Major settlement reached between South Africa' s information regulators with Meta over WhatsApp privacy policy

By Dumisani Ndlovu

Johannesburg— The Information Regulator of South Africa has achieved a significant settlement with Meta Platforms Inc. regarding the contentious update to WhatsApp's privacy policy, effectively ending a legal dispute that tested the country's data protection laws under the Protection of Personal Information Act (POPIA).
During a media briefing, Information Regulator Chairperson Pansy Tlakula announced that this agreement resolves issues stemming from a 2021 policy revision, which required users to accept extensive changes or forfeit access to the application. WhatsApp faced an enforcement notice for allegedly breaching several provisions of POPIA.
The regulator determined that the policy infringed upon multiple sections of POPIA by mandating user consent for data processing without a legitimate basis and allowing the sharing of personal data with other Meta subsidiaries and third parties beyond the initial intention of data collection. “Such consent is invalid under South African law,” Tlakula noted, emphasizing that any processing based on this consent would be unlawful. WhatsApp was initially given 60 days to comply or risk penalties of up to R10 million, imprisonment of up to 10 years, or both.
Meta had previously contested the enforcement notice in court, but this action has now been rescinded following the confidential settlement, the details of which remain undisclosed, prompting concerns from civil society about transparency and accountability.
This case is reminiscent of a recent dispute in Nigeria, where the Nigerian Data Protection Commission levied a $32.8 million fine against Meta for unauthorized data transfers, which also concluded with a secret settlement despite Meta's threats to withdraw from the Nigerian market.
Such events indicate a rising assertiveness among regulators in the Global South as nations like South Africa, Nigeria, and Kenya respond to opaque data practices by global technology firms. However, experts warn that confidential settlements might enable companies to sidestep necessary reforms.
A representative from the Media Institute of Southern Africa (MISA) stated, “Settlements must not become a shield for non-compliance,” following the adoption of Resolution 630 by the African Commission on Human and Peoples’ Rights, which calls for the establishment of continent-wide guidelines to supervise tech companies and uphold information integrity.
A collaborative effort is now in progress among African countries to create these guidelines, striving for a unified approach to digital sovereignty and platform accountability. As Africa navigates the challenges of the digital era, experts argue that only coordinated, transparent, and enforceable standards can ensure the protection of African users' rights and dignity against increasing corporate influence.