The Double-Edged Shield: WhatsApp’s Identity Crisis in India

As Meta pushes for username-based privacy, the platform finds itself caught between facilitating illicit marketplaces and battling a surge in high-end surveillance.

For years, the regulatory comfort of the WhatsApp app in India rested on a single, tethered reality: the phone number. Because every account was tied to a SIM card and, by extension, a KYC-verified identity, the government viewed it as a manageable ecosystem. That premise is now fracturing. As Meta begins a global rollout of usernames to decouple identities from phone numbers, New Delhi has hit the brakes, demanding an audit of how these changes might impede law enforcement’s ability to track organized crime and impersonation.

The irony is not lost on observers. While the government worries about the potential anonymity of usernames, the platform is already struggling to contain a sprawling, subterranean marketplace. Recent investigations by the Digital Witness Lab reveal that thousands of illicit firearm advertisements are circulating through publicly accessible groups. For sellers operating in states like Uttar Pradesh, the platform has become a frictionless storefront for weapons, proving that even with phone-number-based verification, the scale of illegal trade has exploded beyond the reach of traditional policing.

A Siege on Multiple Fronts

Beyond the challenge of criminal marketplaces, WhatsApp is locked in a high-stakes battle against professional spyware. Just days ago, the company disclosed that it had disrupted a campaign by the Israeli firm Paragon, which utilized "zero-click" exploits to compromise the devices of roughly 90 journalists and civil society members across more than two dozen countries. Unlike traditional phishing, these attacks required no user interaction, allowing the spyware to bypass encryption and gain deep access to private messages.

This follows a landmark U.S. federal court ruling that barred NSO Group, the maker of Pegasus, from targeting WhatsApp users. While the injunction is a significant legal victory, it highlights a grim reality: the spyware marketplace is not disappearing. Instead, it is shifting toward new players like Paragon, which market their tools as "ethical" surveillance instruments for government clients. Citizen Lab researchers have warned that these tools are becoming a standard feature of the global digital landscape, making the targeting of activists and reporters a matter of "when, not if."

Why it matters: The bigger picture

The tension here is structural. WhatsApp is attempting to evolve into a more private, identity-agnostic communication tool, yet it is simultaneously being used as a staging ground for both illegal commerce and state-sponsored surveillance. The government’s recent move to audit the username feature signals a shift in policy: regulators are no longer willing to take Meta’s security claims at face value.

For the average user, the stakes are high. As the line between legitimate privacy and criminal anonymity blurs, the platform is finding that it cannot easily satisfy the demands for ironclad encryption while also serving as a reliable crime-prevention tool for the state. If Meta cannot prove that its new features won't provide safe harbor for the next wave of illicit activity, the regulatory friction in India—a market where the platform counts hundreds of millions of users—will only intensify.