India’s suspension of WhatsApp’s planned username feature appears to be a dispute over a product update. But a closer look shows it is the latest chapter in a long battle over how much visibility governments should have on the identities of those who use such digital platforms to communicate.
Meta’s proposed username option will let WhatsApp users trade messages without revealing their phone numbers to those who do not have them saved. But law enforcers want visible numbers since they offer investigative leads.
The ministry of electronics and information technology (MeitY) says that usernames will make it harder to identify fraudsters and probe cybercrimes. After asking WhatsApp to pause their rollout, it sought explanations from Telegram and Signal too of how their username features address cybercrime.
The government’s concerns are genuine. India is WhatsApp’s largest market, with more than 850 million monthly active users. If we add Telegram, Signal and Meta’s other platforms, the country has over 2 billion accounts active at least once a month. It has also seen a surge in cybercrime, from phishing and voice cloning to ‘digital arrest’ scams, in which crooks impersonate police officers or other authorities to extract money from victims.
Yet, the Centre’s response conflates data hidden from other users with data hidden from the state.
First, phone numbers on WhatsApp have been harvested at industrial scale for years; recall the 2022 breach that exposed around 500 million numbers. Usernames are an attempt to fix this.
Second, usernames do not affect chats and their encryption, but users must still register with a phone number. And that data is available to the platform and law enforcers (via legal processes).
Third, officials worry that fraudsters may pair foreign numbers with deceptive usernames to pose as public figures or institutions. But tracing overseas accounts has never been easy, given the gaps in cross-border ID verification and telecom rules; masked numbers will not change this.
So the latest dispute must be seen in the context of the Centre’s old standoff with WhatsApp over digital traceability. In 2021, the app challenged Indian rules at the Delhi high court, arguing that identifying the originator of a message would require cracks in encryption for all users just to catch a few bad actors.
Similar debates have played out in the EU, UK and Australia over how much identity data governments can legally demand from platforms that promise privacy. MeitY’s intervention relied on executive fiat rather than a clearly articulated statutory authority.
Critics argue that current intermediary liability provisions do not empower the Centre to approve or reject product features. In 2024, New Delhi proposed requiring approval for certain AI models before deployment, only to withdraw the plan in the face of criticism.
Such ad hoc regulation creates uncertainty for businesses. Zoho’s messaging app, Arattai, for instance, dropped its username feature without a formal directive. Meta, however, must not dodge its responsibility. Its record on privacy and platform-abuse remains deeply contested; it has also been summoned by Indian authorities over Instagram ads that allegedly promote child sexual abuse material.
Even so, specific traceability rules should be set by laws that are well-debated and transparent. Else, every new pro-privacy feature will risk needing the state’s nod, which would form an overly statist policy that sends market-focused businesses and investors the wrong signal.