Government scraps plan for shared biometric database of telecom users

India's government has abandoned plans to establish a centralized, shared biometric database for telecom users known as the Biometric Identity Verification System (BIVS). The decision comes after the Department of Telecommunications (DoT) finalized the Telecommunications (User Identification) Rules, 2026, on August 21, marking a significant shift from earlier proposals that had drawn sharp criticism from privacy advocates. The revised rules eliminate the requirement for cross-industry biometric matching among telecom providers. Instead, verification processes will rely on existing mechanisms such as e-KYC (electronic Know Your Customer) and D-KYC (Document-based Know Your Customer). These methods were previously outlined in the draft rules, which had been circulated by the DoT on September 19, 2025, and remained in place for over a year before being finalized. The removal of the BIVS system follows concerns raised by organizations like the Internet Freedom Foundation (IFF), which criticized the initiative as unnecessary and lacking adequate safeguards. In October 2025, IFF argued that the proposed system would create a parallel collection of biometric data beyond what is already managed by the Unique Identification Authority of India (UIDAI) under the Aadhaar program. The foundation highlighted that the BIVS lacked the protections mandated by the Aadhaar Act, 2016. Despite the withdrawal of the BIVS, the final rules still impose stringent requirements on telecom companies regarding user verification. All operators, including major players such as Airtel, Jio, Vodafone Idea, and BSNL, must ensure accurate identification of users before issuing SIM cards, updating account details, or disconnecting numbers. Companies have up to three months, extendable to six, to implement necessary systems to comply with these regulations. Verification procedures differ depending on whether a user holds an Aadhaar card. For Aadhaar holders, e-KYC will be conducted through UIDAI’s authentication platform. Non-Aadhaar users will undergo D-KYC, involving the capture of a live facial image and scanned copies of identification documents. Alternative verification methods are available for individuals with physical impairments or injuries preventing live biometric capture, including field visits or police assistance. Additional measures include an alert system under Rule 10, enabling telecom entities to notify users of any activity initiated in their names, such as new connections or SIM updates. Entities are also required to report instances where biometric identification fails to the government. Furthermore, biometric verification is now mandatory before disconnecting a service, a provision absent in the initial draft. Several provisions from the draft rules have been omitted without replacements, such as the option for self-KYC via web portals or apps, and the requirement to perform biometric checks within seven days of a user change, with potential disconnection if unmet. In a separate move, the DoT issued a circular on August 17 introducing a new method for cross-checking telecom data. The Digital Intelligence Platform will aggregate subscriber data and photographs from all telecom companies to detect individuals holding more than the legally allowed number of mobile connections. Photo-based checks for this purpose became effective on August 23. The revised rules reflect a balance between enhancing security and addressing privacy concerns, while maintaining strict compliance standards for telecom operators. Implementation timelines and specific enforcement mechanisms remain under review as the industry adapts to the new framework.