Encryption lawsIndia
India's traceability rule and the WhatsApp case
Rule 4(2) of India's IT Rules 2021 requires large messaging services to be able to identify the "first originator" of a message when ordered. WhatsApp says that breaks end-to-end encryption, and has challenged it in court.1, 2
Checked 28 October 2026 against the sources. This page describes the law. It is not legal advice.
What rule 4(2) requires
The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, as updated on 6 April 2023.1
| Who | A "significant social media intermediary providing services primarily in the nature of messaging", meaning one with registered users in India above a threshold the government notifies.1 |
|---|---|
| What | It "shall enable the identification of the first originator of the information on its computer resource".1 |
| On whose order | A court, or the Competent Authority under section 69 of the IT Act and the 2009 interception and decryption rules.1 |
| For which offences | Offences on sovereignty, state security, foreign relations or public order, or relating to rape, sexually explicit material or child sexual abuse material, punishable by at least five years in prison.1No order where less intrusive means would work. |
| What it does not require | Disclosing the contents of any message, other information about the first originator, or information about other users.1 |
| Senders abroad | If the first originator is outside India, the first person to send it within India counts as the first originator.1 |
The two positions
WhatsApp's petition argues that because no one can predict which message will be the subject of an order, it "would be forced to build the ability to identify the first originator for every message sent in India", which it says "breaks end-to-end encryption".2
The government has argued in court that the provision helps create a safe cyberspace by countering illegal content and tracing fake messages, India TV reported in April 2024.4
The court case
WhatsApp and its parent company challenged the rule in the Delhi High Court. Court records were not reachable for us, so these steps come from named legal and news outlets.
- WhatsApp's petition says the rule fails the tests under Article 21 of the Constitution, which protects privacy, as reported by LiveLaw on 26 May 2021.2
- The Supreme Court transfers more than a dozen challenges to the 2021 Rules from other High Courts to the Delhi High Court, to avoid "contradictory judgments", as reported by Supreme Court Observer.3
- WhatsApp's counsel tells the Delhi High Court: "if we are told to break encryption, then WhatsApp goes", as reported by India TV.4
As of 28 October 2026 we found no report of a final judgment.
Questions people ask
Does India require WhatsApp to break encryption?
Who decides when a tracing order is made?
A court, or the Competent Authority under section 69 of the IT Act, and only for the listed offences carrying five years or more.1
Has WhatsApp left India?
No. In April 2024 its counsel told the Delhi High Court it would leave if told to break encryption.4
Sources 4
- Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, updated 6 April 2023, rule 4(2), Ministry of Electronics and Information Technology, India. Read 28 October 2026.
- Traceability rule will break end-to-end encryption; can put privacy at risk: WhatsApp tells Delhi High Court, 26 May 2021, LiveLaw. Read 28 October 2026.
- Supreme Court transfers challenges to IT Rules 2021 to the Delhi High Court, 23 March 2024, Supreme Court Observer. Read 28 October 2026.
- WhatsApp tells Delhi High Court it will "exit India" if forced to break encryption, 26 April 2024, India TV. Read 28 October 2026.
We read the law itself, and every status has a date. How we check