WhatsApp's India business at risk from new law – experts

WhatsApp Inc. faces a difficult decision in India where the government introduced a law that clashes with the company's user privacy efforts, experts told S&P Global Market Intelligence.

India's Information Technology Rules 2021, which came into force Feb. 25, require stricter content moderation from companies with over 5 million users in India — encompassing Facebook Inc. and its subsidiaries WhatsApp and Instagram LLC, as well as YouTube LLC and Twitter Inc.

In a lawsuit filed May 26 against the Indian government, WhatsApp said the requirement that social media companies trace the user who first posted illegal content violates the company's privacy policy and should be declared unconstitutional. In a petition to the High Court of Delhi, the Facebook unit said, "enabling the identification of the first originator of information is antithetical to and destroys end-to-end encryption."

The company asked the court to confirm it will not be breaking the law if it does not comply with the requirement; the government said it is WhatsApp's responsibility to find a "technical solution" in order to ensure "public order and maintain national security."

Non-compliance could result in a number of outcomes, experts told S&P Global Market Intelligence. These range from taking on potentially costly liability for third-party content to the messaging platform exiting India, which would impact Facebook's growth in the country, experts said. Compliance, meanwhile, could see data-privacy-minded users leave the platform.

Facebook and WhatsApp did not respond to requests for comment.

Liable for content

"If WhatsApp fails to comply with the new IT rules, one of the primary ramifications is a withdrawal of safe harbor protection under section 79 of the IT Act," Salman Waris, managing partner at India-based technology law firm, TechLegis Advocates and Solicitors, told S&P Global Market Intelligence.

This means WhatsApp will no longer be considered an intermediary or platform host but instead a publisher, making it liable for illegal content posted by users.

"As a publisher, platforms will have to proactively censor all content before [it appears] online, and this may lead to operational costs as well as potential litigation costs," Waris said.

WhatsApp's lawsuit against the government will likely come down to the "technicalities of providing the originator source [identifying the user responsible for illegal content] without compromising its end-to-end encryption technology," said Jayanth Kolla, principal technology analyst at Convergence Catalyst.

This would require investments in engineering but is a potential workaround to compromising on encryption, Kolla said.

Impact on Facebook

If a resolution cannot be found, and WhatsApp exits India, this will impact Facebook's ads business in the country, experts said.

It will lose access to data from WhatsApp business accounts that Facebook uses to generate targeted advertisements, Kolla said.

WhatsApp business accounts give users the option to be hosted on and managed from the Facebook platform. WhatsApp's website says that unlike with personal messaging, with business accounts, "whether you communicate with a business by phone, email, or WhatsApp, it can see what you are saying and may use that information for its own marketing purposes, which may include advertising on Facebook."

As of July 2020, WhatsApp had 50 million business accounts globally. About 15 million of these are in India, according to local reports.

"Facebook's data monetization business could be significantly impacted if WhatsApp is forced to shut operations due to noncompliance," Waris said.

It is not yet clear whether WhatsApp will be impacted following its disagreement with the Indian government. WhatsApp has been banned in China, North Korea, Syria, the United Arab Emirates and Iran due to encryption policies.

A ban of this nature will be an "extreme step" and "would not be in the collective interest of all the stakeholders involved," Meraj Noor, DLA Piper India Group's deputy chair international, said.

More time, fewer users

Compliance with the law comes with its own complications, experts said.

Creating a system that can trace every message to its original source in India is complicated — especially if the source has a non-Indian WhatsApp account. "Looking at the number of customers and volume of messages being generated on a daily basis ... WhatsApp is likely to require more time as an error may lead to being labeled a culprit for failure to provide correct details," Ankur Raheja, an India-based cyber lawyer and founder of cyberlaw consultancy firm Cylaw Solutions, said.

The messaging service, which has over 500 million users in India, could also see its numbers drop due to privacy concerns. "[If WhatsApp loses the battle and] end-to-end encryption is removed, there will be serious concerns in terms of privacy and hacking," ASA Capital founder Pranav Bhavsar said.

Companies that use WhatsApp may choose other forms of communication as undermining encryption will threaten their cybersecurity and the privacy of users, Bhavsar added.

Almost 1.16 million cyberattack cases were reported in India in 2020, three times as high as 2019 cases and 20 times as high as 2016 cases, according to government data presented in Parliament in March 2021.