WhatsApp Ireland Limited

DPC (Ireland) case IN-18-5-6, decided 2023-01-12. EUR 5,500,000.

What the regulator decided

WhatsApp could not lawfully rely on Article 6(1)(b) GDPR (necessity for performance of a contract) as the legal basis for processing personal data for service-improvement and security purposes; the forced-acceptance presentation of the May 2018 Terms of Service did not provide a freely-given consent under Article 6(1)(a) either, breaching the lawfulness and transparency principles of Article 5 GDPR.

Primary source

Regulator-owned URL. Quote this in legal briefs and academic citations.

https://www.dataprotection.ie/sites/default/files/uploads/2023-04/WhatsApp%20FINAL%20DECISION%20%28adoption%20version%29%20Redacted.pdf

Archived snapshot

Wayback Machine snapshot of the primary source. Use this when the regulator URL might be refactored or expire.

https://web.archive.org/web/20240529211629/https://www.dataprotection.ie/sites/default/files/uploads/2023-04/WhatsApp%20FINAL%20DECISION%20(adoption%20version)%20Redacted.pdf

ConsentMark interpretation

Operator-readable note on how this case shapes the ConsentMark scanner narrative. Not a legal opinion; cites the primary source.

The DPC initially accepted WhatsApp's contractual-necessity argument for service improvements; the EDPB Article 65 binding decision required the position to be reversed. Cite when a service uses a forced-acceptance Terms of Service to bundle marketing-or-analytics processing into "necessary for the service".

Verification trail

Verified by: donal
Verified at: 2026-05-27
Review due: 2026-11-27

Cite this case

Pick the format that matches where you are pasting. The methodology version is preserved in every variant so the citation stays verifiable after future methodology changes.

BibTeX

@misc{consentmark-precedent-dpc-in-18-5-6,
  author       = {{ConsentMark}},
  year         = {2023},
  title        = {DPC (Ireland) IN-18-5-6 - WhatsApp Ireland Limited},
  howpublished = {\url{https://www.consentmark.com/precedent/dpc-in-18-5-6}},
  note         = {ConsentMark methodology v1.3}
}

APA

ConsentMark. (2023, January 12). DPC (Ireland) IN-18-5-6 - WhatsApp Ireland Limited. Methodology v1.3. https://www.consentmark.com/precedent/dpc-in-18-5-6

Markdown

[DPC (Ireland) IN-18-5-6 - WhatsApp Ireland Limited - ConsentMark](https://www.consentmark.com/precedent/dpc-in-18-5-6)

Plain text

DPC (Ireland) IN-18-5-6 - WhatsApp Ireland Limited - ConsentMark, 2023-01-12, methodology v1.3, https://www.consentmark.com/precedent/dpc-in-18-5-6