India to Track Every Smartphone: New Regulations Explained

India Expands Smartphone Security Initiative, Sparking Privacy Debate

The Indian government is broadening the reach of its anti-theft and cybersecurity program to encompass both new and pre-owned smartphones. This expansion aims to reduce device theft and combat online fraud, but simultaneously generates renewed concerns regarding user privacy.

Verification of Used Devices

The Indian telecom ministry is now mandating that companies involved in the purchase or trade of used phones verify each device against a centralized database of IMEI numbers. This requirement supplements a recent directive compelling smartphone manufacturers to preinstall the government’s Sanchar Saathi app on all new handsets.

Furthermore, manufacturers are instructed to deploy the app to existing devices via software updates.

Sanchar Saathi: Growth and Functionality

Launched in 2023, the Sanchar Saathi portal enables users to block or locate lost or stolen mobile phones. Government data indicates the system has successfully blocked over 4.2 million devices and traced more than 2.6 million.

The dedicated Sanchar Saathi app, released in January, has further enhanced the system’s capabilities. It has reportedly assisted in the recovery of over 700,000 phones, including 50,000 in October alone.

App Adoption and Usage Statistics

The Sanchar Saathi app has experienced significant adoption. According to marketing intelligence firm Sensor Tower, it has been downloaded nearly 15 million times.

November saw over 3 million monthly active users, representing a more than 600% increase since its launch. Web traffic to the Sanchar Saathi portal has also risen, with monthly unique visitors increasing by over 49% year-over-year, as reported by Sensor Tower.

Privacy Concerns and Government Response

The preinstallation mandate for Sanchar Saathi has faced criticism from privacy advocates, civil society groups, and opposition parties. Concerns center around the expansion of state surveillance into personal devices without sufficient protective measures.

The Indian government maintains that the mandate is necessary to address escalating cybercrime, including IMEI duplication, device cloning, fraud within the secondhand smartphone market, and identity theft scams.

Telecom minister Jyotiraditya M. Scindia stated that Sanchar Saathi is “completely voluntary and democratic,” and users can uninstall the app if they choose. However, a directive reviewed by TechCrunch instructs manufacturers to ensure the app is “readily visible and accessible” and that its functionalities are not disabled, raising questions about its true optionality.

API Pilot Program and Data Collection

Deputy telecom minister Pemmasani Chandra Sekhar revealed that most major manufacturers participated in the government’s working group, with the exception of Apple.

The telecom ministry is also piloting an application program interface (API) that would allow recommerce and trade-in platforms to directly upload customer identities and device details to the government. This initiative would represent a substantial step towards establishing a national record of smartphones in circulation.

Growth of the Used Smartphone Market

India’s used-smartphone market is experiencing rapid growth, driven by rising prices of new devices and extended replacement cycles. In 2024, India became the world’s third-largest market for secondhand smartphones.

However, approximately 85% of this sector remains unorganized, with most transactions occurring through informal channels and physical stores. The government’s current measures apply only to formal recommerce and trade-in platforms.

Data Flows and Potential for Misuse

The government stated that preinstalling the app will facilitate “easy reporting of suspected misuse of telecom resources.” Privacy advocates argue that the increased data flows could grant authorities unprecedented insight into device ownership, raising concerns about potential misuse of the information.

Prateek Waghre, head of programs and partnerships at Tech Global Institute, expressed concern about the potential for “every single device being ‘databased’,” and the uncertain future uses of this database.

Data Storage and Governance

The Indian government has not yet disclosed details regarding data storage, access control, or safeguards as the system expands. Digital rights groups emphasize that India’s large smartphone base—estimated at 700 million devices—means even minor changes can have significant consequences.

Meghna Bal, director at Esya Centre, highlighted the risk of stifling innovation from private players and startups, who have historically driven secure digital solutions.

She stressed the need for independent audits, robust data governance, and transparent accountability measures to protect user privacy and foster ecosystem innovation.

Liability Concerns for Recommerce Firms

The planned API also raises liability concerns for recommerce firms, should sensitive customer information be mishandled.

The Indian telecom ministry has not yet responded to requests for comment.

Lack of Transparency and User Awareness

Waghre noted that while the Sanchar Saathi app is visible, the underlying system operates largely unseen. Permissions, data flows, and back-end changes, including the API integration, may be hidden within lengthy terms and conditions that most users do not read.

This lack of transparency leaves users with limited understanding of the information collected, how it is shared, and the system’s overall reach.

“You can’t go about restricting cybercrimes and device thefts in such a disproportionate and heavy-handed way,” Waghre stated.

“The government is basically saying that, look, you need to put my app on every device that is sold, on every existing device, you have to install it, and in anything that’s being resold as well,” he concluded.