Kampala, March 2025 — Ugandan law firm AdLegal has filed a formal complaint with Uganda’s Personal Data Protection Office (PDPO) against WhatsApp LLC, alleging violations of the Data Protection and Privacy Act, 2019. The complaint challenges WhatsApp’s 2021 Privacy Policy, which requires users to accept expanded data-sharing arrangements with Meta’s group of companies as a condition for continued use of the platform. AdLegal argues that this policy unlawfully mandates the sharing of personal data without obtaining valid and informed consent from Ugandan users. According to the firm, the policy unfairly restricts users’ control over their personal information, particularly when compared to the rights afforded to European users under the European Union’s General Data Protection Regulation (GDPR). While EU users can withdraw consent for data processing without losing access to their WhatsApp accounts, Ugandan users are reportedly forced to accept the new terms or exit the platform entirely. AdLegal also raised concerns about what it describes as excessive data collection practices, arguing that WhatsApp gathers more user data than is necessary for the provision of its core messaging services. The firm claims this violates Uganda’s data minimization and purpose limitation principles enshrined in the Data Protection and Privacy Act. In its filing, AdLegal contends that the policy results in discriminatory treatment of Ugandan users, who receive fewer privacy protections than their European counterparts. The firm says this creates a two-tier system of data protection that undermines the rights of African users in the global digital economy. “The complaint seeks to ensure that Ugandans are not treated as second-class digital citizens,” AdLegal stated, calling on regulators to take decisive action against what it describes as unfair and unlawful data practices. AdLegal has asked the Personal Data Protection Office to open a full investigation into WhatsApp’s data processing practices, issue corrective orders where necessary, and require the company to align its operations with Uganda’s data protection laws. The case comes amid growing scrutiny of how multinational technology companies handle personal data in African markets, where regulators are increasingly asserting their authority over cross-border digital platforms. If upheld, the complaint could set a significant precedent for the enforcement of data protection standards in Uganda and across the region.