Can the Sanchar Saathi App’s Security, Privacy Risks Be Justified?

The Government of India has recently issued a directive that mandates every smartphone manufacturer and importer to pre-install the government-owned app, Sanchar Saathi, on their devices before selling them in India. 

While the Indian government mandating global and Indian private entities to forcefully install an application is an issue, Apple, which has nearly 10% smartphone share in India, became the first smartphone manufacturing company to speak against the directive and said that it will not comply with the directive and will submit its concerns very soon.

Pemmasani Chandra Sekhar, Minister of State for Communications, claims that Apple was not part of the working group, which the DoT reportedly formed to address concerns from smartphone manufacturing companies. It is also important to note that there is no publicly available information about any such working group committee to date, raising serious transparency questions regarding the legitimate stakeholder consultations that were not made public.

List of Problems with the Sanchar Saathi App

Before we reason out why mandating Sanchar Sathi on every smartphone can be a nightmare for privacy and security-related concerns, let us briefly list out the problems with the app: 

• No public technical documentation is available to explain the data flows or security architecture.
• The app requests excessive permissions, including access to contacts, audio, call data and storage modification. These permissions could potentially allow the app to install or delete files on the device, and the developers do not explain why the app requires them.
• The app removes user consent by mandating manufacturers to install it. It eliminates user agency, and because users cannot delete or disable it, the app effectively forces them to use it.
• There were no public consultations or open participation, and no pilot testing or field trials before the nationwide rollout.
• There is a lack of transparency about who built the app, how it functions, who truly owns it beyond DoT’s name, and where its servers or data security measures are located.
• Since the app is not open-source, independent audits are not possible.
• If the government exempts itself from the DPDP Act, it undermines user privacy protections and eliminates transparency regarding the retention, deletion, or sharing of collected data.
• Ignores the large population using feature phones and mandates compliance for all SIM-using devices, including IoT, EVs, drones, etc., despite the app being only available for iOS and Android and being impossible to install on non-smart devices.

No Stakeholder Consultations.

After the furore, Telecommunications Minister Jyotiraditya Scindia lied before the media, saying that the app can be uninstalled. According to the official directive issued by the DoT on November 28, 2025, point 6(b) states that manufacturers should pre-install the app in a manner that ensures the app’s…