The Indian government has extended the compliance timeline for mandatory SIM binding on messaging platforms, giving services such as WhatsApp, Telegram, Signal and Arattai additional time to implement the requirement. The Department of Telecommunications (DoT) has set December 31, 2026, as the compliance deadline. The extension follows concerns from technology companies about technical challenges involving app development, device compatibility and operating system updates. The measure is designed to strengthen telecom cybersecurity by keeping messaging accounts linked to their registered, active SIM cards.
Under the directive, covered messaging services must remain connected to the specific SIM associated with a user’s registered Indian mobile number. This means an app should not continue operating on a device without the required active SIM being present. The government has also revised its approach to web and linked-device sessions: rather than enforcing a universal six-hour logout, platforms are expected to use risk-based analysis to determine when sessions should end. The deadline gives companies time to implement these requirements, but it does not mean users need to wait until January to see app updates.
Key Takeaways
- Compliance deadline: Messaging platforms have until December 31, 2026, to comply with the SIM-binding directive.
- Apps covered: WhatsApp, Telegram, Signal, Arattai and other covered communication services using Indian mobile numbers.
- Active SIM requirement: The registered SIM must remain present and active in the device using the messaging service.
- Cybersecurity objective: The government aims to reduce misuse of Indian mobile numbers in scams and digital fraud.
- Web sessions: Risk-based logout replaces the earlier fixed six-hour logout approach.
- Implementation challenges: Companies have raised concerns about technical testing, operating system compatibility and user experience.
- Users should prepare: People using linked devices or travelling with Indian SIMs should monitor official app updates and guidance.
What Is the SIM-Binding Rule?
SIM binding is a security requirement that connects a messaging account to the physical SIM card associated with its registered mobile number.
Ordinarily, many messaging apps verify a phone number through a one-time password or another authentication process. Once verification is complete, an account can often continue working even if the original SIM is removed from the device.
The DoT’s directive seeks to close that gap. Under the requirement, covered communication apps must remain continuously linked to the registered SIM installed in the device.
The government issued the original directions to selected app-based communication service providers on November 28, 2025, under its telecom cybersecurity framework. The initial compliance period was shorter, but implementation difficulties led to a revised timeline.
The requirement is aimed at making it harder for fraudsters to continue operating accounts linked to Indian numbers after the associated SIM has been removed, deactivated or moved elsewhere.
Which Messaging Apps Will Be Affected?
The directive covers selected app-based communication services that use Indian mobile numbers to identify users or provide their services.
| Messaging platform | Potential impact |
|---|---|
| Registered SIM must remain present and active in the device using the service | |
| Telegram | Must implement applicable SIM-binding requirements |
| Signal | Must implement applicable SIM-binding requirements |
| Arattai | Must implement applicable SIM-binding requirements |
| Snapchat and other covered services | Requirements depend on the scope of the DoT directive |
Source: Department of Telecommunications directions, as reported by Business Standard and other media outlets.
The directive does not mean all messaging apps will necessarily introduce identical user interfaces or verification procedures. Companies may use different technical methods to meet the same requirement, subject to the government’s directions.
Users should rely on official app announcements for instructions about updates, compatibility or additional verification.
Why Has the Government Extended the Deadline?
Technology companies have reported difficulties implementing SIM binding across different devices and operating systems.
Messaging platforms must ensure that the registered SIM is present without unnecessarily disrupting legitimate users. This is particularly challenging when accounts are used across multiple devices, including smartphones, tablets, desktop applications and web browsers.
The government acknowledged implementation challenges involving testing and operating system updates when the revised timeline was reported in April 2026.
The extension gives companies more time to develop, test and roll out compliant systems. A phased implementation may be needed to accommodate differences between Android and iOS devices and between mobile apps and companion-device sessions.
The revised deadline should therefore be understood as additional compliance time for platforms, rather than an exemption from the requirement.
What Changes for WhatsApp Web and Linked Devices?
The original SIM-binding directions also included a requirement for companion-device and web sessions to be logged out periodically, with a maximum interval of six hours.
That fixed interval was subsequently replaced with a risk-based approach. Under the revised arrangement, platforms determine when logout is required based on risk analysis rather than following a universal six-hour schedule.
This matters for people who use WhatsApp Web or desktop messaging applications throughout the working day. Users may need to reauthenticate or relink a device if the platform determines that a session should end.
However, the revised approach does not mean linked-device sessions will remain active indefinitely. Platforms still need to meet the applicable requirements, and the precise frequency of logout may vary according to their implementation.
Businesses that depend on messaging platforms for customer support, sales and internal communication should monitor official guidance to avoid unexpected disruptions.
How Could SIM Binding Affect Ordinary Users?
For most users, the practical impact will depend on whether the SIM associated with their messaging account remains in the device they use.
| User situation | What to consider |
|---|---|
| Registered SIM remains in the phone | The requirement is designed around this setup |
| SIM is removed or deactivated | The messaging app may no longer work as expected on that device |
| User relies on a laptop or web session | Reauthentication or session logout may be required |
| User travels internationally | Keep track of the registered SIM and official platform guidance |
| User changes phones | Follow the app’s official account-transfer and verification process |
| Business uses messaging for customer support | Review linked-device access and continuity arrangements |
The rules may create additional steps for people who use one SIM to register an account but rely on another device for daily messaging. Travellers and businesses with complex device arrangements should pay particular attention to how their chosen platform implements the requirement.
The directive does not automatically mean users will lose their chat histories or be required to create new accounts. Specific consequences will depend on the app’s implementation and its existing account-transfer procedures.
How SIM Binding Could Help Prevent Digital Fraud
The government says SIM binding is intended to improve traceability and reduce misuse of telecom identifiers.
Fraudsters can exploit messaging accounts associated with Indian mobile numbers to conduct phishing, impersonation and other scams. If an account continues to function after its registered SIM has been removed or deactivated, tracing the connection between the account and the original mobile number may become more difficult.
By requiring an active link to the registered SIM, the government aims to make such misuse harder and strengthen the connection between a communication account and a verified telecom identity.
The policy is part of a wider cybersecurity effort. However, SIM binding alone cannot prevent every scam. Criminals may still attempt fraud using legitimate accounts, compromised devices, social engineering or other methods. Users must continue to verify identities, avoid suspicious links and protect authentication codes.
Industry Concerns and User Experience
The policy has attracted concerns from technology companies and industry groups about implementation, legal authority and possible disruption.
The Broadband India Forum, which represents major technology companies, questioned the legal basis and practical implications of the mandate. Industry participants have also highlighted the complexity of enforcing continuous SIM binding across devices and operating systems.
A separate concern involves shared devices and family use. Some people use messaging apps on phones where the registered SIM belongs to another household member. Others rely on a laptop or tablet because they cannot regularly access their primary phone.
The challenge for platforms is to comply with the directive while keeping authentication reliable and avoiding unnecessary interruptions for legitimate users.
The extended timeline gives companies more time to address these issues, but the final experience will depend on the solutions they deploy and how consistently the requirements are applied.
The Bigger Picture
The SIM-binding mandate reflects the government’s effort to strengthen digital security by linking messaging accounts more closely to verified mobile identities. Extending the compliance timeline to December 31, 2026, gives platforms additional time to address technical issues while keeping the underlying requirement in place. The move also shows the difficulty of applying security rules to communication services used across smartphones, computers and multiple operating systems.
For users, the most important point is that the rule concerns the presence of the registered active SIM, not simply whether the account was verified in the past. Web and linked-device sessions may also be subject to risk-based logout. As implementation approaches, clear communication from WhatsApp, Telegram and other platforms will be essential to helping individuals and businesses prepare without unnecessary disruption.
FAQs
1. What is the new SIM-binding deadline in India?
The reported compliance deadline for covered messaging platforms is December 31, 2026. References to January 1, 2027, generally describe the point after that deadline has passed, rather than a separately confirmed extension to a new date.
2. Which apps are affected by SIM binding?
The directive covers selected messaging and communication services, including WhatsApp, Telegram, Signal, Arattai and other specified platforms that use Indian mobile numbers for user identification.
3. Will WhatsApp stop working if the registered SIM is removed?
Under the directive, covered services must remain linked to the registered active SIM in the device. Removing the SIM may therefore prevent the app from operating as expected, depending on the platform’s implementation.
4. Will WhatsApp Web log out every six hours?
The earlier fixed six-hour logout requirement was replaced with a risk-based approach. Platforms are expected to determine when sessions should end based on risk rather than a universal six-hour interval.
5. Is SIM binding intended to prevent online scams?
Yes. The government says the measure is intended to reduce misuse of telecom identifiers and improve traceability. It cannot eliminate all scams, so users should continue to verify suspicious messages and protect their authentication codes.
Looking Ahead
Messaging platforms will need to use the remaining compliance period to test their SIM-binding systems, address operating system constraints and communicate changes to users. Businesses that depend on linked devices should review their workflows and ensure that important communication channels have appropriate continuity arrangements. Official app updates will be the best source of instructions for individual users.
The longer-term impact will depend on whether SIM binding improves fraud traceability without creating excessive disruption for legitimate users. The government has retained the cybersecurity objective while giving platforms more time to implement the requirements. As the December 31 deadline approaches, the balance between security, usability and technical feasibility will remain central to the rollout.
Get the day’s top stories in your inbox
One concise email. No spam, unsubscribe anytime.
