Meta assures the government that the feature will not be introduced in India until ongoing consultations are completed.

Meta-owned WhatsApp has been granted an extension to submit its response to the Centre regarding its proposed username feature, while assuring the government that it will not roll out the feature in India until discussions on the matter are concluded.

According to sources, the government has allowed WhatsApp three additional days to file its response after the company sought more time. The original deadline for the reply was Friday.

The proposed username feature would allow users to connect with others without revealing their phone numbers, a move that has raised concerns within the government over its potential impact on cyber safety.

Last week, the Centre issued a notice to Meta questioning the feature, expressing concerns that it could increase online fraud, phishing attempts, impersonation, and so-called “digital arrest” scams. The government also directed the company to pause the rollout until consultations are completed to its satisfaction.

Sources said representatives from Meta met officials from the Ministry of Electronics and Information Technology (MeitY) on Friday following the issuance of the notice. During the discussions, WhatsApp reportedly assured authorities that the feature would not be introduced in India before the consultation process is completed.

The government has also asked Meta to explain why action should not be initiated under the Information Technology Act and the relevant rules if the proposed feature is found to compromise user safety. It reminded the company that WhatsApp, as a significant social media intermediary, must comply with due diligence obligations under Indian law.

A WhatsApp spokesperson had earlier clarified that the username feature is not yet live and is expected to be introduced gradually later this year.

The company said it has built several safeguards into the feature to prevent impersonation. According to WhatsApp, usernames of public figures, government entities, celebrities, and verified Meta accounts have been reserved so that they can only be claimed by their legitimate owners. It also said lookalike variations of such usernames are being restricted.

WhatsApp also clarified that users will still need a phone number to create and use a WhatsApp account. The username feature is intended only as an alternative way for people to connect.

The company added that users would need to know another person’s exact username before initiating contact. It also plans to limit how many new users an account can message, prevent repeated attempts to guess usernames, and use automated systems to detect impersonation and abusive behaviour.

To help users identify unfamiliar contacts, WhatsApp said it will display contextual information whenever someone sends a message through a username for the first time. Users will be informed whether the sender is a new account, an existing contact, someone who shares a mutual group, or a person located in another country before deciding whether to respond.

Following its notice to WhatsApp, the IT Ministry also issued notices to Telegram and Signal, seeking details on how their existing username-based systems address concerns related to fraud and impersonation. While WhatsApp has around 500 million users in India, Telegram has a significantly smaller user base.

In recent days, Meta and Telegram have also come under regulatory scrutiny on separate issues. The government recently issued a notice to Meta regarding child sexual abuse material appearing in Instagram advertisements, while Telegram was directed to strengthen action against the circulation of pirated films, OTT content, and other copyrighted audio-visual material on its platform.

The Centre is considering stricter compliance measures for virtual private network (VPN) service providers operating in India as part of its broader efforts to strengthen cybersecurity enforcement and improve cybercrime investigations. Officials are exploring a framework that could require VPN companies to appoint designated compliance officers or authorised representatives to coordinate with enforcement agencies and the Indian Computer Emergency Response Team (CERT-In).

The move comes amid growing concerns within the government over the alleged misuse of VPN services to conceal user identities, bypass law enforcement, and access websites or online platforms that have been blocked in the country.

Government seeks stronger compliance framework

According to government officials, the proposal is intended to ensure that VPN providers establish a clear compliance mechanism in India. Designated officials would be responsible for responding promptly to lawful requests from investigating agencies and CERT-In during cyber incident investigations.

Authorities have stressed that the objective is to improve accountability and facilitate quicker coordination during investigations involving cyber offences rather than monitor ordinary internet users.

Officials also noted that cybercriminals frequently use anonymisation tools, including VPN services, while carrying out ransomware attacks, financial fraud, phishing campaigns, and other online crimes. The proposed framework is aimed at helping investigators trace those involved in such offences through lawful procedures.

Proposal draws from existing IT Rules

The proposed compliance model is similar to the framework introduced under the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021.

Under those rules, significant social media intermediaries are required to appoint a Chief Compliance Officer, a Nodal Contact Person for round-the-clock coordination with law enforcement agencies, and a Resident Grievance Officer. Officials believe adopting a comparable structure for VPN providers would improve accountability, particularly for companies serving Indian users from outside the country.

Existing CERT-In directions remain in focus

The renewed discussions also highlight the cybersecurity directions issued by CERT-In in April 2022.

Under these directions, VPN providers, cloud service providers, virtual private server (VPS) providers, and data centres are required to collect and retain subscriber information for at least five years, even after a customer stops using the service.

The framework requires providers to maintain verified subscriber details, including names, physical addresses, contact numbers, email addresses, IP addresses, the duration of service usage, and the purpose for which the service was obtained. These records must be made available to authorities when sought as part of a lawful cybercrime investigation.

Government officials have maintained that access to subscriber information is limited to lawful investigations and is not intended for indiscriminate surveillance.

VPN industry had opposed data retention rules

When the CERT-In directions were introduced in 2022, several VPN companies and digital rights groups opposed the requirements. They argued that mandatory retention of customer information conflicted with their “no-logs” policies, which are designed to protect user privacy.

Some providers responded by changing their operational models. ExpressVPN, for instance, removed its physical servers from India and began serving Indian users through virtual server locations outside the country. Other VPN companies adopted similar arrangements while continuing to offer services in the Indian market.

Following representations from industry associations and technology companies, the government had extended the compliance deadline from June 27 to September 25, 2022, allowing providers additional time to implement the required changes.

Focus remains on cybercrime investigations

Officials said the latest initiative is intended to place VPN providers under compliance standards comparable to those applicable to other digital intermediaries operating in India. The government believes the proposed measures will strengthen its ability to investigate cybercrimes while further expanding the country’s digital regulatory framework.

Millions of Android users in Venezuela reportedly received earthquake alerts on their smartphones moments before powerful tremors shook the country, renewing global interest in how Google’s earthquake warning technology functions and whether smartphones can help save lives during natural disasters.

The alerts were triggered ahead of the strong shaking caused by the powerful earthquakes that struck Venezuela this week. However, experts have clarified that Google did not predict the earthquakes. Instead, the company’s system detected the initial seismic activity and rapidly issued warnings to people located in potentially affected areas.

How Google’s Android Earthquake Alerts System works

Google’s Android Earthquake Alerts System uses the accelerometers built into billions of Android smartphones. These sensors, typically used to detect device movement and screen orientation, can also identify ground vibrations associated with earthquakes.

When multiple Android devices in the same region detect similar vibrations simultaneously, anonymised data is sent to Google’s servers. Algorithms then analyse the information to estimate the earthquake’s location, magnitude and expected intensity. If the system determines that significant shaking is likely, alerts are automatically sent to users in affected areas.

The technology works by detecting primary seismic waves, or P-waves, which travel faster and are generally less destructive than secondary waves, known as S-waves. Since internet signals travel much faster than seismic waves, alerts can reach users seconds before the strongest shaking arrives.

Why a few seconds can make a difference

Although the warning window is often brief, experts say even a few seconds can be crucial during an earthquake. Such alerts can allow people to move away from hazardous areas, stop dangerous activities, seek cover or prepare for stronger shaking.

During the recent earthquakes in Venezuela, some residents reported receiving alerts on their phones shortly before the tremors intensified, giving them additional time to react.

How to enable earthquake alerts on Android

Google says Android earthquake alerts are available in many countries, including India. To receive these notifications, users need an Android device running Android 5 or later, active internet connectivity and location services enabled.

To check whether earthquake alerts are enabled:

1. Open Settings on your Android smartphone.
2. Search for “Earthquake alerts”.
3. Ensure the feature is turned on.
4. Keep both location services and mobile data or Wi-Fi enabled.

Google emphasises that the system is designed as a supplemental early warning service and may not detect or alert users about every earthquake. It does not predict earthquakes before they begin but aims to provide precious seconds of advance warning once seismic activity is detected.