The Government of India has issued a significant new directive that will change how users access major messaging apps including WhatsApp, Telegram, Signal, Arattai, Snapchat, Sharechat, Jiochat and Josh. The Centre has ordered that these app-based communication services must remain continuously linked to the user’s active SIM card. This means messaging apps will only function if the same, active SIM associated with the registered mobile number is present in the device. The Department of Telecommunications (DoT) issued the notification on November 28 and these directions have come into force with immediate effect.
Why Has The Directive Been Issued?
According to the central government, the order addresses security risks posed by users running messaging apps on devices without the SIM card that is tied to the account. Issuing the order, the DoT stated that some app-based communication services allow users to consume services without the underlying SIM being present in the device where the app is running. The department noted: “…and this feature is posing a challenge to telecom cyber security as it is being misused from outside the country to commit cyber-frauds.”
The DoT said these new instructions are necessary to prevent the misuse of telecommunication identifiers and to safeguard the integrity of the telecom ecosystem. The department asserted that the directions are essential to protect telecom infrastructure and reduce cyber-fraud risks targeting Indian mobile numbers.
What Are The Compliance Requirements?
Continuous SIM linkage: Within 90 days of the instructions’ issuance, all Telecommunication Identifier User Entities (TIUEs) providing app-based communication services must ensure that the service is continuously linked to the active SIM card installed in the user’s device. This will make it impossible to use the app without that specific, active SIM.
Web-based access restrictions: Within the same 90-day period, web-based versions of mobile apps must automatically log users out at least once every six hours. Users will then have to sign in again by re-linking the device using a QR code.
The DoT has asked all providers offering app-based communication services in the country to submit compliance reports within 120 days from the date of issue. The directions remain in force until the department withdraws or amends them. Failure to meet the new norms will attract action under the Telecommunications Act, 2023, the Telecom Cyber Security Rules, and other applicable laws.
