Govt seeks Meta's response on WhatsApp usernames feature, halts further rollout: Sources

The government has directed Meta to explain WhatsApp's upcoming usernames feature within three days and pause its rollout in India until then, according to sources. Authorities are planning a detailed assessment of the feature's potential implications and are seeking clarity on the security safeguards Meta intends to implement before allowing it to be introduced.

The Centre has sought a comprehensive explanation of the feature, which would allow WhatsApp users to create unique usernames and connect with others without sharing their phone numbers. The feature is yet to be rolled out publicly.

WhatsApp had earlier announced that users would soon be able to reserve their usernames ahead of a broader rollout. The process of allowing users to choose between usernames would possibly be delayed amid the stringent actions taken by the authorities.

More from Tech

In its communication to Meta, the government expressed concerns that the proposed usernames feature could significantly increase cybercrime by allowing users to connect without sharing phone numbers. The notice further stated:

"...It is felt that the feature may materially increase the incidence of online fraud, phishing, digital arrest scams and impersonation attacks, by enabling bad actors to solicit and message victims."

The government also flagged the possibility that the feature could make it easier for malicious actors to impersonate trusted entities through deceptive usernames.

"Furthermore, this feature may facilitate impersonation and identity spoofing, including impersonation of individuals, public authorities, financial institutions, and government agencies, by permitting the adoption of usernames closely resembling those of genuine persons or institutions."

Citing these concerns, the authorities asked Meta to explain why regulatory action should not be initiated under India's information technology laws.

"Accordingly you are directed to explain why regulatory action ought not to be initiated under the Information Technology Act, 2000 ("IT Act"), the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 ("IT Rules, 2021") and other laws as may be applicable for launching a feature that may increase cybercrimes."

The notice further directed the company to submit a detailed response within three days and refrain from launching the feature until the government completes its review.

The government's increased scrutiny is aimed at evaluating the feature's implications for user identification, privacy and platform safety. Officials are assessing the potential risks associated with username-based communication, including the possibility of misuse, before deciding whether to allow the feature's launch.

Responding to the government's concerns, whatsApp's spokeperson said the usernames feature has not yet been rolled out and that users currently only have the option to reserve their preferred usernames ahead of a phased launch later this year.

"We've announced the option for people to reserve their preferred username on WhatsApp. The ability to use a username is not yet live and will roll out slowly later this year."

The company said it has introduced measures to prevent impersonation, including reserving high-profile usernames so they cannot be claimed by unauthorized users.

"To protect against impersonation, we've held the highest-profile names — think public figures, government entities, celebrities, verified Meta accounts — so they can only ever be claimed by their legitimate owners and lookalike derivatives of known names are held as well."

Meta also stressed that the feature will not replace WhatsApp's existing account system, noting that users will still need a phone number to access the platform. It added that multiple safeguards have been built into the feature to curb abuse and scams.

"Users still require a phone number to use WhatsApp and we've built multiple layers of defense against scams into usernames: Other users need to know the exact username to message you, we will limit how many new people an account can contact, block repeated attempts to guess someone's username key, and have systems to detect and remove activity showing common impersonation and abuse patterns."

The company further said users will receive additional context when they are contacted by someone via a username for the first time, helping them determine whether the interaction is legitimate.

"When the feature becomes available and someone sends you a message for the first time via your username, we will show you if they're a new account, if they're your contact, if you have groups in common, and if they're based in a different country, so you can decide whether to respond."

Priavcy benefits from the new feature

Reports suggest, availability of usernames can enhance user privacy by allowing people to connect without sharing their phone numbers, reducing risks such as SIM-swapping attacks and contact scraping. However, they also caution that the feature could create new security challenges, including identity impersonation and verification issues. Similar-looking usernames, they warn, could be exploited by scammers to impersonate brands, banks, government agencies and public figures.

The government's scrutiny comes amid a rise in digital fraud and online scams in India, with authorities seeking to ensure that new platform features strengthen user privacy without compromising security, traceability and accountability.