DoT’s WhatsApp SIM-binding mandate faces pushback from Broadband India Forum

The Broadband India Forum (BIF) spoke out against the Department of Telecommunications (DoT)’s mandate last week for WhatsApp and similar apps to perform “SIM binding” and log out web-based instances every six hours. BIF is an industry group which has WhatsApp and its parent firm Meta as members. Neither company has issued any statement on the mandate.

BIF’s statement said the DoT’s order, aimed at curbing fraudulent use of Indian numbers by people abroad who don’t physically possess the Indian SIM with which their WhatsApp account is registered, was “well-intentioned,” but that it raised “significant questions of jurisdiction, proportionality, and consumer impact.”

The directions “risk creating obligations that extend far beyond the mandate of the Telecom Act or the purpose of the Telecom Cyber Security Rules,” the statement said, referring to the Telecommunications Act, 2023, and the Telecom Cyber Security Rules, 2024, which were amended in November, preceding the WhatsApp SIM binding order.

“The Telecommunications Act does not authorise the regulation of OTT communication platforms, nor does it provide the legislative basis to impose telecom-style operational mandates upon them,” BIF said. The Ministry of Communications had informally assured stakeholders in 2023 that the definition of “telecommunication,” though apparently broad, would not be wielded against applications, which typically reside on the application layer.

The 2024 rules’ amendment last month, though, introduced the concept of a Telecommunication Identifier User Entity (TIUE), a broad category that includes any firm using phone numbers to identify their customers. 

The order would hit non-resident Indians badly, BIF said: “Ordinary use cases such as travellers and NRIs who rely on Wi-Fi to use their Indian numbers abroad, professionals who depend on uninterrupted web-client access during an 8-10 hour workday, families and multi-SIM users who routinely separate their primary SIM from their messaging number, and elderly or low-literacy users who struggle with repeated re-authentication—stand to be disproportionately affected,” BIF said.

“The result is a consumer cost imposed in the absence of consultation, impact assessment, or proportionality, and one that risks degrading user experience for compliant, law-abiding citizens … Against this backdrop, it becomes imperative that DoT pause the current implementation timelines, open a formal stakeholder consultation, constitute a technical working group of OS providers, TIUEs, licensees, and security experts, and ultimately adopt a risk-based and proportionate framework consistent with constitutional standards of necessity and least intrusive means.”