A recent tribunal ruling made it clear that user consent is mandatory for any data WhatsApp collects and then shares with Meta — not just the information used for advertising. The decision narrows the scope of lawful data sharing, stressing that consent must cover the full range of personal data moving between services.
What the ruling means
The tribunal emphasised that consent needs to be specific and informed. Companies cannot rely on broad or implied permissions to move user data to a parent company or affiliate. This affects how messaging apps and related platforms design their privacy notices and consent flows.
Practical implications for businesses
- Audit data flows: Firms must map what data is collected, how it is used, and whether it is shared with third parties or affiliates.
- Update consent mechanisms: Consent prompts should clearly state which categories of data will be shared and for what purposes.
- Revise privacy policies: Policies must be transparent and easy to understand so users can give informed consent.
- Review contracts: Data-sharing agreements with partners need to reflect the requirement for explicit user consent.
- Prepare for enforcement: Regulators may scrutinise practices more closely and expect demonstrable proof of valid consent.
What users can expect
Users are likely to see clearer choices when apps request permissions. That could mean separate opt-ins for different categories of sharing rather than a single “accept” button. The ruling strengthens users’ control over how their data travels between services.
Next steps
Companies affected by the ruling should act quickly to align their privacy practices with the tribunal’s guidance. For consumers, the decision reinforces the importance of reading consent prompts and using available privacy controls.
In short: The tribunal has tightened the rules around data sharing — consent must be explicit, informed, and cover all data passed from a messaging app to its owner or partners, not only data used for advertising.