Why WhatsApp Web Will Auto-Logout Every 6 Hours: DoT’s New SIM-Binding Rule Explained

SIM-Binding Rule Latest News

• A new DoT directive requires messaging platforms such as WhatsApp, Signal, and Telegram to ensure that users can access their accounts only when the original registered SIM card is present in the phone. 
• As a result, linked services like WhatsApp Web will now auto-log out every six hours.
• The government argues this move will curb digital fraud. However, tech companies warn it may undermine user privacy, create problems for users travelling abroad, and add friction when using apps across multiple devices. 
• Telecom operators, meanwhile, support the directive, creating a fresh flashpoint between telcos and tech firms.

New Regulations Under the Telecom Cybersecurity Rules, 2025

• The government is enforcing new powers under the Telecommunication Cybersecurity Amendment Rules, 2025, which introduced a new regulatory category: Telecommunication Identifier User Entity (TIUE).
• TIUEs include any platforms that use mobile numbers to identify users — not just telecom operators.

Mandatory SIM Binding for Messaging Apps

• Platforms must now ensure that their services are continuously linked to the SIM card used during registration.
• This means:
  • Users cannot access the app without the original SIM being present in the device.
  • All related web services (like WhatsApp Web) must auto-log out every six hours.
• This SIM-binding requirement must be implemented within 90 days, and companies must submit a compliance report within four months.

Shift From OTP Verification to IMSI-Based Authentication

• Currently, platforms verify identities via OTP sent to mobile numbers.
• Under the new rules, they must begin verifying users by accessing the IMSI (International Mobile Subscriber Identity) — a globally unique number stored on the SIM card.
• This represents a significant architectural change in how platforms authenticate users.

Impact on Global Platforms Like WhatsApp

• For WhatsApp — with billions of global users and over 500 million in India — complying with India-specific SIM-binding rules will require major re-engineering, since such requirements do not exist in other countries.

‹ ›

Why the Government Wants SIM Binding

• The government argues that cybercriminals exploit messaging apps like WhatsApp without keeping the registered SIM in the device, making it difficult to trace fraud.
• According to the DoT, some communication apps let users operate accounts even when the SIM linked to registration is absent, enabling misuse from outside India for cyber-frauds. 
• SIM binding, it says, is necessary to strengthen telecom cybersecurity and improve the ability to track malicious actors.

Telecom Industry’s Initial Support for SIM Binding

• When the cybersecurity rules were first proposed, telecom operators supported SIM binding.
• The Cellular Operators Association of India (COAI) argued that apps currently bind to a SIM only during initial verification, after which they continue functioning even if the SIM is removed — a loophole they believed enabled misuse.

New Practical Concerns Raised by Telecom Companies

• Despite their earlier support, telecom representatives are now highlighting challenges in the DoT’s final directive.

Problems for International Travelers

• Users who travel abroad often use foreign SIM cards while continuing to access WhatsApp or other apps without re-registration.
• The new rule would block access unless the original SIM is present, creating significant inconvenience for frequent travellers.

Disruption to Professional Workflows

• The requirement to log out secondary devices like WhatsApp Web every six hours adds friction:
  • Many professionals rely on web access during work hours.
  • Some workflows require using messaging apps without having the phone nearby.
• This could hamper productivity and daily operations.

Questions About Effectiveness Against Fraud

• Industry representatives also point out that:
  • Many scammers use illegally obtained SIM cards, often registered with forged or mule identities.
  • SIM binding may not effectively curb fraud if the underlying issue of fraudulent SIM issuance remains unaddressed.

Source: IE