Digitalisation of markets has resulted in consumer data being continuously extracted from individuals’ online activities. Cross-market data use generates privacy harms and may also reinforce data-driven market power through targeted advertising, and reduction of consumer surplus by employing personalised pricing.

Regulatory authorities have focused on strengthening users’ rights over personal data. India’s Digital Personal Data Protection Act, 2023 does so through informed consent and rights to access, correct, and erase data. However, the consumer control approach has shortcomings: The equilibrium level of data collection can still be socially excessive, and users may not be able to exercise privacy choices effectively. To be clear, excessive data extraction is a structural phenomenon driven by network effects and the bottleneck position of digital platforms that may create competition and societal harms. Against this backdrop, India’s competition regulator, the Competition Commission of India (CCI), took cognisance of the competition harm in WhatsApp’s 2021 policy update. [Read more…]