"Could open up Pandora's box": International Commission on Cyber Security Law Chairman on WhatsApp's proposed username feature
New Delhi, July 2
Chairman of the International Commission on Cyber Security Law, Pawan Duggal, on Thursday warned that WhatsApp's proposed username feature can open a Pandora's box of privacy violations if it fails to strictly comply with India's stringent new data protection regime.
Speaking to ANI, Duggal said that WhatsApp must ensure that its username feature is compliant with the Information Technology Act 2000, the Digital Personal Data Protection Act 2023, and the DPDP Rules 2025.
"The concern of the government is very clear: it does not want Indians to be made guinea pigs in the laboratories of big tech companies. The Supreme Court in the case of Justice Puttaswamy has categorically held that your fundamental right to privacy is an integral part of the fundamental right to life. Now, once this kind of a feature is going to be used as username, this could open up a Pandora's box: it could potentially impact people's privacies; this username ultimately is nothing but a manifestation of personal data of data principles, hence WhatsApp has to make sure that its username offerings has to be compliant with not just the Information Technology Act 2000 but also with the Digital Personal Data Protection Act 2023 and the DPDP Rules 2025," he said.
He further added that WhatsApp's massive user footprint classifies it as a Significant Social Media Intermediary (SSMI) under Indian law. This classification strips the platform of blanket immunity and binds it to strict regulatory oversight.
Duggal highlighted that under Section 79 of the IT Act, WhatsApp is legally obligated to maintain rigorous statutory due diligence. This framework has grown even tighter following recent legislative updates.
"A company like WhatsApp is a significant social media intermediary under the Information Technology Act 2000. That being so, under section 79 of the IT Act, it is required to exercise due diligence while it discharges its obligations under the law. When you read this IT Act with the IT Rules 2021, which have been updated on 20th of February 2026, it's very clear that the government can give any directions or notification to the significant social media intermediary. And it shall be a part of the due diligence of the significant social media intermediary that it complies with those directions," he said.
The remarks came as the government asked Meta not to roll out the feature until satisfactory consultation.
Earlier on Wednesday, the government issued a notice to Meta over the proposed feature, stating that it may increase the incidence of online fraud, phishing, and digital arrest scams.
The Centre expressed concern, saying that the "usernames" feature may enable "impersonation and identity spoofing," and asked Meta to furnish a detailed explanation within three days.
Meanwhile, according to Meta, a username is an "optional unique identifier you can choose for your WhatsApp account". It starts with the @ symbol (for example, @Name123) and can be used by others to message or call a person, while keeping their phone number private. The username is different from the display name (the name that appears in your profile). The display name doesn't have to be unique, but the username does, according to the messaging platform.
— ANI
Reader Comments
I understand the privacy concerns, but can we also acknowledge that usernames could actually help people who want to keep their phone numbers private? As a freelancer who deals with clients online, I'd actually welcome this feature. The key is proper implementation and regulatory compliance - not just blanket rejection. 🤔
As someone who has elderly parents who are constantly getting scam calls, I'm terrified of what this could mean. My father got a fake "digital arrest" call last month that left him shaking. WhatsApp needs to think about India's ground realities - we have millions of first-time internet users. This feature in wrong hands is dangerous. 🚨
Look, I'm all for data protection, but sometimes our government overregulates things. WhatsApp is already encrypted, and username features exist on Telegram without major issues. Maybe instead of blocking everything, we should invest in better digital literacy and scam awareness? Just my two paise! 💭
I appreciate the government's caution, but I think this is a classic case of regulation stifling innovation. WhatsApp is just trying to give users more options. If implemented correctly with proper verification, usernames could reduce spam calls because people won't need to share their numbers publicly. Let's not be too quick to judge.⚖️
The comment about India's Supreme Court ruling on privacy is spot on. But here's my concern: while we debate usernames, WhatsApp is still sharing metadata with Facebook. Maybe focus on the bigger privacy violations first before worrying about a feature that could actually give users more control. Just thinking aloud... 🤷
We welcome thoughtful discussions from our readers. Please keep comments respectful and on-topic.