WhatsApp usernames are a net privacy gain; experts say government is overreacting

Technology policy experts have backed WhatsApp's proposed username feature, arguing that it strengthens user privacy while questioning the Centre's move to ask the messaging platform to pause its rollout over cybercrime concerns.

Speaking to CNBC-TV18, Nikhil Pahwa, Founder of MediaNama, and Mishi Choudhary, Tech Lawyer and Founder of SFLC, said the feature offers meaningful privacy benefits by allowing users to communicate without exposing their mobile numbers. They also argued that the government's concerns over impersonation and fraud are not unique to usernames and should not become grounds for regulatory intervention.

The comments come after the Indian government issued a notice to WhatsApp, directing the company to explain why action should not be initiated under the IT Act over the feature, which it believes could increase cybercrime. The Centre has also asked the company to put the rollout on hold until consultations are completed.

Usernames improve privacy, experts say

Pahwa said the feature addresses a long-standing privacy concern, particularly for users whose phone numbers become visible in group chats.

"It's an important privacy feature because quite often we are in groups, and especially women are in groups where their mobile numbers get exposed," he said.

He noted that similar username-based systems already exist on platforms such as Signal and Telegram, although he criticised Telegram's implementation for allowing users to be discovered without adequate consent.

According to Pahwa, WhatsApp has added further safeguards by requiring a username key or PIN before new users can establish contact, making the overall implementation stronger from a privacy perspective.

Choudhary echoed the view, calling the feature "a net privacy gain" because it reduces reliance on phone numbers, which have become a primary identifier for banking, government services and financial accounts.

"The username itself is a net privacy gain because it reduces the need to share phone numbers, which expose us to SIM swap attacks, phishing and account takeovers," she said.

Fraud risks already exist

While acknowledging concerns around impersonation and scams, both experts argued that usernames do not create a fundamentally new problem.

Pahwa said scammers have long impersonated business leaders by using publicly available profile photographs and fake numbers to solicit money from employees.

"So, I don't think this is a new problem. I don't think this creates new problems, as far as my understanding goes," he said.

He suggested WhatsApp could strengthen protections against similar usernames but added that distinguishing between users with common names would remain a practical challenge.

Choudhary said scams remain widespread across digital platforms irrespective of whether phone numbers or usernames are used.

"I don't discount that there aren't concerns. Scams, financial or otherwise, are rampant in India, and those exist irrespective of the platform we are using," she said.

Traceability concerns misplaced

Responding to concerns raised by law enforcement agencies over traceability, Pahwa said every WhatsApp account would still require a mobile number for registration.

"This traceability issue that the government is raising is basically out of ignorance because you cannot get a WhatsApp username without using a mobile number to register your account. So, traceability exists. It's just that it is not publicly available," he said.

He also pointed out that WhatsApp already operates verified business accounts and said the company should do more to educate users to trust only verified accounts while continuing to improve anti-spam measures.

Government should not approve product features

Both experts criticised the government's approach, arguing that requiring companies to seek approval before introducing new features would undermine ease of doing business.

Choudhary said there was no legal basis for requiring technology companies to obtain government clearance before rolling out product updates.

"For the government to say now that for each feature any company needs to get permission from it or have a discussion about it destroys the claim of ease of doing business," she said.

She added that while WhatsApp should provide greater transparency around safeguards, verification processes and data-sharing practices, the executive should not dictate platform design choices.

"This approach of saying, 'Please get permission from the government,' starts a slippery slope of the executive deciding what design features a business can or cannot introduce," Choudhary said.

Calls for stronger safeguards instead of a pause

Rather than halting the rollout, the experts said WhatsApp should focus on strengthening spam controls, verification systems and user awareness.

Pahwa said the platform should give users greater control over who can message them through usernames, similar to existing privacy controls for phone numbers. He also called for improvements to curb unsolicited messages and abuse by business accounts.

Choudhary said users ultimately have alternatives if platforms fail to adequately protect them, citing Signal as an example of a service offering stronger privacy protections.

What triggered the government's notice?

The Centre's notice argues that WhatsApp's username feature could facilitate online fraud, phishing, identity spoofing and so-called digital arrest scams by allowing users to connect without sharing phone numbers.

The government has given WhatsApp three days to respond and has asked it to pause the rollout until consultations are completed.

WhatsApp has said the feature is not yet live and will be introduced later this year. The company said usernames of public figures and government entities have already been reserved to prevent impersonation and can only be claimed by their legitimate owners.

It also said it would introduce safeguards including limits on how many new users an account can contact, protections against repeated attempts to guess username keys, and systems to detect and remove impersonation and abuse.

Under the proposed feature, users will need to know the exact username of another person to initiate contact, with no public directory or search suggestions available.