What changed this week
On 23 October 2026, MediaNama reported, citing CNBC journalist Aseem Manchanda, that Apple has made the changes iOS needs to support SIM binding, the Department of Telecommunications (DoT) requirement that messaging apps keep an account tied to the SIM that registered it. An industry source told MediaNama that Apple had initially pushed back and planned to file a representation with DoT. WhatsApp and Zoho's Arattai have confirmed they are building the feature. Telegram has not clarified its plans, Signal has not responded to the government's notices, and Snapchat appears to argue the rule does not reach it because it does not use a phone number as its user identifier. The compliance deadline is 31 December 2026.
The Apple report matters because, in the words of telecom specialist Parag Kar, quoted by MediaNama, continuous SIM validation is technically infeasible without deep OS-level support from Apple or Google. A rule that depends on two foreign platform owners is only as enforceable as their cooperation.
The strongest case for the mandate
The government's argument deserves a fair statement. DoT's directions, as described by the government broadcaster in December 2025, target accounts that keep working after the linked SIM is removed, deactivated or taken abroad. That gap, the Ministry says, enables anonymous scams, "digital arrest" frauds and government-impersonation calls, and it cites cyber-fraud losses of over ₹22,800 crore in the previous year. Telecom operators already carry KYC duties for every SIM they issue, while an app account tied to a number can outlive that number indefinitely. Closing the mismatch is a coherent goal, and the industry body COAI has welcomed the move. The directions apply to eight named apps: WhatsApp, Telegram, Signal, Arattai, Snapchat, ShareChat, Jiochat and Josh.
Where the design breaks down
The legal footing is contested. The directions rest on the Telecom Cyber Security Rules, 2024, notified on 21 November 2024 under Section 22(1) of the Telecommunications Act, 2023, as DoT's own portal states. The October 2025 amendment, notified on 22 October 2025, is what stretches those rules to "Telecommunication Identifier User Entities": non-licensees such as banks, delivery platforms and messaging apps that use mobile numbers to identify users, according to AZB & Partners' summary. The Broadband India Forum argues, as Inc42 and BOOM report, that this extends telecom-style regulation to internet messaging services without a statutory basis and without wider consultation. A mandate of this reach, reshaping how roughly every major messenger in the country authenticates users, would normally warrant parliamentary debate rather than rule amendment.
The fraud payoff is unproven. BOOM's explainer quotes cybersecurity consultant Venkata Guttula noting that mule accounts, which use real KYC documents and legitimate SIMs, are untouched by SIM binding. Tech lawyer Salman Waris adds that it cannot reach scams run through international numbers, VoIP routes, foreign SIMs or rooted devices. The ministry has published no analysis estimating what share of the ₹22,800 crore in losses involved an orphaned messaging account, which is the only category this rule addresses. Proportionate regulation starts with that estimate.
The privacy cost is concrete. Binding every account to a KYC-linked SIM creates a durable link between a person's messages and their official identity. For journalists, whistleblowers and activists, that removes a protection many depend on. Travellers using local SIMs abroad and dual-SIM users face lockouts. The earlier design made this worse: the original November 2025 directions required web and desktop sessions to log out every six hours, a requirement DoT dropped in April 2026, when it also moved the deadline from 28 March to 31 December 2026. The Minister of State told the Rajya Sabha on 2 April 2026 that web sessions may be logged out on a risk basis, with no fixed period. The retreat shows how little testing preceded the first version. Nikhil Pahwa of MediaNama has warned that the government has "no idea how much will break."
A mandate that depends on selective cooperation
The compliance picture is already uneven. Two apps have said they will comply, one believes it is exempt, and two have said nothing publicly. Telegram and Signal are the services most likely to attract users who want less identity linkage, and a rule that only binds the cooperative leaves fraudsters a ready alternative. That is the familiar failure of identity mandates: they bind compliant mainstream services and push risk-takers to unregulated ones.
There is also a dependency problem the government did not create but now inherits. If SIM validation works only because Apple and Google expose new OS capabilities, then Indian telecom policy has been implemented through two private gatekeepers, whose terms on what apps may read from a device now shape the rule's scope. Questions such as whether eSIMs count, which CNBC reportedly left uncertain, will be settled by platform engineering rather than public rulemaking.
What proportionate looks like
There are narrower tools that target the same harm. Risk-based triggers, such as requiring re-verification when an account's SIM changes country or goes dormant, address the orphaned-account problem without a blanket identity link. Operator-side signals like SIM-swap and deactivation notices can reach apps through the Mobile Number Validation platform the 2025 amendment already created. Before 31 December, DoT should publish the legal basis for applying Section 22 to app providers, a fraud-impact estimate, and clear guidance on eSIMs, dual-SIM phones and travellers. Publishing those is cheaper than discovering the breakage after the deadline.