India's Department of Telecommunications (DoT) had earlier issued directions to messaging apps to log out users from web-based sessions every six hours. It would have affected WhatsApp, Telegram, Signal, and other messaging apps in India and the government had asked companies to submit a compliance report by the end of March. Now, it has come to light that the mandate has been shelved for now after industry pushback.
Indian Government backs off after industry pushback
A DoT official confirmed to The Hindu that the government has dropped the requirement for messaging apps to forcibly log out web-based sessions every six hours. The original SIM-binding directions had two major components. First, apps like WhatsApp would need to verify that users have an active SIM card matching their registered phone number in the same device.
Second, web-based sessions like WhatsApp Web would need to forcibly log users out every six hours. The government argued that these measures were necessary to fight spam, financial fraud, and counter national security risks.
Now, the DoT has backed off and the logout requirement has been dropped entirely. Instead of a six-hour logout cycle, the official said logouts would be based on a "risk-based analysis". That said, it's unclear what it actually means and how it will be implemented. In the past, the government quietly walked back the mandate to install the Sanchar Saathi app after a huge backlash.
Apart from that, the SIM binding requirement is still standing, but the compliance deadline has been pushed to December 31, 2026.
The Indian government reversed its position after a strong pushback from the industry. It was led by the Broadband India Forum, which has members like Meta and Google. It had warned the DoT that these directions were unconstitutional.
Similarly, the Internet and Mobile Association of India (IAMAI) raised concerns and pointed out that millions of Indians rely on WhatsApp Web daily, and forcing periodic logouts would cause massive disruptions with negligible security benefits.
While the web-based logout requirement is gone, tech companies have nine months of breathing room to submit a compliance report on SIM binding. UPI apps like PhonePe and Google Pay already do SIM verification via SMS to confirm that the registered number's SIM is active in the device. However, it's unclear how messaging apps will be able to directly read SIM data as both Android and iOS restrict it.
