India mandates active SIM for using messaging apps like WhatsApp, Telegram

New Delhi: The Government of India has issued new rules requiring app-based communication platforms—such as WhatsApp, Telegram, Signal, and others—to remain linked to a user’s active SIM card at all times. This rule will come into effect in February 2026. 

All companies offering these messaging services must submit compliance reports to the Department of Telecommunications (DoT) within 120 days of the directive being issued. The DoT has warned that non-compliance will invite action under the Telecommunications Act, 2023, the Telecom Cyber Security Rules, and other relevant laws.

The new rule will change how users access popular messaging apps like WhatsApp, Telegram, Signal, Arattai, Snapchat, Sharechat, JioChat, and Josh, making it mandatory for these services to function only when the associated SIM card is inserted and active in the device, reported PTI.

In its November 28 order, the department noted that several communication apps that use mobile numbers for user identification or service delivery still allow their platforms to operate even when the linked SIM is not present on the device.

According to the DoT, this capability is creating telecom cybersecurity risks and is being exploited from outside India for committing cyber-frauds.

The DoT asserted it has become necessary to issue directions to providers of app-based communication services to prevent the misuse of telecommunication identifiers and to "safeguard the integrity and security of the telecom ecosystem".

"The Department of Telecommunications, in exercise of the powers conferred upon it under the Rules, hereby directs TIUEs (Telecommunication Identifier User Entity) providing App Based Communication Services utilising mobile number for identification of customers/users or for provisioning or delivery of services in India, to...from 90 days of issue of these instructions, ensure that the App based Communication Services is continuously linked to the SIM card (associated with Mobile Number used for identification of customers/users or for provisioning or delivery of services) installed in the device, making it impossible to use the app without that specific, active SIM," the directive said.

Within 90 days, any web version of the app must automatically log users out at least once every six hours. Users can then sign in again by re-linking the device using a QR code.

"From 90 days of issue of these instructions, ensure that the web service instance of the Mobile App, if provided, shall be logged out periodically (not later than 6 hours) and allow the facility to the user to re-link the device using QR code," it added.

The directions come into force immediately and will remain in force until amended or withdrawn by the DoT, it added.