India's WhatsApp SIM-Binding Rule: What Changes From January 2027

India's Department of Telecommunications (DoT) issued directions requiring messaging and calling apps that use Indian mobile numbers to identify users to keep each account continuously linked to the physical SIM card used to register it, according to the government broadcaster News on Air and the news outlet TechCrunch. TechCrunch and the outlet BusinessToday date the directions to November 28, 2025. The requirement, known as SIM binding, is scheduled to become operational for users on January 1, 2027.

What SIM binding actually requires

Under the DoT order, an app account must stay tied to the specific SIM card that was active in the device when the account was registered or last verified. News on Air reported the directions were issued under India's Telecom Cyber Security Rules, which were themselves amended on October 22, 2025 under Section 56(2)(v) of the Telecommunications Act, 2023, according to the digital-rights group Internet Freedom Foundation (IFF).

The problem the DoT is targeting, as summarized by News on Air, is that accounts on instant-messaging and calling apps 'continue to work even after the associated SIM is removed, deactivated or moved abroad,' which the ministry says lets fraudsters keep running scam accounts from outside India.

Which apps and users are affected

The DoT order names eight apps: WhatsApp, Telegram, Signal, Snapchat, Arattai, ShareChat, Josh and JioChat, according to News on Air, the technology site Digit, and BusinessToday. WhatsApp is by far the largest of these in India, with more than 500 million users and 94% of its monthly users opening the app daily as of November, far above the 59% figure TechCrunch reported for the United States.

BusinessToday reports that WhatsApp has started beta-testing SIM binding on Android, and that Apple added related iOS support in September 2026, according to the gadget site Beebom. Beebom also reported that, as of its reporting, Signal had not publicly responded to the government notice, while coverage from Digit and BusinessToday treats Signal as formally covered by the DoT list.

Timeline: from a 90-day order to a 2027 deadline

TechCrunch and News on Air both reported that the original directions, issued in late November 2025, gave covered platforms 90 days to comply and 120 days to submit compliance reports to the DoT. Later coverage from Digit, BusinessToday and Beebom describes a revised timeline in which platforms have until December 31, 2026 to finish implementation, with the rule becoming operational for end users from January 1, 2027.

The original order also required web and desktop versions of the apps to force a logout every six hours and make users re-link the session with a QR code, according to TechCrunch. Digit reported that this blanket six-hour rule has since been eased in favor of 'risk-based logouts,' where apps can log out a session mainly when fraud is suspected rather than on a fixed schedule.

Who could lose access, and when

Digit and BusinessToday both describe several groups at risk of losing access once the rule is enforced: people who remove or deactivate the SIM that is bound to their account, users who rely mainly on Wi-Fi without that SIM physically in the device, owners of tablets or secondary phones linked to a main account, and international travelers who swap in a local SIM abroad. Digit advises travelers to check in advance whether their account setup will still work with a replacement SIM.

Why the government says this is necessary

News on Air and TechCrunch both cite the same government figure: cyber-fraud losses in India exceeded Rs 22,800 crore (roughly $2.5 billion, per TechCrunch's conversion) in 2024 alone. News on Air quoted the ministry describing SIM binding as necessary 'to plug a concrete security gap that cybercriminals are exploiting.'

Industry and privacy concerns

TechCrunch reported that the Broadband India Forum, an industry group, warned the rule raises 'serious questions of technical feasibility' and could cause 'material inconvenience and service disruption,' particularly for small merchants who run WhatsApp Business across multiple devices at once.

Separately, the Internet Freedom Foundation flagged concerns about a related part of the same rule package: a Mobile Number Validation platform that lets the government suspend telecom identifiers on undefined 'public interest' grounds under Rule 5(6), which IFF says is not among the specific grounds listed in Article 19(2) of India's constitution for restricting speech. IFF also noted that affected users could lose phone access for more than 30 days while a dispute is resolved.

What this means for ordinary users

For most people who keep using the same phone number and the same physical SIM, the practical change after January 1, 2027 should be limited to occasional re-verification steps, based on the scenarios described by Digit and BusinessToday. The rule mainly affects people who physically remove their registered SIM, let it lapse, rely on secondary devices without that SIM inserted, or swap to a foreign SIM while traveling.