It took India four days to stop the biggest messaging app on Earth.On Monday, WhatsApp opened reservations for its new usernames — the feature that will let three billion people chat while their phone number stays private. By Wednesday, a formal notice from the Ministry of Electronics and Information Technology was sitting with WhatsApp's compliance chief in India, and it carried two blunt directions. Explain this feature, in detail and with documents, within three days. And keep it switched off in India until the government says it is satisfied.A copy of the notice, reviewed by Gadgets Now, shows a document that reads politely and lands hard. It runs through the feature's mechanics with evident homework, lists the harms the ministry expects, stacks six legal provisions against the company, and closes with a reminder that every other weapon in the government's arsenal stays available. Agency copy on Wednesday evening carried the two directions; WION named MeitY as the ministry behind them. Meta has yet to file a public response, and reports say WhatsApp has already paused the feature for India.The letter also lands on a desk that changed hands nine days earlier. Kunal Shah — the CRED founder Meta named WhatsApp's global head on 22 June, succeeding Will Cathcart after a near-seven-year run — was recruited, by the company's own telling, for his feel for how the app lives in markets like India. The first crisis of his tenure now arrives from the market he was hired to understand.The stakes need little dressing. India is WhatsApp's largest market, home to roughly 500 million of its users, and the country has just converted Tuesday's murmurs of "examining" into a written veto. What follows is what the notice actually says, why its quietest phrase is its most powerful, and how a fight over a username became the newest front in a war that started in a courtroom five years ago.Key TakeawaysThe Ministry of Electronics and Information Technology served a formal notice on WhatsApp's Chief Compliance Officer in India on Wednesday, 1 July, over the new username feature.The notice carries two directions: furnish a detailed, documented explanation within three days, and hold the India rollout until consultations satisfy the government.It lands nine days into Kunal Shah's tenure as WhatsApp's global head — the first regulatory fire for the CRED founder Meta hired for his grounding in this exact market.It warns the feature "may materially increase" online fraud, phishing, digital arrest scams and impersonation attacks, and cites six provisions of the IT Act and IT Rules, 2021.Policy experts at think tanks associated with Meta in India conceded to Gadgets Now, off the record, that the feature was bound to collide with the government — and that Meta was warned after announcing it.The sharpest threat is to safe harbour — the legal shield that spares platforms liability for what users send — which the notice treats as conditional on WhatsApp's conduct here.One citation, Rule 4 on tracing a message's "first originator," drags the username dispute into the traceability war WhatsApp has fought in the Delhi High Court since 2021.WhatsApp has paused the feature for India, per reports, and Meta has yet to file a public response.What Exactly Has India Ordered WhatsApp To Do?The document is what lawyers call a show-cause notice — in plain terms, an official "explain yourself" letter that precedes punishment. The recipient must show why action should be spared, and the burden of persuasion sits with them, rather than with the state.This one is addressed to the Chief Compliance Officer, WhatsApp LLC (Meta), India Operations, and its subject line is dry as paper: the roll-out of the "usernames" feature on the WhatsApp platform in India. The ministry records that it "has taken note of public announcements by WhatsApp" of a phased global rollout, including in India. It then describes the feature with striking accuracy — that users can reserve unique handles, that full activation will let people converse "by exchanging usernames alone," and that a recipient's phone number stays hidden from a first-time contact. The notice even names the optional "username key," the PIN-style second lock WhatsApp built as an extra control.That last detail matters more than it first appears. The government has read the fine print. Its objection arrives with the safeguards already priced in.Then come the directions. Paragraph four orders WhatsApp "to furnish a detailed explanation, supported by relevant documents, on this new feature, within three days of its receipt." Paragraph five is the freeze, and it deserves quoting in full: "You are also directed not to roll out this feature until the consultation on this point is achieved to the satisfaction of the Government." And paragraph six closes the exits, recording that the notice issues with the approval of the Competent Authority and "without prejudice to any other action that may be taken by the Government or LEAs under any law for the time being in force." Translated from officialese: comply with this, and everything else stays on the table anyway.Fraud, Phishing And Digital Arrests: The Government's CaseThe heart of the notice is a paragraph of anticipated harm. The feature, it says, "may materially increase the incidence of online fraud, phishing, digital arrest scams and impersonation attacks, by enabling bad actors to solicit and message victims."Each item on that list has a face in India. Digital arrest is the scam that has terrorised Indian households for two years — fraudsters pose as police or central agencies on a video call, invent a case against the victim, and extort payments dressed up as fines or bail. Phishing and impersonation run through the same playbook: the con works because the target believes the person on the other end is someone official. The notice's second charge goes straight at that mechanism, warning the feature "may facilitate impersonation and identity spoofing, including impersonation of individuals, public authorities, financial institutions, and government agencies, by permitting the adoption of usernames closely resembling those of genuine persons or institutions."The document turns into formal charges what officials had spent two days saying anonymously. A DoT official had already sketched the nightmare for reporters — a fraudster on a +1 American number, wearing the NIA chief's photograph and a lookalike handle, dialling victims from beyond the reach of a +91 trace. Paytm founder Vijay Shekhar Sharma had warned on X that every verified username would soon be shadowed by convincing fakes. Entrepreneur Ankur Warikoo had called the feature a potential "disaster" for a country this drenched in digital fraud. The notice gathers those fears, strips the anonymity, and gives them a letterhead.Read the operative verb, though, and something unusual surfaces. The case rests on "may." The feature stands accused of what it could enable rather than what it has done — it has yet to go live for a single Indian user. India is moving against a hypothesis, and asking Meta to disprove it on a 72-hour clock.The hypothesis, it emerges, was alive inside Meta's own policy orbit too. Policy experts and figures at think tanks associated with Meta in India declined to comment on the record — but, off the record, they conceded to Gadgets Now that the usernames feature was bound to land the service in hot water with the government, and that Meta had been warned about it in the wake of the announcement.Why Safe Harbour Is The Real ThreatThe scariest word in the notice, for Meta's lawyers, appears nowhere in it. The word is liability, and the document circles it with six citations.Start with the shield. Section 79 of the IT Act is the provision that makes the modern internet workable in India: it spares an intermediary — a platform carrying other people's messages — from legal responsibility for what those people send. A scammer's message is the scammer's crime, and the pipe stays innocent. But the shield is conditional. Section 79 protects a platform only while it observes "due diligence" under the IT Rules, 2021. Drop the diligence, and every fraud flowing through the pipe becomes, potentially, the pipe's problem too.The notice walks straight down that path. It first pins WhatsApp's status: an "intermediary" and a "significant social media intermediary" under the Act and the Rules — the heavy-compliance tier reserved for platforms above 50 lakh registered users, a threshold WhatsApp clears many times over — and declares it "squarely subject to the due-diligence and other obligations" that follow. Then it lists where those obligations bite. Rule 3(1)(b) requires platforms to inform users of, and "cause them not to host, display or share," information that is "impersonating another person" or that "deceives or misleads the addressee about the origin of a message." The government's implied reading is aggressive: a feature that hides the sender's number, it suggests, sits uncomfortably close to a design that misleads recipients about origin. Rule 3(2) adds the grievance machinery every platform must run. Rule 4 layers on the special burdens of the biggest platforms — including one this story will return to.Then the criminal law. Sections 66C and 66D of the IT Act punish identity theft and "cheating by personation" through a computer or communication device — each carrying up to three years in prison along with a fine. Those provisions punish the fraudster. The notice's sting is the clause it pairs them with: Section 79(3)(a), under which an intermediary loses its shield where it has been "aiding, abetting or inducing the commission of an unlawful act." Assemble the pieces and the theory of the case emerges. If usernames make impersonation easier, and impersonation is a crime, then launching usernames could be read as inducement — and the shield falls.That is a genuinely aggressive construction, and lawyers will fight over every joint in it. Safe harbour doctrine has generally attached liability to a platform's response to specific unlawful content, rather than to the architecture of a feature. Stretching "inducement" to cover product design would be new ground. But a show-cause notice needs a theory rather than a verdict, and this one has put its theory in writing.Three Days, One Compliance OfficerTwo choices inside the document reveal how the ministry wants this contest to feel, and both were made before a single legal argument.The first is the addressee. The notice went to the Chief Compliance Officer — a post that exists because the IT Rules, 2021 demanded one. Every significant social media intermediary must appoint a senior India-based officer who answers for the platform's diligence, and who can carry liability in proceedings when that diligence fails. The 2021 rules built the office as a pressure point; Wednesday's notice pressed it. The letter lands on the desk of the one person whose job description is to absorb exactly this letter.The second is the clock, and here the document starts to resemble an examination. Three days to submit a detailed explanation, "supported by relevant documents" — WhatsApp must show its working, with annexures attached. The marking scheme stays private. The pass mark appears in a single phrase, and it is the most consequential line in the notice: the rollout stays frozen until consultation is achieved "to the satisfaction of the Government." Satisfaction stays undefined — the notice skips a benchmark, a timetable and any route of appeal. The examiner grades alone, sets the syllabus after the paper is written, and decides when the exam ends. WhatsApp can submit the most thorough answer sheet in the company's history and still be told to sit the paper again.The contrast with India's last messaging intervention is instructive. The SIM-binding mandate of November 2025 arrived with consultation windows and was softened in places after industry pushback. This clock runs 72 hours. Whatever else the notice communicates, tempo is part of the message.A Red Light Only The Government Can SwitchStrip away the citations and paragraph five does something simple: it parks a global feature at the Indian border. Usernames can cruise through every other market on WhatsApp's own schedule. At the Indian crossing, the signal has turned red, and the switch for that signal sits inside a ministry in New Delhi.The immediate, practical effect is smaller than the headline suggests. India sat outside the feature's first rollout wave; third-party trackers list a phased sequence beginning with a handful of smaller markets in July and widening from September, and WhatsApp itself committed only to a gradual spread "later this year." The government has closed a road the traffic had yet to reach. Reports since the notice say WhatsApp has paused the feature for India — the light is being obeyed while the paperwork moves.The legal effect is much larger. On Tuesday, the government's posture was "examining," a word with room in it. By Wednesday evening the posture was a written direction with an open-ended hold, the state as sole judge of when it lifts, and a company on a three-day answer clock. India has blocked whole apps before — 14 encrypted messengers went dark in Jammu and Kashmir in 2023 — but freezing a single feature inside the world's biggest messaging app, before launch, on anticipated harm, is a finer instrument than anything in that record. The precedent will outlast this dispute: any platform shipping a global feature now knows India may demand a country-specific red light, held down for as long as consultation takes.How WhatsApp's Defence Lines Up Against The AllegationsMeta's answer sheet, as it happens, is already largely written. Pressed on the fraud fears earlier this week, a WhatsApp spokesperson laid out the feature's defences in detail — and several of them speak directly to lines in the notice.On the lookalike fear, the company said it has held the highest-profile names — public figures, government entities, celebrities, verified Meta accounts — so they can only ever be claimed by their legitimate owners, adding that "lookalike derivatives of known names are held as well." On accountability, the spokesperson reconfirmed that "users still require a phone number to use WhatsApp," meaning every account keeps a number bound to it for registration, recovery and lawful requests even while the handle hides it from strangers. Around that sit the mechanical locks: an exact username is needed to reach anyone, handles stay outside search and directories, accounts face caps on how many new people they can contact, repeated attempts to guess a username key are blocked, and detection systems watch for impersonation patterns. And when a first message arrives via username, the app will show whether the sender is a new account, an existing contact, a member of shared groups — and whether they are "based in a different country," the flag aimed squarely at the foreign-number fraudster of the DoT official's nightmare.Set the two documents side by side and the argument sharpens.The notice's fearWhatsApp's stated answerUsernames "closely resembling" officials, banks and agenciesHighest-profile names and their lookalike derivatives held for legitimate ownersBad actors soliciting and messaging victims at scaleCaps on how many new people an account can contactStrangers reaching users at willExact username required; handles stay outside search and directoriesGuessing attacks on identitiesRepeated attempts to guess a username key are blockedAccountability fading once numbers hideA phone number stays mandatory for every account, on file with MetaCross-border fraudsters posing as Indian officialsFirst message flags a new account and a sender based in a different countryThe table also exposes the gap between the two sides' currencies. WhatsApp's answers are mechanisms — locks, caps, flags. The notice's demand is assurance, judged by the government at its own discretion. A mechanism can be demonstrated; satisfaction has to be granted. That asymmetry is why some of India's sharpest tech lawyers read the whole episode as smaller than its drama. Dhruv Garg, the technology-policy lawyer, had already deflated the feature as "just adding another layer over a phone number," with real value for harassed users, women above all. Apar Gupta of the Internet Freedom Foundation attacked from the opposite flank, calling the privacy gains limited and noting the feature still feeds Meta's own cross-app profiling. Between them sits the awkward truth for the ministry: the feature it froze keeps the phone number — the state's actual handle on every account — exactly where it has always been.An Old War, Reopened By A Single CitationBuried in the notice's third paragraph, between the due-diligence rules and the criminal provisions, sits a citation that gives the game away. Rule 4 — the special obligations of the biggest platforms — is invoked "including enabling identification of the first originator where lawfully required."First originator. Anyone who has followed India's platform wars will feel the temperature drop at those two words. Rule 4(2) of the IT Rules, 2021 requires a significant social media messaging service to be able to identify, on a lawful order, the first person who sent a given message. WhatsApp's answer, from the day the rule appeared, has been that compliance would force it to break end-to-end encryption — the scrambling that keeps a message readable only to sender and recipient — and it sued in the Delhi High Court in May 2021 to say so. That case, argued on the rights to privacy and free speech under Articles 19 and 21 and resting on the Supreme Court's Puttaswamy privacy judgment of 2017, stays live to this day. The then IT minister Ravi Shankar Prasad insisted at the time that the encryption debate was misplaced and that the government "does not wish to track all messages"; five years on, the two sides still occupy the same trenches.By citing Rule 4 in a notice about usernames, the ministry has stitched the new dispute to the old one. The message inside the message: your obligations on traceability stand, and this feature will be examined in their light. Seen from that angle, Wednesday's notice is the IT-ministry wing of a doctrine New Delhi has been building across departments. The Department of Telecommunications spent late 2025 hardening the phone number as the anchor of digital identity — reclassifying chat apps as quasi-telecom entities and binding them to the SIM in the device. MeitY has now moved on its own statute to freeze the feature that hides the same number from view. Two ministries, two laws, one philosophy: the number is the state's grip on the network, and anything loosening that grip answers to the state first.WhenWhat happenedFeb 2021IT Rules require large platforms to trace a message's "first originator" on court orderMay 2021WhatsApp sues in the Delhi High Court over traceability; the case stays liveMay 2023India bans 14 encrypted messaging apps in Jammu and KashmirNov 2025DoT reclassifies chat apps as quasi-telecom entities and orders SIM binding29 Jun 2026WhatsApp opens username reservations worldwide1 Jul 2026MeitY serves notice: explain within three days, hold the India rollout2 Jul 2026WhatsApp pauses the feature for India; Meta yet to reply in publicWhich Way Does Meta Move Now?Three paths leave the room the notice has built, and Meta has walked versions of each before.The first is concession by customisation: an India-specific build. Keep numbers visible to first contacts in India, add verification layers the ministry can point to, push the Indian launch deep into 2027, or gate usernames behind stricter checks here than anywhere else. Meta has form — when the SIM-binding mandate landed, the company engaged, negotiated and adapted rather than threatening exit. India-only product surgery is the cost of a 500-million-user market, and both sides know it.The second is contest. The notice's inducement theory — that shipping a feature which eases impersonation strips safe harbour — is untested for product design, and a company already five years into constitutional litigation against this very ministry has both the lawyers and the appetite to test it. A courtroom fight would be slow, public, and would freeze the feature for years either way; it is the path of last resort, but the notice's aggressive legal construction almost invites it.The third, and likeliest, is the one the notice itself mandates: the consultation. For all its teeth, the document ends by demanding a conversation, and conversations are where Meta does its best regulatory work in India.And the executive leading WhatsApp into this one was built for the room. Shah founded Freecharge and CRED inside India's fintech rulebook and ranks among the country's most prolific angel investors; Meta's product chief Chris Cox, explaining the hire, said understanding how people use WhatsApp in markets like India "is almost like speaking a language." Meta recruited Shah to monetise WhatsApp through payments and commerce. His opening file instead asks him to defend a privacy feature to the government he knows best — with 72 hours on the clock.Expect the three-day reply to be voluminous, technical and conciliatory — the safeguards restated with annexures, the mandatory phone number placed at the centre, the country-flag on first messages offered as proof the company anticipated exactly the fraudster the government fears. Expect, too, that the reply will be judged against a standard the notice deliberately left undefined.Because the sharpest thing in this document sits in its quietest phrase. "To the satisfaction of the Government" arrives free of any test, deadline or benchmark; it is a door only one side can open, for a corridor only one side can measure. That converts a username into currency. The consultation now under way gives New Delhi a table at which to reprice the demand WhatsApp has refused since 2021 — traceability of the first originator — with a frozen feature as the visible cost of continued refusal. The feature on hold is four days old. The price being negotiated is five years old, and it has been waiting in a Delhi courtroom all along.FAQWhat has the Indian government ordered WhatsApp to do?A formal notice served on 1 July 2026 directs WhatsApp to furnish a detailed, documented explanation of the username feature within three days, and to hold its India rollout until consultation is achieved to the government's satisfaction. Reports say WhatsApp has paused the feature for India in response.Is the username feature banned in India?It is frozen rather than banned. The notice blocks the rollout pending consultation, and its closing paragraph keeps further action open under any applicable law. Username reservations opened globally on 29 June, but activation in India now waits on the government.What is a show-cause notice in simple terms?It is an official letter that says: explain why we should spare you punishment. The burden shifts to the recipient, who must respond within the stated window — here, three days — and persuade the authority against acting.Which laws does the notice cite?Section 79 of the IT Act (the conditional safe-harbour shield), Rules 3(1)(b), 3(2) and 4 of the IT Rules, 2021 (due diligence, grievance machinery and big-platform obligations including first-originator traceability), and Sections 66C and 66D of the IT Act (identity theft and cheating by personation), read with Section 79(3)(a) on aiding or inducing an unlawful act.What is safe harbour and why does it matter here?Safe harbour is the legal shield that spares a platform liability for what its users send, provided it observes due diligence. The notice's theory is that launching a feature which eases impersonation could count as inducement, stripping that shield — an aggressive and untested reading that would expose Meta to liability for user crimes.What safeguards has WhatsApp offered?A phone number stays mandatory for every account; high-profile names and their lookalike variants are held for legitimate owners; an exact username is needed to reach anyone; accounts face caps on new contacts; guessing attempts on username keys are blocked; and a first message shows whether the sender is a new account or based in a different country.What happens after the three days?Meta must file its explanation, after which consultation continues until the government declares itself satisfied — a standard the notice leaves undefined, on an open-ended clock. The freeze holds throughout, and the notice reserves every other legal option in the meantime.Who runs WhatsApp now, and why does that matter here?Kunal Shah, founder of the Indian fintech CRED, took charge as WhatsApp's global head on 22 June 2026, succeeding Will Cathcart after a near-seven-year run. The notice arrived nine days into his tenure, handing the first big test of his leadership to a market — and a regulatory system — he built his career inside.Is this connected to WhatsApp's 2021 encryption case?Directly. The notice cites Rule 4, the provision containing the first-originator traceability mandate that WhatsApp challenged in the Delhi High Court in May 2021 on privacy and free-speech grounds. That case stays live, and the citation signals the government views the username feature through the same traceability lens.end of article