Names without numbers: India must set the terms for WhatsApp usernames

For 17 years, your Wha­t­s­App identity was your phone number. from this week, your identity can be a handle - issued and controlled by Meta

On June 29, Meta began rolling out usernames on WhatsApp — handles that let anyone be found and messaged without sharing a phone number. Within forty-eight hours, the government ordered Meta to hold the rollout in India and explain itself within three days.

 

That was the right call, and I support it. Six hundred million Indians live a large part of their lives on this one app. When the platform that carries their conversations decides overnight to change what identity itself means on that platform, India does not get informed as a courtesy. India gets consulted first.

 

But a pause is not a policy. What matters now is what we do with these three days — and the weeks after and how we regulate Whatsapp in India. So let me say clearly what I believe this feature is, what it is not, and what the government must demand before a single username goes live in India.

 

What Meta has actually done

 

Strip away the product language and the change is simple. For 17 years, your Wha­t­s­App identity was your phone number — an identifier issued under Indian regulation, portable across operators, usable on any rival app. From this week, your identity can be a handle — issued by Meta, controlled by Meta, and meaningless anywhere outside Meta’s walls.

 

Two facts should frame every conversation the government has with Meta. First, the phone number does not disappear. It is still mandatory to register, and it stays on Meta’s servers. So nobody should be misled into thinking this is anonymity — it is not, and our agencies’ lawful access through due process remains intact. 

 

Second, for the millions of Indian businesses that live on WhatsApp, Meta is replacing the customer’s phone number with a new identifier that Meta generates, scopes and controls. The kirana store, the boutique, the bank, our growing D2C brands and small and micro businesses — each will know its customers only through a code that works exclusively inside Meta’s ecosystem, on Meta’s terms.

 

Government’s first concern is the Indian user

 

I have long argued that the internet must be safe and trusted for every digital nagrik — and safety is exactly where this feature, launched carelessly, will fail first.

 

Within a day of the rollout, researchers found handles like “rbi_verify”, “indiamodi” and “ambanijio” available for anyone to claim. Think about what that means in a country already tormented by digital-arrest scams, fake bank officials and phishing rackets. A random 10- digit number claims nothing; a handle that reads “rbi_verify” carries an implicit claim of authority. Combine that with the ability to message strangers without burning a traceable SIM, and we have handed the fraud industry a cheaper, more convincing weapon — aimed squarely at the newest, most trusting users of the internet: our parents, our first-generation users, the millions who came online in the last decade because of Digital India.

 

While on the face of it the username launch suggests that it is a privacy-enhancing measure, it is actually Meta’s commercial strategy at play driven by putting a monetisation lock on India’s large digital consumption market. It is very similar to what Meta did under its Free Basics and Internet.org programme  — using public interest posturing to monopolise a market and gatekeep the internet. 

 

Ten years ago, this was stopped under Prime Minister Narendra Modi’s first term. Something similar is being attempted here. Stripped to basic facts it’s a gigantic data-harvesting programme for benefitting Meta and not Indian users. Everything from customer acquisition on social media to customer engagement and retention will become expensive for our consumer startups.

 

The deeper game: Who owns your identity?

 

Beyond fraud lies the question few are asking. WhatsApp is not a startup experimenting with a feature. It is a platform our courts have affirmed as dominant: Entrenched network effects, switching costs its own regulatory battles could not dent, and a penalty for abusive data-sharing upheld only last year. When a dominant platform converts identity from a public, portable number into a proprietary handle, that is not a convenience feature. That is a land grab on the identity layer of a billion Indians. 

 

Understand the mechanics of lock-in here. Your number moves with you — to Signal, to Telegram, to whatever comes next. Your handle does not. Every year you are known ‘at your handle’, the cost of leaving rises. Every business that rebuilds its customer relationships around Meta’s new identifiers becomes a tenant on Meta’s land. And a uniform handle across WhatsApp, Instagram and Facebook quietly makes one American corporation the de facto identity infrastructure of the world’s largest digital democracy. India spent a decade building public digital infrastructure — Aadhaar, UPI, DigiLocker — precisely so that no private monopoly would own the rails of Indian life. We should not now surrender the identity rail of daily communication by in-attention.

 

What government must regulate

 

The DPDP Act and the IT Rules exist for exactly this moment — not to stop innovation, but to make it answer to the Indian user. I would urge the government to convert this pause into the following firm, time-bound set of conditions:

 

1. Bot-free, Impersonation-free messaging - protect the namespace before launch. No handle resembling a government body, regulator, bank or payment system should be claimable by anyone but its rightful owner — verified in advance, with look-alike and homoglyph detection built-in and a rapid takedown channel for impersonators. If Meta can reserve celebrity names, it can protect the RBI.

 

2. Safety on by default. First contact from an unknown handle must come with friction and warnings switched on by default — not buried in settings our first-time users will never find. One-tap reporting must flow straight to I4C and the 1930 helpline.

 

3. Stop Data harvesting, draw the data line under the DPDP Act. The new identifiers this feature creates — the handle-to-number mapping, the business-scoped IDs, username searches — must be used for service and security, and nothing else. Not advertising. Not cross-platform profiling. If Meta wants to monetise identity data of Indians, it must ask Indians first, in plain language.

 

4. Security cannot be diluted. Preserve lawful traceability. The handle-to-number mapping, including history, must be retained and produced under due process within defined timelines. Nothing about this feature should weaken the equilibrium our law enforcement depends on — and nothing in this demand touches encryption.

 

5. Prevent market dominance and concentration risks. Put the CCI on the field. Identity lock-in. Business dependence on Meta-issued identifiers are competition questions, and they belong before our competition regulator now — not after the lock-in is complete. And as we shape our digital competition framework, identity portability— the right to take your handle, your contacts, your business relationships and leave —must be written into it.

 

6. Make the rules platform-neutral. These conditions should bind any messaging platform offering handles at scale — Signal , Arattai etc included — through proper rule-making, not one-off directions. India acts by law, not by whim: That is what separates us from regimes we would never want to resemble, and it is what makes our regulation stand up in court.

 

7. Review regulation of communication OTT (over the top) services. Invite TRAI (the Telecom Regulatory Authority of India) to regulate OTT communication services under anti-spam / unsolicited commercial messaging regulation to prevent fraud and spam. India is nobody’s beta test — not for Meta, not for AI. I have said for years that the era of Big Tech treating India as a market to be harvested — big enough to profit from, too polite to answer to — is over. We are not anti-innovation; we built the world’s most ambitious digital public infrastructure while others were writing white papers. We are anti-impunity. 

 

So the message to Meta is simple. Six hundred million Indians are not a rollout schedule. They are citizens of a digital republic — and on questions of their safety, their privacy and their identity, it is India that sets the terms.

 

The writer is an entrepreneur, a member of the Kerala Legislative Assembly, and former Union minister of state for electronics and information technology