A single product decision inside a Menlo Park engineering team can now trigger a policy review in New Delhi. That is roughly the shape of the latest flashpoint between the Indian government and Meta, and it is worth watching not because it is dramatic, but because it is so ordinary. WhatsApp wants to let people talk without handing over their phone numbers. The Centre worries that the same convenience could grease the wheels of impersonation and fraud. Both positions are reasonable. That is exactly what makes this a useful test of how India regulates the platforms most of its citizens actually use.
What’s happening
According to a PTI report carried by Entrackr, the Indian government is reviewing WhatsApp’s upcoming usernames feature and exploring legal options to regulate or restrict its rollout. The feature, still in the pipeline, is designed to let users connect with one another using a chosen handle rather than their mobile number — a familiar pattern for anyone who has used Instagram, Telegram, or Signal.
The concern flagged by officials is that anonymity-by-design could make it easier to impersonate people and run online scams. And this is no longer hypothetical: within roughly 48 hours of WhatsApp’s June 29 announcement, India’s Ministry of Electronics and IT (MeitY) sent Meta a formal notice, ordered the username feature suspended for Indian users, and gave the company three days to explain its safeguards or face action under India’s IT rules. Officials singled out the “digital arrest” scam — where fraudsters pose as CBI officers, judges or customs officials — warning that lookalike handles mimicking agencies, public figures or banks could supercharge phishing and impersonation. Meta, for its part, says usernames still require a phone number, that it reserves handles for public figures and government entities, and that it has layered scam defences into the feature.
It is worth being precise about what has and hasn’t happened. There is no confirmed ban, no published notice, and no stated timeline. What exists is a reported review and a signal of intent. For readers trying to gauge risk, that distinction matters: this is the early, consultative end of the regulatory spectrum, not the enforcement end.
The tension
Strip away the specifics and you are left with a structural conflict that will recur for years. Privacy features work by removing information — in this case, the phone number, one of the most sensitive and reusable identifiers a person owns. Safety and enforcement frameworks, by contrast, tend to want more information, or at least reliable ways to trace it back to a human being when something goes wrong.
India has been unusually clear about which way it leans on that trade-off. The country’s traceability expectations — the idea that platforms should be able to help identify the origin of harmful content or activity when legally required — have shaped its dealings with messaging services for years. A usernames feature sits awkwardly against that backdrop. If two people can transact, argue, or defraud one another without a phone number ever changing hands, the government’s instinct is to ask where accountability lives.
This is really a story about platform design meeting national regulation. Meta designs for a global user base and a broadly consistent product experience. India regulates for its own risk environment, its own scam economy, and its own legal machinery. When those two logics collide, the friction is not a bug in the relationship; it is the relationship. As Entrackr framed it, the episode reflects India’s increasingly assertive approach to global platforms and the genuine tension between privacy and traceability.
Both sides of the argument
The case for usernames is straightforward and, on its own terms, strong. Your phone number is a poor thing to hand strangers. It follows you across banking apps, OTP flows, and contact lists; once leaked, it is a permanent liability. A username lets a journalist take tips, a seller field enquiries, or a stranger join a conversation without exposing a number that can be harvested, sold, or used for targeted spam and phishing. In that sense, usernames could reduce a category of harm — number-based spam and unwanted contact — that Indians experience daily.
The case for caution is equally grounded. A phone number, whatever its flaws, is a mild form of friction and a thread of accountability. It ties an account, however loosely, to a SIM, a KYC trail, and a real person. Remove that thread and you may lower the cost of setting up disposable, deniable identities — precisely the infrastructure that impersonation and investment-scam operations thrive on. In a market where digital fraud is a large and growing problem, regulators are right to ask whether a privacy upgrade for the many becomes an anonymity gift to the few.
Other markets offer a reference point rather than a verdict. Telegram has long allowed username-based contact and pairs it with optional privacy layers; it has also faced sustained criticism over abuse. Signal, built around privacy as a principle, introduced usernames while keeping phone-number registration in the background. Instagram and X are username-native and lean heavily on reporting, verification, and platform-side detection to manage impersonation. The lesson across these examples is not that usernames are safe or dangerous in the abstract — it is that the safeguards wrapped around them (rate limits, reporting, verification, fraud detection, and reversibility) determine the real-world outcome. The design of the guardrails matters more than the existence of the feature.
That is the productive question for both Meta and the Centre. Not “usernames: yes or no?” but “what has to be true — in abuse detection, reporting speed, and lawful traceability — for usernames to ship responsibly in India?” If a legal notice does arrive, the useful version of it asks for exactly that.
The India read
Zoom out and this fits a clear pattern. India has grown steadily more willing to shape how global platforms operate within its borders, from IT rules to data-protection legislation to repeated tussles over messaging, content, and grievance redressal. The message to Big Tech has been consistent: access to the world’s largest connected market comes with the expectation that product decisions account for Indian law and Indian risk. Reviewing a feature before it fully lands, rather than reacting after harm, is a logical extension of that posture.
For businesses that live on WhatsApp — and there are millions of them, from D2C brands to neighbourhood retailers running their entire order flow through chat — the practical takeaway is to expect uncertainty, not disruption. A few things are worth anticipating:
- Delayed or staged rollout in India. Even if usernames ship globally, the Indian version may arrive later or with extra guardrails. Don’t build a growth plan that assumes the feature by a fixed date.
- Verification will matter more. If usernames make impersonation easier, official business accounts, green ticks, and verified profiles become more valuable as trust signals. Invest in the legitimacy markers you can control now.
- Fraud hygiene becomes table stakes. Clear, consistent contact identities, published official handles, and customer education (“we will only message you from this account”) reduce the blast radius if impersonation scales.
The harder balance belongs to the regulator. Lean too far toward safety and you risk freezing legitimate privacy improvements, sending a signal that any feature reducing traceability is presumptively suspect — a stance that could chill useful innovation and inconvenience the ordinary users India says it wants to protect. Lean too far toward hands-off and you may license the next wave of scam infrastructure. The credible path runs between them: demand transparency on safeguards, insist on fast recourse for victims, preserve lawful traceability where genuinely needed, and let a well-guarded feature ship.
The honest verdict here is that neither side is obviously wrong. WhatsApp is chasing a real privacy win; the Centre is guarding against a real fraud risk. What will separate good regulation from grandstanding is whether the conversation stays technical — about detection, reversibility, and accountability — rather than becoming a symbolic fight over who controls the product. On the current evidence, this is a review, not a reckoning. The interesting part is what New Delhi and Meta build in the negotiating room next.
