Xbox has announced plans to reduce its workforce by 3,200 employees, representing around 20 per cent of its total staff, over the coming year as part of a broader restructuring programme linked to Microsoft’s increased investment in artificial intelligence.

According to an email shared with employees by Asha Sharma, the company will begin the process immediately, with 1,600 employees leaving on Monday, while the remaining job reductions will take place during FY27. The company also plans to divest four gaming studios and is preparing to separate from another.

Business reset planned amid financial challenges

In her message to employees, Sharma said the company’s current financial position required significant changes, stating that Xbox’s business was operating at substantially lower margins than comparable platform and publishing companies.

She said the layoffs were not a reflection of employees’ commitment or abilities but were part of a wider effort to strengthen the company’s long-term business.

The workforce reduction comes as Microsoft continues implementing AI-focused cost-cutting measures across its operations. Overall, the technology company is reportedly cutting 4,800 jobs, with Xbox accounting for the largest share.

Sharma also described the gaming sector as experiencing one of its most challenging hardware periods and said the company needed to “reset Xbox” to improve its future performance.

Company to streamline operations and reduce management layers

As part of the restructuring strategy, Xbox plans to simplify its organisational structure, revise its content portfolio and improve platform operations.

According to Sharma, the company currently loses 64 cents for every dollar invested annually, making operational efficiency a key priority.

She said Xbox would increasingly support independent game creators by offering open development tools and broader audience access.

The restructuring will also see Mojang and King report directly to Sharma. She said both studios have evolved into major gaming platforms with large monthly active player bases and will play a central role in Xbox’s future strategy.

To improve decision-making, the company plans to significantly reduce its management hierarchy. Sharma said some departments currently have as many as 14 management layers, which slow down operations. Xbox aims to reduce this to no more than five layers, and in some cases, only three.

The company will also reduce vendor spending by 50 per cent as part of its cost-saving measures.

Helen Chiang promoted to Chief Operating Officer

Alongside the restructuring announcement, Sharma confirmed the promotion of Helen Chiang to the newly created position of Chief Operating Officer.

Chiang will oversee profit and loss responsibilities across Xbox’s content, hardware, platform and services divisions while reporting directly to Sharma.

According to Sharma, the new operating structure is intended to improve investment decisions, strengthen accountability and better integrate the company’s various business units.

Despite the ongoing restructuring and job cuts, Sharma said Xbox remains committed to long-term growth and plans to continue investing heavily in the business, while placing greater emphasis on disciplined spending and strategic priorities.

Meta assures the government that the feature will not be introduced in India until ongoing consultations are completed.

Meta-owned WhatsApp has been granted an extension to submit its response to the Centre regarding its proposed username feature, while assuring the government that it will not roll out the feature in India until discussions on the matter are concluded.

According to sources, the government has allowed WhatsApp three additional days to file its response after the company sought more time. The original deadline for the reply was Friday.

The proposed username feature would allow users to connect with others without revealing their phone numbers, a move that has raised concerns within the government over its potential impact on cyber safety.

Last week, the Centre issued a notice to Meta questioning the feature, expressing concerns that it could increase online fraud, phishing attempts, impersonation, and so-called “digital arrest” scams. The government also directed the company to pause the rollout until consultations are completed to its satisfaction.

Sources said representatives from Meta met officials from the Ministry of Electronics and Information Technology (MeitY) on Friday following the issuance of the notice. During the discussions, WhatsApp reportedly assured authorities that the feature would not be introduced in India before the consultation process is completed.

The government has also asked Meta to explain why action should not be initiated under the Information Technology Act and the relevant rules if the proposed feature is found to compromise user safety. It reminded the company that WhatsApp, as a significant social media intermediary, must comply with due diligence obligations under Indian law.

A WhatsApp spokesperson had earlier clarified that the username feature is not yet live and is expected to be introduced gradually later this year.

The company said it has built several safeguards into the feature to prevent impersonation. According to WhatsApp, usernames of public figures, government entities, celebrities, and verified Meta accounts have been reserved so that they can only be claimed by their legitimate owners. It also said lookalike variations of such usernames are being restricted.

WhatsApp also clarified that users will still need a phone number to create and use a WhatsApp account. The username feature is intended only as an alternative way for people to connect.

The company added that users would need to know another person’s exact username before initiating contact. It also plans to limit how many new users an account can message, prevent repeated attempts to guess usernames, and use automated systems to detect impersonation and abusive behaviour.

To help users identify unfamiliar contacts, WhatsApp said it will display contextual information whenever someone sends a message through a username for the first time. Users will be informed whether the sender is a new account, an existing contact, someone who shares a mutual group, or a person located in another country before deciding whether to respond.

Following its notice to WhatsApp, the IT Ministry also issued notices to Telegram and Signal, seeking details on how their existing username-based systems address concerns related to fraud and impersonation. While WhatsApp has around 500 million users in India, Telegram has a significantly smaller user base.

In recent days, Meta and Telegram have also come under regulatory scrutiny on separate issues. The government recently issued a notice to Meta regarding child sexual abuse material appearing in Instagram advertisements, while Telegram was directed to strengthen action against the circulation of pirated films, OTT content, and other copyrighted audio-visual material on its platform.

The Centre is considering stricter compliance measures for virtual private network (VPN) service providers operating in India as part of its broader efforts to strengthen cybersecurity enforcement and improve cybercrime investigations. Officials are exploring a framework that could require VPN companies to appoint designated compliance officers or authorised representatives to coordinate with enforcement agencies and the Indian Computer Emergency Response Team (CERT-In).

The move comes amid growing concerns within the government over the alleged misuse of VPN services to conceal user identities, bypass law enforcement, and access websites or online platforms that have been blocked in the country.

Government seeks stronger compliance framework

According to government officials, the proposal is intended to ensure that VPN providers establish a clear compliance mechanism in India. Designated officials would be responsible for responding promptly to lawful requests from investigating agencies and CERT-In during cyber incident investigations.

Authorities have stressed that the objective is to improve accountability and facilitate quicker coordination during investigations involving cyber offences rather than monitor ordinary internet users.

Officials also noted that cybercriminals frequently use anonymisation tools, including VPN services, while carrying out ransomware attacks, financial fraud, phishing campaigns, and other online crimes. The proposed framework is aimed at helping investigators trace those involved in such offences through lawful procedures.

Proposal draws from existing IT Rules

The proposed compliance model is similar to the framework introduced under the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021.

Under those rules, significant social media intermediaries are required to appoint a Chief Compliance Officer, a Nodal Contact Person for round-the-clock coordination with law enforcement agencies, and a Resident Grievance Officer. Officials believe adopting a comparable structure for VPN providers would improve accountability, particularly for companies serving Indian users from outside the country.

Existing CERT-In directions remain in focus

The renewed discussions also highlight the cybersecurity directions issued by CERT-In in April 2022.

Under these directions, VPN providers, cloud service providers, virtual private server (VPS) providers, and data centres are required to collect and retain subscriber information for at least five years, even after a customer stops using the service.

The framework requires providers to maintain verified subscriber details, including names, physical addresses, contact numbers, email addresses, IP addresses, the duration of service usage, and the purpose for which the service was obtained. These records must be made available to authorities when sought as part of a lawful cybercrime investigation.

Government officials have maintained that access to subscriber information is limited to lawful investigations and is not intended for indiscriminate surveillance.

VPN industry had opposed data retention rules

When the CERT-In directions were introduced in 2022, several VPN companies and digital rights groups opposed the requirements. They argued that mandatory retention of customer information conflicted with their “no-logs” policies, which are designed to protect user privacy.

Some providers responded by changing their operational models. ExpressVPN, for instance, removed its physical servers from India and began serving Indian users through virtual server locations outside the country. Other VPN companies adopted similar arrangements while continuing to offer services in the Indian market.

Following representations from industry associations and technology companies, the government had extended the compliance deadline from June 27 to September 25, 2022, allowing providers additional time to implement the required changes.

Focus remains on cybercrime investigations

Officials said the latest initiative is intended to place VPN providers under compliance standards comparable to those applicable to other digital intermediaries operating in India. The government believes the proposed measures will strengthen its ability to investigate cybercrimes while further expanding the country’s digital regulatory framework.