A dispute between WhatsApp and the Information Regulator of South Africa has been settled out of court.
Speaking at a media briefing on Thursday, the chair of the Information Regulator, Pansy Tlakula, said the matter – which stemmed from the Meta Platforms-owned WhatsApp’s amended privacy policy in 2021 being in violation of the Protection of Personal Information Act (Popia) – was resolved after WhatsApp agreed to be more transparent with South African users.
“While WhatsApp had initiated legal action to review the decision of the Information Regulator and have it set aside, we are happy to announce that WhatsApp and the regulator have resolved the matter through a settlement agreement,” Tlakula told journalists on Thursday.
“In terms of this settlement agreement, which will be made an order of court, WhatsApp has agreed to introduce a number of enhancements to the transparency information that it makes available to South African users.”
The Information Regulator threatened legal action in May 2021 after WhatsApp released an updated privacy policy that the former believed was in contravention of Popia. One of the main concerns was based on the regulator’s observation that WhatsApp effectively has two different privacy policies: one for Europe and one for territories outside of Europe.
It argued that since the legislative landscape in Europe and South Africa is similar, WhatsApp should apply the same privacy policy it employs in Europe in the South African context. WhatsApp disagreed.
Three-year probe
One of the key issues the regulator had regarding the privacy policy WhatsApp applies outside of Europe is that it compels users to accept having their personal information shared with WhatsApp parent company Meta and users who do not agree must forego the use of the app entirely.
Following a three-year investigation, the regulator slapped WhatsApp with an enforcement notice in September 2024, asking the company to make amendments to its privacy policy to better align with Popia.
The regulator argued that:
- WhatsApp failed to demonstrate that its processing of personal information was lawful and fair;
- WhatsApp did not adequately justify the necessity or relevance of the personal information it collects;
- Making the acceptance of the terms a condition of service amounted to coercion, making the consent invalid under Popia;
- WhatsApp failed to clearly and specifically define the purposes for collecting and sharing personal information, especially with other Meta companies; and
- WhatsApp failed to demonstrate to the regulator that it had documented enterprise information security policies and appropriate technical and organisational measures in place.
Read: South Africa threatens litigation over new WhatsApp privacy policy
Failure to comply with the enforcement notice could result in penalties including a fine of up to R10-million or 10 years in prison. WhatsApp has the right to challenge the notice in court, but the company chose not to pursue this route.
Remarks by Deborah Lamola, senior manager for compliance and monitoring for Popia at the Information Regulator, suggests WhatsApp’s acknowledgement of some missteps encouraged a non-litigious outcome.
“The contents of the settlement agreement are yet to be taken to the courts, so we cannot speak to the details. What is important is that there was non-compliance regarding conditions for data processing, which WhatsApp did concede to, and there were corrective measures that were put in place,” said Lamola.
A spokesman for WhatsApp said: “WhatsApp protects the privacy of people’s personal conversations wherever they are in the world, including in South Africa. We are pleased to have reached a settlement with the South African Information Regulator on this matter.” – © 2025 NewsCentral Media
Get breaking news from TechCentral on WhatsApp. Sign up here.