Photo by Amanz on Unsplash
In late November 2025, India's Department of Telecommunications announced sweeping changes that will fundamentally alter how millions use their favourite messaging applications. The new Telecommunication Cybersecurity Amendment Rules mandate that popular platforms, including WhatsApp, Telegram, Signal, and Snapchat must maintain continuous verification that users have an active SIM card in their devices. This regulatory intervention represents an unprecedented shift in how India governs digital communication, raising important questions about the trade-off between cybersecurity and user convenience.
Understanding the New Framework
The newly introduced regulations classify messaging applications as Telecommunication Identifier User Entities, or TIUEs, bringing them under the same regulatory umbrella as traditional telecom services for the first time. The core requirement is straightforward yet consequential that these apps must continuously verify that the SIM card associated with a user's registered mobile number remains physically present and active in their device.
What does this mean practically? If you remove your SIM card, switch it to another device, or if it becomes deactivated, your messaging app will cease to function until the original SIM is reinserted. The regulation extends to desktop and web-based versions as well. WhatsApp Web users, for instance, will face mandatory logouts every six hours, requiring them to re-authenticate by scanning a QR code with their phone, which must have the active SIM inside.
The Department of Telecommunications has given these platforms 90 days to implement these changes. Failure to comply could result in penalties under the Telecommunications Act of 2023, making this a binding obligation rather than a voluntary security enhancement.
The Security Rationale
The government's reasoning centres on closing what officials describe as a critical vulnerability in current messaging app security. Today's authentication model operates on a "bind-once" principle when you first set up WhatsApp or similar apps, the service verifies your phone number once, and that's essentially it. After this initial verification, you can continue using the app regardless of whether the SIM card remains in your device.
This approach, while convenient, creates opportunities for exploitation. Cybercriminals have leveraged this gap to conduct fraud, impersonation, and spam operations by gaining remote access to accounts without needing the physical SIM card. The Cellular Operators Association of India has backed the government's position, arguing that persistent SIM verification would create a direct, verifiable link between communication accounts and physical devices.
From a law enforcement perspective, the appeal is clear. Continuous SIM verification promises enhanced traceability of online activity, making it easier to track down perpetrators of cybercrimes and potentially deterring fraudulent activities before they occur. In a country where digital payment fraud and online scams have become increasingly sophisticated, the government views this as a necessary safeguard for protecting millions of users.
The Convenience Question
However, security measures rarely come without costs and in this case, the price is paid in user convenience and flexibility. Messaging apps have thrived precisely because they offer seamless and multi-device experiences. Professionals routinely switch between their phones and computers throughout the workday. Students message friends from tablets and laptops. The ability to access WhatsApp from any device with an internet connection has become a fundamental expectation.
The new rules disrupt this ecosystem. The six-hour logout requirement for web and desktop versions means users will need to authenticate multiple times daily, interrupting workflow and adding friction to what has been a frictionless experience. For those who travel internationally and swap SIM cards, or for individuals who use dual-SIM phones and regularly switch between numbers, the complications multiply.
There's also a practical concern about enforcement effectiveness. Privacy advocates and some technology experts question whether forcing frequent re-authentication will actually prevent sophisticated cybercriminals who may find alternative methods to circumvent these controls. Meanwhile, ordinary users and the vast majority who aren't engaged in fraudulent activity will bear the burden of these restrictions daily.
Privacy Implications and Data Concerns
Beyond inconvenience lies a deeper question about privacy. Continuous SIM verification necessarily involves constant monitoring and data collection about device status, SIM presence, and potentially user location. While the government emphasises that these measures enhance security, critics worry about the creation of new databases containing sensitive information about users' devices and communication patterns.
The concern isn't merely theoretical. In an era where data breaches have become common and trust in institutional data handling remains sensitive, any system requiring continuous verification creates new points of vulnerability. What happens to the verification data collected during these constant checks? Who has access to it? How long is it retained? These questions remain largely unanswered in the current regulatory framework.
Finding the Right Balance
The challenge facing Indian policymakers is one that societies worldwide grapple with how to make digital spaces secure without making them restrictive. Cybersecurity is undeniably important. The rise in online fraud has real victims and genuine costs to individuals and the economy. Measures to combat these threats deserve serious consideration.
Yet security that comes at the expense of usability risks creating systems that frustrate legitimate users while potentially failing to stop determined bad actors. The test of good regulation lies not just in its intentions but in its proportionality and effectiveness.
The Path Forward
As India embarks on this regulatory experiment, several considerations merit attention. First, the government should commit to transparency about how verification data is collected, stored, and protected. Second, there should be mechanisms for evaluating the policy's actual effectiveness in reducing fraud versus its impact on legitimate users. Third, provisions for exceptions, perhaps for verified business users or specific use cases, could help mitigate unnecessary disruption.
The messaging app companies themselves face a significant challenge in implementing these requirements within 90 days while maintaining service quality. Their response will likely involve technical innovation to make the verification process as seamless as possible, but ultimately, they're constrained by the regulatory framework they must operate within.
. . .
References: