WhatsApp username a 'Pandora's box' for privacy: Pawan Duggal

Cybersecurity law expert Pawan Duggal has warned that WhatsApp's new username feature could lead to massive privacy violations. He stated it must comply with India's new data protection laws, including the DPDP Act 2023, to avoid being misused.

Chairman of the International Commission on Cyber Security Law, Pawan Duggal, on Thursday warned that WhatsApp's proposed username feature can open a Pandora's box of privacy violations if it fails to strictly comply with India's stringent new data protection regime.

Legal Compliance and Privacy Concerns

Speaking to ANI, Duggal said that WhatsApp must ensure that its username feature is compliant with the Information Technology Act 2000, the Digital Personal Data Protection Act 2023, and the DPDP Rules 2025. "The concern of the government is very clear: it does not want Indians to be made guinea pigs in the laboratories of big tech companies. The Supreme Court in the case of Justice Puttaswamy has categorically held that your fundamental right to privacy is an integral part of the fundamental right to life. Now, once this kind of a feature is going to be used as username, this could open up a Pandora's box: it could potentially impact people's privacies; this username ultimately is nothing but a manifestation of personal data of data principles, hence WhatsApp has to make sure that its username offerings has to be compliant with not just the Information Technology Act 2000 but also with the Digital Personal Data Protection Act 2023 and the DPDP Rules 2025," he said.

Regulatory Obligations for WhatsApp

He further added that WhatsApp's massive user footprint classifies it as a Significant Social Media Intermediary (SSMI) under Indian law. This classification strips the platform of blanket immunity and binds it to strict regulatory oversight. Duggal highlighted that under Section 79 of the IT Act, WhatsApp is legally obligated to maintain rigorous statutory due diligence. This framework has grown even tighter following recent legislative updates. "A company like WhatsApp is a significant social media intermediary under the Information Technology Act 2000. That being so, under section 79 of the IT Act, it is required to exercise due diligence while it discharges its obligations under the law. When you read this IT Act with the IT Rules 2021, which have been updated on 20th of February 2026, it's very clear that the government can give any directions or notification to the significant social media intermediary. And it shall be a part of the due diligence of the significant social media intermediary that it complies with those directions," he said.

Government Intervenes Over Fraud Concerns

The remarks came as the government asked Meta not to roll out the feature until satisfactory consultation. Earlier on Wednesday, the government issued a notice to Meta over the proposed feature, stating that it may increase the incidence of online fraud, phishing, and digital arrest scams. The Centre expressed concern, saying that the "usernames" feature may enable "impersonation and identity spoofing," and asked Meta to furnish a detailed explanation within three days.

Meta's Explanation of the Feature

Meanwhile, according to Meta, a username is an "optional unique identifier you can choose for your WhatsApp account". It starts with the @ symbol (for example, @Name123) and can be used by others to message or call a person, while keeping their phone number private. The username is different from the display name (the name that appears in your profile). The display name doesn't have to be unique, but the username does, according to the messaging platform. (ANI)

(Except for the headline, this story has not been edited by Asianet Newsable English staff and is published from a syndicated feed.)