Log in
India just changed how you'll use WhatsApp forever. Starting February 2026, your messaging apps won't work unless your registered SIM card is physically inside your phone—and that's just the beginning.
The Indian government's Department of Telecommunications (DoT) has issued a sweeping directive that fundamentally alters how over 500 million Indians use messaging platforms. Under new regulations, WhatsApp, Telegram, Signal, and other messaging apps must continuously verify that the registered SIM card remains active and physically present in the device. Remove your SIM, and the app stops working immediately.
But the changes go further. For web-based versions like WhatsApp Web, users will be automatically logged out every six hours and must re-authenticate using a QR code. This means if you're used to keeping WhatsApp Web open all day on your laptop, you'll now need to pull out your phone to scan a new code every six hours.
What Is SIM Binding and Why Now?
The new rule introduces what telecom regulators call "SIM binding"—a continuous link between your messaging account and your physical SIM card. The government argues that current apps using mobile numbers for validation allow access even when the underlying SIM is not present in the device, creating vulnerabilities exploited from outside India to commit cyber fraud.
The directive affects WhatsApp, Telegram, Signal, Arattai, Snapchat, ShareChat, JioChat, and Josh. These platforms now fall under a new regulatory category called Telecommunication Identifier User Entities (TIUEs), bringing them under the same cybersecurity framework as traditional telecom operators for the first time.
The 90-Day Countdown and What Users Should Expect
All affected platforms have 90 days to implement continuous SIM-to-device binding and must complete compliance reports within 120 days. The rules take effect in February 2026, with the DoT warning that non-compliance will trigger action under the Telecommunications Act, 2023.
For most users with a single phone and active SIM, daily messaging won't change dramatically. However, certain use cases will become impossible: using WhatsApp on a Wi-Fi-only tablet, keeping your primary SIM in one device while using the app on another, or accessing your account after temporarily removing your SIM card will all trigger automatic logouts.
The Cellular Operators Association of India has supported the move, with one statement noting that mobile numbers remain the country's most monitored identity system. However, cybersecurity experts point out that scammers frequently use loaned or forged IDs to procure SIM cards, bypassing KYC norms, and only need a few IDs per year to conduct fraudulent activities.
Industry Pushback and Privacy Concerns
The Internet and Mobile Association of India, which represents Meta and other digital firms, has stated that the amended rules represent a clear overreach of delegated legislative power and will have broad implications for digital businesses across fintech, e-commerce, mobility, and social media.
One industry source called the instructions problematic, noting that no feasibility study or consultation was held before the directions were issued, and questioned whether these measures would resist circumvention by fraudsters.
The directive marks an unprecedented expansion of DoT's jurisdiction from regulating traditional telecom carriers into the content layer of the internet—a move that could set precedents for how messaging platforms operate globally.
What You Need to Do
For now, nothing. The platforms themselves must implement the technical changes over the next 90 days. Once active, ensure your registered SIM stays in your primary device, and prepare for more frequent logins if you use desktop or web versions of these apps. If you use messaging apps on multiple devices or without an active SIM, consider adjusting your workflow before February 2026.
The government maintains these measures will enhance traceability and reduce cross-border cyber fraud, though whether SIM binding alone can achieve these goals remains a point of serious debate among cybersecurity professionals and digital rights advocates.
