act, 2023.

The 2021 WhatsApp policy update triggered a fresh wave of litigation: W.P.(C) 4378/2021 filed by Chaitanya Rohilla and W.P.(C) 4634/2021 filed by Seema Singh, both in the Delhi High Court, together with the CCI investigation. The CCI proceedings have produced the strongest operative outcome of the entire decade-long litigation cycle — the ₹213.14 crore penalty and the five-year data-sharing prohibition imposed in November 2024.

On 23 January 2025, the NCLAT delivered an interim order on Meta's appeal that set aside the five-year prohibition on WhatsApp sharing user data with other Meta entities for advertising purposes, while upholding the ₹213.14 crore penalty. The NCLAT directed Meta to deposit 50% of the penalty as a condition of the partial stay. The order leaves the substantive CCI penalty intact while restoring the data-sharing pathway pending final disposal of the appeal.

The DPDP Act's notice and consent regime under Sections 5–7, the Data Protection Board's adjudicative architecture, and the cross-border data-flow framework all sit on doctrinal foundations that Karmanya Singh Sareen originally sought to lay through constitutional review. Until the Constitution Bench delivers its final judgment, the 2016 Delhi High Court order's narrow operative directions — data of departing users deleted, data of staying users ring-fenced — remain the only Indian judicial precedent on platform-side privacy-policy transitions.

Related on Valkya

• Shreya Singhal v. Union of India: striking down Section 66A
• Anuradha Bhasin v. Union of India: internet as an Article 19 right
• Agij Promotion v. Union of India: the IT Rules 2021 Part III stays
• DPDP Rules 2025: practitioner read

Sources

1. Supreme Court Observer — Karmanya Singh Sareen v. Union of India case background: https://www.scobserver.in/cases/karmanya-singh-sareen-whatsapp-privacy-policy-case-background/
2. SCC OnLine Blog — Delhi HC dismisses WhatsApp/Facebook appeals against CCI probe (25 August 2022): https://www.scconline.com/blog/post/2022/08/26/delhi-hc-cci-whatsapp-facebook/
3. LiveLaw — Supreme Court dismisses Meta/WhatsApp SLP against CCI probe (14 October 2024): https://www.livelaw.in/top-stories/supreme-court-meta-whatsapp-cci-investigation-271234
4. BarandBench — Delhi HC DB upholds CCI investigation into WhatsApp 2021 policy: https://www.barandbench.com/news/litigation/delhi-high-court-cci-whatsapp-2021-privacy-policy-investigation
5. Internet Freedom Foundation — Karmanya Singh Sareen case tracker: https://internetfreedom.in/karmanya-singh-sareen-whatsapp-privacy-case-tracker/
6. Delhi High Court — official judgment text W.P.(C) 7663/2016: https://delhihighcourt.nic.in/judgment/karmanya-singh-sareen-2016