India orders messaging apps to enforce SIM binding by 2027
Messaging access becomes continuously tied to a physical phone identity.
Overview
From January 1, 2027, major messaging apps in India must keep each account linked to the physical card used to register it. The issued the order under the . It says regular checks will help prevent fraud, impersonation and phone-number misuse. WhatsApp, Telegram, Signal, Snapchat, ShareChat, JioChat, Arattai and Josh must comply by December 31, 2026.
The must remain active and stay in the main device. Removing, replacing or deactivating it, or moving it to another device, could suspend the account until checks are completed. Web and desktop sessions will end after six hours and require a . The rules may make accounts harder to hijack, but could create problems for privacy, travel, accessibility, dual- users and people who rely on computers or other devices. It is still unclear how platforms will enforce the checks.
Timeline
India is scheduled to begin enforcing SIM binding for covered messaging apps
From January 1, 2027, a covered app may stop working when the registered active SIM is absent from the , inactive or replaced until the account is restored and verified. Linked web and desktop sessions will remain dependent on the and periodic QR authentication, making everyday access more secure against impersonation but more dependent on continuous possession of one physical SIM.
The government set December 31, 2026 as the compliance deadline for covered messaging platforms
The Department of Telecommunications set December 31, 2026 as the compliance deadline for covered app-based communication services, ahead of the planned January 1, 2027 implementation of . Reports identify WhatsApp, Telegram, Signal and other services as covered platforms, while implementation details remain subject to clarification.
Messaging platforms received a 90-day window to implement continuous SIM binding
The directive gave covered services 90 days to modify account-access and linked-device systems, with implementation reporting required within 120 days. Platforms therefore had to enforce the SIM condition continuously rather than only during initial registration.
The DoT required web and desktop sessions to expire within six hours and use QR relinking
Web versions and other must log users out periodically, no later than six hours, and let them reconnect by scanning a from the primary device. The rule could affect shared computers, workplace access, tablets and users who depend on secondary devices.
The DoT required the registered SIM to remain physically present in the primary device
Covered apps must be tied to the specific active SIM used for registration, with access potentially blocked if that SIM is removed, replaced, deactivated or used in another device. The requirement changes account verification from a one-time login check into an ongoing .
The Department of Telecommunications ordered eight messaging platforms to bind accounts to active SIM cards
The DoT directed WhatsApp, Telegram, Signal, Snapchat, ShareChat, JioChat, Arattai and Josh to keep accounts continuously linked to the associated with the registered number. The order was issued under the Telecom Cyber Security Rules, 2024, to reduce cyber fraud, impersonation and misuse of telecom identifiers.
India created a cybersecurity rule framework for protecting telecom identifiers
The established the regulatory route later used to control misuse of mobile numbers and other telecom identifiers. The framework focuses on protecting the telecom ecosystem from fraud and identity abuse.