The Indian government has issued a sweeping directive that will force app-based messaging services to remain tied to an active SIM card on the device where the app runs, and to implement periodic web‑session logout and re‑authentication — a move that reshapes how WhatsApp, Telegram, Signal, Snapchat, ShareChat, JioChat and other platforms operate in India and places new compliance, technical and privacy responsibilities on both providers and users.
The Department of Telecommunications (DoT) published directions on November 28 that rely on the recently amended telecom cyber‑security framework and the Telecommunications Act, directing providers of App Based Communication Services — now classified as Telecommunication Identifier User Entities (TIUEs) — to make it impossible to use their services unless the SIM card associated with the registered mobile number is present and active in the device. The instructions come into force immediately, but the DoT has given platforms a finite window to implement the technical changes: a 90‑day deadline for enforcing continuous SIM‑to‑device binding and a 120‑day deadline to file compliance reports. Those changes are not limited to mobile apps. Desktop and web clients must be configured to log users out at least once every six hours, requiring QR‑code based re‑linking from the mobile device to resume a session. The DoT explicitly warns that failure to comply may attract action under the Telecommunications Act, the Telecom Cyber Security Rules and other applicable laws.
Source: ETV Bharat Messaging Apps Like WhatsApp To Work Only With Active SIM; DoT Tightens Cyber Norms
Background / Overview
The Department of Telecommunications (DoT) published directions on November 28 that rely on the recently amended telecom cyber‑security framework and the Telecommunications Act, directing providers of App Based Communication Services — now classified as Telecommunication Identifier User Entities (TIUEs) — to make it impossible to use their services unless the SIM card associated with the registered mobile number is present and active in the device. The instructions come into force immediately, but the DoT has given platforms a finite window to implement the technical changes: a 90‑day deadline for enforcing continuous SIM‑to‑device binding and a 120‑day deadline to file compliance reports. Those changes are not limited to mobile apps. Desktop and web clients must be configured to log users out at least once every six hours, requiring QR‑code based re‑linking from the mobile device to resume a session. The DoT explicitly warns that failure to comply may attract action under the Telecommunications Act, the Telecom Cyber Security Rules and other applicable laws. What the DoT directive requires — the essentials
Immediate, mandatory technical controls
- From 90 days after the directive’s issue, app‑based communication services must ensure continuous binding between the mobile number, the SIM card, and the device; the app must stop functioning if that specific SIM is removed or deactivated.
- Web/desktop instances must auto‑logout at least once every six hours; re‑authentication must be possible via QR code pairing from the mobile device.
- All affected providers must submit formal compliance reports to the DoT within 120 days.
Legal and regulatory basis
- The directions invoke the Telecommunications (Telecom Cyber Security) Rules (amendments notified in 2025) and the Telecommunications Act, 2023, which allow DoT to issue directions to entities that use telecommunication identifiers for service delivery. The DoT’s new TIUE classification is central to the mandate.
Who is affected
The DoT named a non‑exhaustive list of platforms that fall within the TIUE definition and have already been notified: WhatsApp, Telegram, Signal, Snapchat, ShareChat, JioChat, Josh, Arattai and broadly “other OTT messaging services” that use mobile numbers as identifiers. The rule’s scope is intentionally broad: any service that uses a mobile number to identify users or provision services in India is likely to be captured unless the provider can demonstrate a different, acceptable model. This is a regulatory shift that treats large OTT messaging services more like telecom providers for specific security obligations — particularly those tied to traceability of phone numbers and preventing SIM‑independent account continuity that authorities say has been exploited in fraud.Why the DoT says this is necessary
The government frames the directive as a targeted response to growing cyber‑fraud that exploits the decoupling between phone numbers and device‑resident SIMs. In many current models, an app can continue operating after initial verification even if the SIM that received the OTP is removed, replaced, or deactivated — a behaviour that, according to officials, creates traceability gaps exploited by cross‑border fraudsters. Binding the app’s session lifecycle to the active SIM is intended to restore a stronger link between a telephone identifier and the physical device in which it is used. Proponents argue the measure will:- Increase traceability of malicious actors using stolen credentials or spoofed accounts.
- Shrink the window for SIM‑swap, number‑spoofing and long‑running impersonation attacks.
- Align OTT services with security expectations that already apply to telecom operators and certain financial services.
Cross‑checking the facts — independent confirmation
Multiple independent outlets reported the DoT’s directions and the timelines noted above, including national press and technology policy analysts. Economic Times, India Today and Business Today all describe the 90‑day implementation deadline, the 6‑hour auto‑logout requirement for web clients, and the 120‑day compliance reporting obligation. Media‑focused reporting reproduced the DoT text and quoted the new TIUE definition and rule references. These independent reports corroborate the main operational and legal elements of the directive.Technical implications for messaging platforms
How apps currently work — why change is needed
Most messaging apps use a one‑time verification flow (SMS OTP or voice) to link a phone number to an account. After the initial bind, the client typically generates an authentication token that permits continued operation independently of the SIM’s presence. This model optimizes usability and multi‑device flexibility but creates a gap: once authenticated, the app does not consistently verify the presence of the SIM that owns the number. That gap is what the DoT aims to close.What providers must build or change
To comply, platforms will likely need to adopt one or more of the following technical measures:- Periodic SIM presence checks on mobile clients via device APIs to confirm the SIM associated with the registered number is present, active and matches the registered identifier.
- Shorter token lifetimes and server‑side session revalidation tied to successful SIM checks.
- Mandatory re‑linking flows for web/desktop that require the mobile device with the active SIM to perform QR‑based reauthentication not later than every six hours.
- Integration with a Mobile Number Validation (MNV) platform if mandated, which can validate whether a number is active and mapped to a device/telecom operator at a point in time; the DoT’s rules give it powers around the MNV ecosystem.
Multi‑device tradeoffs
Current multi‑device models (where a phone number can be used across devices, even when the primary phone is offline) will be impacted. Platforms will need to define how to keep multi‑device convenience while enforcing SIM presence, for example by:- Making companion devices short‑lived sessions requiring periodic revalidation.
- Introducing account linking that uses an authenticated cloud account (rather than pure number binding) so that the cloud account’s identity, not merely the number, governs device access.
User impact — the practical consequences
For consumers
- Devices without the registered SIM will be unable to use the app once the rule is enforced — this affects users who switch SIMs, roam internationally, or keep the number active on a different device.
- Web and desktop sessions will require frequent re‑linking (every six hours), disrupting always‑on desktop workflows and automation that rely on long‑running sessions.
- Travelers and dual‑SIM users will face friction when the “primary” SIM needs to remain present and active on a particular device to maintain connectivity.
For privacy and data portability
- The measure strengthens device‑level traceability, which helps law enforcement but also raises privacy concerns about persistent device‑level tracking and potential unintended access patterns.
- Users who rely on convenience (for example, keeping a messaging session active on a laptop in another country) will see increased friction and potential data disruption.
For enterprises and developers
- Customer‑service bots or automation flows that used unauthenticated or long‑lived business sessions via messaging APIs must re‑architect to comply, potentially migrating to authenticated APIs or narrow, permitted automations that DoT allows.
- Startups that relied on low‑friction phone‑number discovery will need to invest in onboarding flows that capture authenticated identities, increasing cost and complexity.
Benefits: what the directive seeks to fix
- Stronger anti‑fraud posture: Tying sessions to an active SIM reduces avenues for long‑running impersonation and SIM‑swap‑enabled fraud.
- Improved traceability: Authorities gain a clearer mapping from identifier to device when investigating cross‑border scams that used SIM‑independent app access.
- Aligned security baseline: TIUE classification brings certain app providers under cybersecurity rules that already apply to telecom and critical communications infrastructure.
Risks, costs and open questions
While the stated aims are straightforward, the directive introduces significant uncertainties and risks.User friction and service fragmentation
The constant revalidation principle — particularly the six‑hour web logout — will disrupt workflows for users who depend on persistent desktop access. That will especially hurt small businesses and power users who use desktop automation or integrations.Technical feasibility and interoperability
- Device‑level SIM checks rely on platform APIs; on some operating systems or form‑factors (for example, tablets or certain IoT devices) reliable SIM presence checks may not be possible, or the API surface may not expose sufficient detail for continuous validation.
- The MNV platform model (if the DoT mandates or relies on a central validation service) raises operational and privacy questions about how often providers must query a number’s status and how false positives/negatives will be handled.
Privacy and civil liberties concerns
Requiring continuous device binding increases the risk that identifiers are used to create persistent device‑level profiles. While this aids traceability, it also increases stakes for misuse, function creep and surveillance, particularly where judicial oversight is weak or transparency is limited.Competitive and business risks
Small vendors and startups that used low‑friction phone‑number onboarding may be disproportionately impacted — raising the cost of user acquisition and potentially reducing competition. The policy also favors large players that can invest in robust authenticated ecosystems. This echoes other industry moves where platforms or regulators force assistants and services into account‑backed surfaces, reducing open distribution channels.Enforcement ambiguity
The DoT’s direction is specific about timelines, but how the DoT will verify compliance, what constitutes an acceptable technical implementation, and how exceptions will be handled are unclear. This ambiguity creates a compliance risk: platforms must implement one or more technical models at scale without detailed regulatory guidance.How platform operators are likely to respond
- Short term: implement server‑side session expirations and force a QR‑based re‑link for web/desktop clients at six‑hour intervals; deploy mobile‑client updates that check SIM presence regularly.
- Medium term: shift to an authenticated account model (phone number + user account) where the phone remains an identity factor but the cloud account controls device authorizations and session sync.
- Long term: lobby for technical clarifications or carve‑outs, offer alternative compliance mechanisms (e.g., hardware‑backed attestations), and evaluate strategic changes to product distribution (PWA, native apps, region‑specific behaviours).
Best practices and recommended actions (for users, enterprises and developers)
For individual users
- Treat multi‑device access as more fragile — be ready to re‑link desktop sessions frequently and keep the device with the registered SIM accessible.
- If retaining long‑running chats is critical, back up chat history securely (but note exports may not retain end‑to‑end protections once exported).
- Be cautious about storing exported chat transcripts or verification tokens in unencrypted cloud locations.
For businesses and platform integrators
- Inventory all flows that rely on phone‑number only authentication and categorize them as transactional, incidental‑AI, or general‑purpose assistant usage.
- Re‑architect high‑value flows to rely on authenticated accounts and server‑side session management.
- Implement regular testing of SIM presence checks across device models and operating systems.
- Prepare compliance reports with clear technical descriptions, test matrices and fallback behaviour for non‑validated devices.
For developers of messaging apps
- Use short‑lived tokens and require revalidation where SIM presence cannot be guaranteed.
- Make device re‑linking UX clear and friction‑reduced where possible (helpful prompts, guided re‑linking).
- Log and monitor re‑linking failures and edge cases to support compliance reporting.
Broader context — regulatory tightening and platform control
The DoT’s move is part of a broader global pattern where regulators and platform owners are redefining the balance between openness and traceability in messaging and AI distribution. Recent platform policy shifts — such as restrictions on unauthenticated assistants inside messaging services — and national cybersecurity rules have already pushed large AI providers to favor authenticated, first‑party experiences instead of relying on lightweight in‑chat integrations. The Indian directive sits at the intersection of cybersecurity, consumer safety and platform governance and will likely accelerate industry migration toward account‑backed models.Unverifiable or unsettled elements (cautionary notes)
- The DoT text sets functional objectives and deadlines but does not prescribe a single technical implementation. Statements about precisely how platforms will implement continuous SIM binding (for example, a centralized MNV check cadence, cryptographic attestations or proprietary device APIs) remain implementation choices and vary by vendor.
- The scale and pace of enforcement — whether the DoT will perform spot audits, demand evidence of implementation or take punitive action quickly — are not explicitly spelled out. Any claim asserting an immediate shutdown of a service absent manual confirmation should be treated cautiously.
Final analysis — strengths and potential harms
Notable strengths
- The directive addresses a specific, real security problem: the misuse of account continuity to conduct cross‑border fraud.
- By bringing TIUEs under cyber‑security obligations, the DoT creates a legal mechanism to require technical controls that improve accountability.
- The six‑hour re‑link requirement for web clients directly addresses a well‑known vector abused by remote actors.
Potential risks and downsides
- The policy increases friction for legitimate users and businesses, particularly those that operate across devices or internationally.
- Small vendors and startups face higher compliance costs and higher barriers to distribution, which could reduce competition and innovation.
- Privacy advocates will rightly flag the increased device‑level traceability and the potential for misuse if safeguards and transparency are not implemented.
- Ambiguities around enforcement and technical requirements risk uneven implementation and potential service disruption.
What to watch next
- How major global players (Meta/WhatsApp, Telegram, Signal) publish their compliance plans and client updates, and whether they seek technical clarifications or carve‑outs. Independent press coverage indicates companies will need to update clients and session flows quickly.
- Whether the DoT publishes implementation guidance for MNV and acceptable technical patterns; such guidance would reduce compliance uncertainty and interoperability friction.
- Regulatory and civil‑society responses focusing on privacy, competition and proportionality of the measure.
- Real‑world impacts on users (desktop and travel scenarios) and small developers as the 90‑day clock runs down.
Conclusion
India’s DoT has issued a decisive and consequential instruction: messaging apps that use mobile numbers for identification must remain continually bound to the active SIM within the device, and web/desktop sessions must be re‑authenticated at modest intervals. The intent — to reduce fraud and restore traceability — addresses a genuine security pain point, but the operational realities create friction for users, complexity for developers, and potential privacy tradeoffs. The coming weeks will test the technical creativity of platform engineers, the clarity of DoT’s enforcement approach, and the balance India strikes between security and the open, cross‑device convenience that made modern messaging ubiquitous. Stakeholders — from individual users to startups and large platforms — should act now to inventory dependencies, prepare compliance and plan for the user‑experience tradeoffs this change makes unavoidable.Source: ETV Bharat Messaging Apps Like WhatsApp To Work Only With Active SIM; DoT Tightens Cyber Norms
