The Government of India’s reported decision to seek an explanation from Meta over WhatsApp’s proposed username feature is about far more than a messaging application. Should governments regulate digital technologies by focusing on the harms they create, or by scrutinising individual product features before they reach citizens?
The government’s concerns deserve to be taken seriously. India is witnessing an unprecedented rise in cyber fraud, identity theft and so-called digital arrest scams. Criminals are becoming increasingly sophisticated in exploiting technology to impersonate trusted institutions and manipulate unsuspecting citizens. Any responsible government has an obligation to anticipate emerging risks and ensure that technology platforms do not become unwitting enablers of organised crime.
Yet good intentions do not automatically translate into good regulation. Every regulatory intervention must ultimately be judged by a simple question: Does it solve the problem it seeks to address?
That question becomes particularly relevant in the present case.
Government officials have reportedly expressed concern that malicious actors may reserve usernames resembling public personalities, government institutions or prominent organisations, allowing them to impersonate trusted identities and deceive users. The concern is understandable.
Governments should regulate digital harms, accountability and platform obligations, not individual software features whose risks can already be addressed through existing law and better product safeguards. This is about the difference between regulating outcomes and regulating software architecture. The latter risks converting governments into arbiters of product design, an approach that no serious digital economy can sustain as technology evolves at extraordinary speed.
The first question policymakers should therefore ask is whether WhatsApp usernames fundamentally alter the ability of law enforcement to identify wrongdoers.
They do not.
A WhatsApp username is not an anonymous identity detached from its owner. It simply replaces the visible mobile number during user interactions. Every account continues to remain linked to an underlying mobile number obtained through established subscriber verification processes. Platforms retain account identifiers and records that remain available through legal requests.
What does change is something equally important to citizens.
Millions of Indians today routinely disclose their personal mobile numbers to complete strangers simply because digital communication leaves them with no alternative. Ironically, the proposed feature advances another public policy objective that India itself has increasingly embraced over the past decade: Better protection of personal information. Good digital policy should encourage privacy-enhancing technologies where they do not compromise public safety.
If official concerns remain, regulators can require platforms to adopt privacy-preserving defaults. Users could receive messages from username-based accounts only after explicit consent, much as spam filters transformed email without questioning the legitimacy of email itself.
The argument that messaging platforms now resemble public infrastructure also deserves careful examination. Email has arguably become one of the world’s most important pieces of digital public infrastructure. Every email address is, in essence, a username. Governments across the world have responded to phishing and impersonation not by questioning the existence of email addresses themselves, but by strengthening authentication, spam detection, domain verification and cybercrime enforcement. Messaging platforms deserve the same policy logic.
Had governments attempted to regulate email by questioning username-based identities themselves, one of the internet’s foundational technologies might never have evolved into the trusted communication infrastructure upon which governments, businesses and citizens now depend every day.
The possibility of impersonation is therefore neither new nor unique to WhatsApp. Fraudsters already impersonate public officials over telephone calls, banks through SMS messages, government agencies through counterfeit websites, businesses through spoofed email addresses and public figures across social media platforms. Criminals adapt rapidly to every communication medium available to them. The existence of impersonation has never justified questioning the architecture of the communication platform itself. It has instead justified stronger verification systems, more effective authentication, quicker takedown mechanisms and more capable cybercrime enforcement.
A more proportionate regulatory response would focus on platform responsibility rather than platform architecture. Platforms can disable unsolicited messages from unknown username-only accounts by default, provide enhanced verification for public institutions and prominent individuals, deploy artificial intelligence to detect deceptive usernames, accelerate grievance redressal, suspend repeat offenders more rapidly and cooperate more effectively with law enforcement.
This episode also illustrates why India now requires a more technologically informed philosophy of digital policymaking. As software evolves faster than regulation, institutional capability must evolve alongside it. Artificial intelligence will soon introduce entirely new forms of digital identity, authentication, autonomous communication and machine-to-machine interaction. Regulators require enduring principles capable of governing technologies that have not yet been invented.
Digital sovereignty is unquestionably a legitimate national objective. It is too important to become an omnibus justification for scrutinising every technological evolution. Effective regulation should remain technology-neutral. Laws should define obligations, accountability and outcomes, while allowing technology companies the flexibility to determine how those objectives are technically achieved.
India’s ambition to emerge as a global AI power alongside the United States and China demands a new generation of digitally informed policymaking. Technological leadership is ultimately determined not only by the quality of innovation a nation produces, but equally by the wisdom, proportionality and predictability with which it governs that innovation.
If India wishes to lead the AI century rather than merely participate in it, its regulatory institutions must display the confidence to regulate principles over products, harms over hypotheticals, and outcomes over architecture.
Sridharan is a corporate advisor and author of Family and Dhanda and Venkatanarayanan is a strategic security and digital policy researcher. Their forthcoming book Gods of UncertAInty: The Last Battle for Sovereignty, Privacy and Identity examines the challenge of building resilient digital sovereignty in India in the age of AI
If India wishes to lead the AI century rather than merely participate in it, its regulatory institutions must display the confidence to regulate principles over products, harms over hypotheticals, and outcomes over architecture. 
Share
