By Vikrant Rana, Anuradha Gandhi and Rishabh Gupta
Introduction
WhatsApp’s proposed move away from phone-number-based identification towards a username-based system has, within days of being reported, triggered two distinct but connected reactions in India: public concern voiced by industry founders and privacy experts over impersonation and data-sharing risk, and a reported regulatory direction to Meta to pause the feature’s India rollout pending consultations. Read together, these developments sit squarely at the intersection of intellectual property law, personality rights and the Digital Personal Data Protection Act, 2023 (“DPDP Act”), and merit close attention from brand owners, public figures and ordinary users alike.
Background
WhatsApp has historically tied user identity to a verified mobile number, a design choice that indirectly limited certain forms of impersonation by anchoring an account to telecom KYC records. The platform’s reported shift to usernames — a model long used by Instagram, Telegram and X — is intended, per WhatsApp’s own stated position, to let users connect without exposing their phone numbers, thereby enhancing privacy on one axis while, on another, introducing the familiar risks of handle-based platforms: name-squatting, lookalike accounts and reduced friction for impersonation.
The feature does not arise in isolation. It follows the Competition Commission of India’s prior penalty of ₹213 crore against Meta, and an earlier caution from the Supreme Court to WhatsApp concerning data sharing across the Meta family of apps (Facebook, Instagram and WhatsApp). Any username architecture that enables cross-platform matching or targeted advertising therefore invites renewed scrutiny under India’s data protection and competition frameworks.
Analysis
-
Trade Mark, Passing Off and Personality Rights Dimension
A username functions, in substance, as an identifier — not unlike a domain name or a social media handle — and the concerns raised in the press reports (name-squatting, lookalike handles) mirror disputes that Indian courts have long addressed in the domain-name and handle-squatting context. Where a username incorporates a registered trade mark or trade name without authorisation and is used “in the course of trade,” remedies under Section 29 of the Trade Marks Act, 1999 for infringement, and the common law remedy of passing off for unregistered marks, would ordinarily be available to the rights holder.
Separately, where an individual’s personal name or persona is appropriated as a username for impersonation — including for scams, endorsement-style misuse or reputational harm — Indian law increasingly recognizes a personality/publicity right rooted in the right to privacy under Article 21 of the Constitution, as affirmed in Justice K.S. Puttaswamy v. Union of India, and applied in a series of decisions restraining unauthorised commercial or deceptive use of a person’s name, image or likeness. Criminal remedies may also be available: Section 66C of the Information Technology Act, 2000 addresses identity theft, and Section 66D addresses cheating by personation using a computer resource, both of which could apply to fraudulent WhatsApp usernames impersonating a real individual or brand. -
Digital Personal Data Protection Act, 2023 Dimension
Why the rollout was stayed: The government’s notice issued to Meta under Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 flagged that once the feature is enabled, the recipient’s phone number will no longer be visible to a first-time contact and that an optional “username key” may be set as an additional control. Further, the notice stated that this feature may also increase the likelihood of online frauds, phishing, digital arrest scams and impersonation and identity spoofing of individuals, public authorities, financial institutions and government agencies by permitting the adoption of usernames closely resembling those of genuine institutions or persons.[1]
The Central government has now received WhatsApp’s response to its notice over the messaging platform’s proposed ‘username’ feature and is currently examining the submission. WhatsApp has assured the government that it would not roll out this feature in India until discussions are complete.[2]
Key Data Privacy Concerns:
Cross-platform data linkage – WhatsApp lets users carry the same username across Facebook and Instagram by linking their account to the Meta Accounts Center, a unified hub for managing settings and connected experiences across its apps.
Though this linkage is optional[3], in practice it risks functioning as a form of “bundled consent” where opting in for cross-app consistency indirectly exposes users to secondary data uses such as ad targeting and digital marketing, without obtaining a clear, standalone consent mechanism for that specific purpose as also seen in the WhatsApp Privacy Policy Case[4]. (To know more about this case, kindly refer our article, “Impact of Data Protection Act on Meta vs CCI Case[5]”. This runs contrary to Section 6 of the DPDP Act, 2023, which mandates that consent for processing personal data must be free, specific, informed, unconditional and unambiguous, with a clear affirmative action, and cannot be inferred from a user merely opting into a related or bundled feature.
Key Takeaways
For IP and Brand Owners
- Once the username feature rolls out, monitor for registrations that incorporate your brand name or confusingly similar variants, and be prepared to act promptly under Section 29 of the Trade Marks Act, 1999 or through a passing-off action where such use occurs in the course of trade.
- Consider a proactive username-reservation strategy for key brands and executive personas, analogous to defensive domain-name registration practice.
- Where impersonation involves fraud or deception of consumers, evaluate criminal remedies under Sections 66C/66D of the IT Act, 2000 alongside civil IP remedies.
For Individuals and Public Figures
- Assert personality and publicity rights against unauthorised use of your name or likeness in a WhatsApp username used for impersonation, endorsement-style misuse or reputational harm.
- Track how consent is sought (if at all) for any use of username data in Meta’s advertising ecosystem, and exercise DPDP Act rights — including seeking clarity on, or withdrawing, consent — where such use exceeds the purpose for which the data was originally provided.
For All Users
- Treat the introduction of usernames as a reminder to verify contacts through secondary channels before trusting messages from a username alone, given the reduced friction for lookalike accounts flagged by industry commentators.
Conclusion
The WhatsApp username feature illustrates how a single product change can simultaneously advance one privacy interest — reduced exposure of phone numbers — while creating new exposure on the trade mark, personality-rights and data-consent fronts. With the rollout reportedly paused pending a government-directed explanation from Meta, the coming days are likely to clarify the consent architecture, any verification or trade-mark-priority safeguards being contemplated, and the precise regulatory basis for the government’s intervention. SS Rana & Co. will continue to track this development and its implications for brand owners and individuals in India.
Sources
- Himanshi Lohchab, “Worries Arise Over Gaming of WhatsApp Usernames,” The Economic Times (New Delhi/Gurgaon edition), 1 July 2026, p. 1 (print edition).
- Moneycontrol, “Govt tells Meta to halt WhatsApp username rollout in India, seeks reply in 3 days: Sources” (“MC Exclusive”), 1 July 2026, 20:03 IST.
[3] https://faq.whatsapp.com/2535820043482794
[4] https://ssrana.in/articles/the-impact-of-data-protection-act-on-meta-vs-cci-case/
[5] https://ssrana.in/articles/the-impact-of-data-protection-act-on-meta-vs-cci-case/
Our Coverage on LinkedIn: https://www.linkedin.com/feed/update/urn:li:activity:7490260695234621440