India Sets January 2027 SIM Binding Start for WhatsApp and Telegram as Access Rules Change

December Deadline Puts Registered SIMs at the Centre of Messaging Access

India's Department of Telecommunications (DoT) has set December 31, 2026, as the compliance deadline for rules requiring messaging accounts to stay linked to their registered, active SIM cards, with implementation scheduled for January 1, 2027. The change could affect people who use WhatsApp or Telegram on phones without the SIM used to register their account, including people who rely on Wi-Fi or switch SIMs when travelling.

The department has also relaxed a separate requirement: web and desktop sessions will no longer have to end automatically every six hours. The revised approach calls for sessions to be terminated immediately when fraud is suspected, making suspicious activity, rather than a fixed clock, the basis for those logouts.

The policy reaches a large audience. WhatsApp has an estimated 500 million users in India, while other services using Indian mobile numbers for registration also fall within the framework. The practical change is from checking a number when someone opens an account to maintaining a connection with that number's active SIM during continued use.

The government says this will help stop criminals from using Indian numbers for fraud after the original SIM has been removed or deactivated. Technology companies and an industry association have raised concerns about the engineering work, disruption to ordinary users and the legal authority behind the mandate.

What Will SIM Binding Change?

Messaging apps commonly verify a phone number by sending a code through a text message. Once the code is entered, the account can often keep working over the internet even when the SIM is removed. SIM binding adds an ongoing check that the registered SIM remains available and active in the device.

The Data Security Council of India's SIM binding summary, dated December 18, 2025, describes the requirement as access tied to a specific, active SIM. It says the November 28 directive aims to strengthen traceability and compliance with national security and data protection requirements.

KYC, short for know your customer, refers to the identity checks used when a telecom operator issues a mobile connection. The government's approach connects the messaging account more closely to that verified subscription, rather than relying only on proof that somebody received a registration code at an earlier point.

The binding happens through app software and authentication systems. It does not require changes to the physical SIM itself. A March 26, 2026, International Bar Association analysis, written by JSA lawyers Tony Verghese, Radhika Gupta and Uddhav Gupta, explains that platforms can use permitted software interfaces and telecom validation signals to maintain the connection.

The lawyers describe an implementation in which removing, deactivating, replacing or porting the registered SIM triggers suspension followed by verification again. Porting means moving a number to another telecom operator. For users, that could turn a routine change of mobile connection into an additional messaging account check.

How the Timetable Has Changed

The DoT originally gave platforms 90 days to comply with its November 28, 2025, directions and 120 days to submit a compliance report. Industry concerns about technical readiness led to an extension.

Platform companies estimated that support across Android and Apple's systems would be technically ready only around October or November 2026. The December 31 deadline gives them a later target for completing the changes.

• November 28, 2025: The DoT issued the SIM binding directions, initially allowing 90 days for compliance.
• December 18, 2025: The Data Security Council of India published its summary of the active SIM requirement.
• March 26, 2026: The International Bar Association published an analysis describing the earlier February 28, 2026, deadline and the original six hour session rule.
• October to November 2026: Platform companies expected technical readiness across Android and Apple systems.
• December 31, 2026: Platforms face the extended compliance deadline.
• January 1, 2027: The government plans to put the requirements into operation.

The International Bar Association article retains the earlier February 28 deadline, while the revised timetable sets December 31, 2026. Its description of the original framework is useful for understanding how the policy began; the extension and revised logout approach change the practical timetable and session requirements.

Which Apps and Devices Face Changes?

WhatsApp and Telegram are central to the rollout, but the original scope is wider. The Data Security Council of India lists Signal, Arattai, Snapchat, ShareChat, JioChat and Josh alongside them. The International Bar Association analysis describes coverage in terms of services that use Indian telecom identifiers, including Indian mobile numbers, for registration and authentication.

Snapchat's position is unsettled in the public descriptions: the institutional summaries include it, while later implementation information describes it as exempt. Signal is listed within the framework and has reportedly not answered government notices. Final platform instructions, Snapchat's treatment, verification arrangements for individual device setups and a confirmed list of affected phone models have not been made clear.

Both Android phones and iPhones could be affected when the registered SIM is missing or inactive. The relevant issue is how the app verifies the subscription on the device, rather than the phone's brand alone.

WhatsApp has reportedly begun beta testing SIM binding on Android. Beta testing means trying a feature with a limited group before a wider release. Apple has reportedly introduced supporting changes through an iOS update released in September 2026 that helps detect when an iPhone is operating without a SIM. Queries to Apple, Google and Meta about technical readiness had gone unanswered when the deadline extension was reported.

Wi-Fi Users, Travellers and Families Face Practical Changes

A phone can connect to the internet through Wi-Fi while its registered SIM sits in another handset or is no longer active. Under continuous SIM binding, the app would also need to complete the required SIM verification. A working internet connection alone would no longer be the only condition for continued messaging access.

Travellers could encounter this when removing an Indian SIM to use a local connection abroad. The International Bar Association analysis identifies dual SIM and eSIM configurations as relevant to keeping the registered connection available. An eSIM is a digital SIM profile stored on a compatible device, rather than a removable plastic card.

Platforms will need to handle several ordinary situations accurately: a device with two subscriptions, a switched eSIM profile, a replacement SIM and a number moved between operators. Users could otherwise face verification interruptions during changes they make for travel, repairs or network service.

Family sharing adds another complication. A CUTS International survey found that 86% of respondents said they allowed family members to use their phone or SIM for messaging. An account tied more tightly to one active subscription could make those arrangements less convenient, particularly when family members use different devices.

The same survey found that 80% of consumers and more than 60% of small businesses expected disruption. Those figures describe expectations before implementation. They show why access arrangements matter to users who depend on messaging for family communication, customer enquiries and daily work.

What Happens to WhatsApp Web?

The original directions included a requirement for web and desktop sessions to expire within six hours, followed by authentication again through the primary device, typically using a QR code. That would have required people to reconnect during a working day even when nothing suspicious had happened.

The DoT later replaced the blanket six hour rule with a risk based approach. Under the revised arrangement, sessions must be ended immediately in suspected fraud cases. Some descriptions of the policy still repeat the original six hour requirement, but the revised framework removes that routine timetable.

The department also wants users to be able to relink web and other devices using a QR code. The change preserves a way to reconnect while allowing services to intervene when activity appears fraudulent.

SIM verification remains a separate obligation. A person may avoid repeated scheduled logouts on a laptop while still needing the registered SIM to remain valid and available through the primary device. For businesses using messaging throughout the day, that combination makes the design of verification and account recovery especially important.

Why the Government Wants a Continuous Link

The Ministry of Communications has cited cyber fraud losses exceeding Rs 22,800 crore, equivalent to Rs 228 billion, in the preceding year. The government says criminals exploit accounts that continue operating after their underlying SIM has been removed, deactivated or taken abroad.

The DoT's stated concern is that an Indian number can remain attached to an active messaging account while the person operating it is elsewhere. Keeping a live connection with the registered SIM is intended to reduce the time during which that detached account can be used.

Digital arrest scams are among the frauds the policy targets. Criminals impersonate police or other officials and pressure victims into sending money, often by falsely claiming that the victim is under investigation or must remain on a call. Phishing and other impersonation schemes also form part of the government's rationale.

Telecom Minister Jyotiraditya Scindia has said the decision on SIM binding will not change, citing national security. The Cellular Operators Association of India has supported measures aimed at telecom security and the integrity of mobile identifiers.

The DoT also plans a Mobile Number Verification platform, known as MNV, to help check whether numbers correspond to legitimately issued, active connections. That system would give platforms a telecom verification route alongside the changes they make inside their apps.

Why Industry Is Challenging the Legal Basis

Broadband India Forum (BIF), an industry body representing major technology companies including Meta and Google, challenged the mandate in a February 23 letter to DoT secretary Amit Agrawal. It cited a senior counsel's opinion arguing that the Telecommunications (Telecom Cyber Security) Amendment Rules, 2025, and related directions exceed the Telecommunications Act, 2023.

BIF said the legal opinion reached the following conclusion about the amended rules and directions:

ultra vires the parent legislation and are also unconstitutional

Ultra vires means beyond the legal powers granted to the authority making a rule. BIF's argument is that the government has used rules made under an existing law to extend telecom regulation to a category of digital businesses beyond that law's intended reach.

The disputed category is Telecommunication Identifier User Entities, or TIUEs. In simple terms, it covers businesses that use identifiers such as mobile numbers. BIF argues that an app referring to a customer's number is different from a telecom operator receiving authority to provide telecom services.

The association also argues that the framework overlaps with the Information Technology Act, financial regulations and the Digital Personal Data Protection Act. Its concern is that businesses could face competing requirements from different legal systems. The position sets the industry's challenge against the government's view that continuous SIM verification is needed to protect telecom identifiers and combat fraud.

Privacy and Access Depend on the Rollout

The International Bar Association analysis places the privacy debate within the Supreme Court's Puttaswamy ruling of 2017. That framework asks whether a restriction has a legal basis, serves a legitimate aim, is necessary and proportionate, and includes procedural safeguards.

For SIM binding, the practical privacy issues include what information platforms collect during checks, how long they retain it and what oversight applies. The lawyers identify limiting data collection, accountability and protection against disproportionate surveillance as matters that need attention.

Mobile operating systems already restrict apps from directly accessing certain sensitive device and subscriber identifiers. Platforms therefore need verification methods that work within those protections while satisfying the DoT's requirements. That helps explain why implementation requires coordination among app companies, operating system providers and telecom services.

Platforms that fail to comply could face action under the Telecommunications Act, 2023, and the Telecom Cyber Security Rules, 2024. For users, the immediate milestones are the December 31 compliance deadline and the planned January 1, 2027, start. The central change is straightforward: continued access is set to depend more closely on an active registered SIM, while the revised web session policy focuses on suspected fraud.

Key Points

• The DoT has set December 31, 2026, for compliance, with implementation planned for January 1, 2027.
• Covered messaging accounts must remain linked to their registered, active SIM cards.
• The blanket requirement to end web and desktop sessions every six hours has been replaced by a risk based approach.
• People using phones without the registered SIM, switching subscriptions abroad or sharing devices could face access changes.
• The government cites fraud prevention and national security; BIF challenges the mandate's legal basis.
• Platforms are developing verification systems across Android and Apple devices, with WhatsApp reportedly testing the feature on Android.