A notice before a single fraud case
On July 1, 2026, India's Ministry of Electronics and Information Technology (MeitY) issued a notice to WhatsApp over a feature the platform had not yet even fully rolled out in the country. WhatsApp began global rollout of usernames on June 29, letting users message each other without exchanging phone numbers. MeitY's notice asked the company to explain, within days, why regulatory action shouldn't follow — and directed it not to launch the feature in India until consultations concluded "to the government's satisfaction." Similar notices went to Telegram and Signal, which have offered username-based messaging for years. All three platforms were told to respond by July 9; WhatsApp met the deadline, submitting a written justification the ministry is still reviewing (Tribune India; Business Today).
What makes this notice unusual isn't that India is regulating a messaging app — it has done that repeatedly since 2021. It's that the government moved against a feature, pre-emptively, before it could point to a single documented case of the fraud it says the feature will enable.
The government's case, stated fairly
MeitY's underlying concern isn't fanciful. India has a serious digital-fraud problem: fake customer-support numbers, impersonation of bank officials, and so-called "digital arrest" scams that use spoofed identities to extort victims over calls and messages. A phone number, whatever its privacy costs, is at least a weak identity anchor — it ties an account to a SIM registered with government-mandated KYC. Usernames strip that anchor away, and MeitY's specific worry — that fraudsters could register handles that closely mimic banks, police departments, or government agencies — describes a real attack pattern, not a hypothetical one. Any platform serving hundreds of millions of users in a market with limited digital literacy should expect regulators to ask hard questions about identity-spoofing risk before, not after, a feature scales nationally.
Where the legal basis runs thin
The problem is what MeitY did with that concern. India's intermediary framework — the IT Rules, 2021, issued under the Information Technology Act, 2000 — gives the government real levers here. Rule 4(2) requires "significant social media intermediaries" offering messaging to enable traceability of a message's first originator, but only when a court or a competent authority under Section 69 of the Act orders it for specific, listed purposes: sovereignty, state security, public order, or investigation of serious offenses (PRS India, IT Rules 2021 tracker; Section 69, IT Act 2000, via Indian Kanoon). That is a narrow, case-specific power to unmask a sender after wrongdoing is alleged — not a general license to pre-approve product design.
Nothing in the 2021 Rules or Section 69 gives MeitY authority to block a feature's launch pending its own satisfaction with a company's justification. The notice instead leans on the IT Act's broader intermediary-compliance obligations — asking WhatsApp to show cause why "regulatory action" shouldn't follow — a much vaguer hook that lets the ministry act as a de facto product-approval body without a rulemaking process, public comment, or a defined standard for what would satisfy it. Digital rights advocates have already flagged this gap between the notice's demands and its statutory footing, and the ambiguity is the point: an open-ended standard gives the government leverage no specific law does.
A precedent, not just a policy
The stakes extend beyond India. As Namrata Maheshwari, encryption policy lead at Access Now, put it: "It's a slippery slope because the moment you concede something in one jurisdiction and make it known as something that is possible to do technically, other countries will follow suit" (Rest of World). WhatsApp's India user base — reportedly over 850 million, its largest market globally — gives New Delhi outsized leverage to extract concessions that then become templates elsewhere. If WhatsApp modifies a privacy-protective feature for India rather than litigate a notice with a shaky legal basis, every other government watching gets a cheaper playbook: skip the rulemaking, issue a notice, and let commercial pressure do the rest.
The proportionate path
India doesn't need to choose between fraud prevention and pseudonymity. It already has tools: mandatory reporting channels for impersonation, faster takedown timelines for confirmed scam accounts, and the traceability mechanism Rule 4(2) already provides for law-enforcement requests tied to actual investigations. What it shouldn't have is an unwritten veto over product features exercised through informal notices rather than transparent rulemaking. If MeitY believes pseudonymous handles pose a systemic risk, the answer is a public consultation on amending the Rules — not a three-platform show-cause letter that asks companies to prove a negative before launch. Fraud is a real harm worth regulating precisely. A precedent that lets any ministry freeze any feature on suspicion alone is a harm too — just one that compounds quietly, in every market a company like WhatsApp or Signal operates.