India just gave WhatsApp a three-day ultimatum: respond to a July 1 letter and pause its usernames rollout while the government decides whether it poses a security threat. The request comes because WhatsApp announced on June 29 that it would let users reserve usernames, which could replace phone numbers for messaging later this year. MeitY, the Ministry of Electronics and Information Technology, says that change could enable more impersonation and cybercrime, and it explicitly asked Meta to stop the rollout until MeitY has approval.

The stake is not theoretical. MeitY’s July 1 letter warns that allowing first contact without showing a phone number “may increase cybercrimes,” including phishing and digital arrest scams. It is particularly focused on attackers impersonating public authorities, financial institutions, or government departments. MeitY is grounding its concerns in India’s Information Technology Act 2000 and Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules 2021, meaning this is not a casual request. For WhatsApp, whose platform is used by more than 3 billion users globally, the question is whether a product that improves privacy and reduces phone-number exposure can launch in India without becoming a regulatory flashpoint.

So what exactly is WhatsApp rolling out? The feature is simple in concept, but complicated in governance. WhatsApp says users can reserve usernames so that when usernames become available later in 2024, people can chat using usernames rather than having their personal phone numbers exposed. The Register reports that WhatsApp pitched the benefit as letting users contact classmates, neighbors, professionals, or a group chat for a child's sports team without broadcasting their number. That matters in a country like India, which WhatsApp claims is its largest market with more than 850 million users, because even small changes to discovery and identity can scale up fast.

WhatsApp also tries to pre-empt abuse with identity hygiene rules. It is not allowing users to create usernames that already exist on Facebook or Instagram, unless they themselves control those other accounts. It has already reserved high-profile usernames for legitimate organizations and individuals. And users will not be able to register lookalike derivatives, limiting the classic “near miss” strategy scammers use to confuse targets.

On scams, WhatsApp argues it already designed countermeasures into how usernames work. In response to The Register, a spokesperson said usernames are not yet live and will roll out slowly later this year. They also described what users will see when someone messages them for the first time via a username: whether the sender is a new account, a contact, shares groups in common, or is based in a different country. The idea is to give the recipient context before they decide to engage, which is exactly what phishing campaigns try to remove.

The spokesperson also outlined specific safeguards that aim to stop impersonation and guessing. They said WhatsApp still requires a phone number to use the service, and that other users need to know the exact username to message you. WhatsApp claims it will limit how many new people an account can contact, block repeated attempts to guess someone’s username key, and use systems to detect and remove activity showing common impersonation and abuse patterns. In other words: MeitY fears “opportunities for impersonation,” while WhatsApp is arguing the architecture closes those opportunities before they become operational.

But the bigger story here is how India’s regulator is using time pressure and legal framing. MeitY’s move is backed by statutory references to the Information Technology Act 2000 and the Intermediary Guidelines and Digital Media Ethics Code Rules 2021. And it arrives after criticism of a different MeitY attempt in March 2024, when the Internet Freedom Foundation said MeitY tried to block AI companies from rolling out models until the government had approved them. The IFF criticized that earlier step as overreach, saying it sought to build a licensing mechanism without a proper empowering provision in the IT Act, and that MeitY withdrew the notice and dropped the permission requirement within a fortnight. The IFF now calls the usernames action a repeat that goes further, naming a single company, setting a three-day clock, and barring launch until MeitY is satisfied.

WhatsApp says MeitY did not respond to The Register’s request for input. WhatsApp is also dealing with a broader environment where platforms under Indian scrutiny have faced abrupt consequences. The Register notes that India temporarily banned Telegram in June amid fears exam questions were being shared ahead of time. That ban came days before NEET-UG, which was later reworked and rescheduled after being canceled in May when genuine questions were found circulating on Telegram. The pattern is clear even without inventing motives: when regulators decide a platform feature can materially affect public outcomes or public safety, timelines can get compressed and compliance expectations can change quickly.

For executives at messaging platforms, social networks, and any identity-driven product, this is the uncomfortable signal: privacy improvements can still be treated as security threats if regulators believe scammers gain new routes to impersonation. And for boards and investors, the operational reality is just as important as the compliance theory. A three-day pause is not just a PR headache. It can disrupt rollout schedules, strain engineering and legal alignment, and force product teams to prove safety mechanisms faster than they normally would. In India, where WhatsApp’s scale is enormous, the cost of being too slow to adapt is measured in weeks of lost momentum, while the cost of shipping too fast is measured in regulatory consequences.