TRAI Seeks IT Act Powers to Act on Truecaller Over Spam Tags

India’s telecom regulator wants new authority under the Information Technology Act to act against authorised agency designation that would let it notify Truecaller, Hiya, and Whoscall of alleged violations and demand compliance, even though those apps sit outside its existing licence regime.

The Ask: An ‘Authorised Agency’ Label Under the IT Act

The Telecom Regulatory Authority of India (TRAI) has asked to be designated as an “authorised agency” under the Information Technology Act, a move that would let it formally notify third-party call management applications of violations and seek compliance. The push, first reported by The Economic Times, is aimed at platforms including Truecaller, Hiya, and Whoscall that, according to the regulator, have been wrongly tagging or blocking calls from the 1400 and 1600 series as spam.

Those apps are not licence holders under the Department of Telecommunications (DoT) the way telecom operators are, and they fall instead under the IT Act as intermediaries. That distinction is the legal gap TRAI says it needs closed. An official told the publication that the Ministry of Electronics and Information Technology (MeitY) has agreed to the demand, and that DoT will now initiate the next course of action. Queries sent to TRAI by the newspaper went unanswered.

“The intention is not to regulate the apps, but in the IT Act there is a provision that if the law is violated by an app, the ministry or administrative authority concerned can initiate action against them,” one official told the paper. A second official added: “While there are safe harbour provisions, the apps have to follow the law of land. It has come to our notice that some of the apps are violating Trai regulations.” The the TRAI push for IT Act authority over caller-ID apps now moves into DoT’s hands.

Why TRAI Says 1400 and 1600 Series Calls Are Getting Buried

The 140 series is reserved by the regulator for promotional voice calls. The 1600 series is reserved for service and transactional communications, including banking alerts, payment confirmations, and account-related messages. Both ranges were introduced so consumers could tell registered commercial traffic apart from ordinary spam.

TRAI’s case against the caller-ID apps turns on a behavioural side effect. These apps rely on crowd-sourced spam reports. If enough users flag a 1400- or 1600-series number, the app can mark or filter it even though that range is supposed to be trusted by default. Amendments to the Telecom Commercial Communications Customer Preference Regulations (TCCCPR) issued in 2025 bar third-party apps from blocking or tagging calls originating from those designated series. The regulator now says compliance has been uneven.

Officials warn that wrongly tagged enterprise numbers push businesses back to ordinary 10-digit mobile numbers to reach customers, eroding the very consumer trust the 1400 and 1600 ranges were designed to build. “The worst part is that due to wrongful tagging, enterprises may tend to revert to normal 10-digit numbers, thereby increasing spam and consumer distrust,” a second official told the publication.

• Apps named in the request: Truecaller, Hiya, Whoscall
• 140 series: promotional voice calls from registered telemarketers
• 1600 series: service and transactional voice calls, including banking, payments, and account alerts
• Compliance line in TCCCPR 2025: third-party apps cannot block, tag, or filter calls from these designated series
• Stated risk: enterprises reverting to ordinary 10-digit numbers to reach customers

What Truecaller Says It Already Does

Truecaller, the most-downloaded of the three apps at the centre of the dispute, told the publication it is already aligned with TRAI’s directive. A company spokesperson said the platform does not spam-tag or auto-block any numbers from the designated series, regardless of how many complaints they draw. “To clarify further, even if Truecaller has detected a particular number from the designated series as spam, we will not tag it as spam,” the spokesperson said. “Note that Truecaller receives lakhs of spam reports against some numbers, but in compliance with the Trai mandate, does not show them as spam.”

Whether that position satisfies the regulator is not yet clear. TRAI’s framing, in officials’ statements to the press, is that the apps as a class are breaking its rules; Truecaller’s framing is that it has already moved past the specific behaviour the regulator objects to.

The IAMAI’s Counter: A Legal Line Around Jurisdiction

The industry body that represents most of India’s internet and mobile companies has already told TRAI, in written submissions on the draft TCCCPR amendments, that the plan goes too far. The Internet and Mobile Association of India (IAMAI) called the proposals a case of regulatory overreach, arguing that a telecom regulator cannot dictate how an over-the-top platform behaves.

IAMAI’s central complaint is jurisdictional: a sectoral regulator cannot strip an intermediary of its Section 79 safe harbour, because that protection lives in a different statute. The association also pushed back on data-sharing requirements and on the consent framework TRAI wants to impose.

The IAMAI’s full case against the draft TCCCPR as overreach lays out four parallel objections:

• Unconstitutional expropriation: forcing OTT platforms to share proprietary data with telecom access providers amounts to “unconstitutional expropriation of valuable proprietary data” built through “significant intellectual and financial investment”.
• Right to trade undermined: mandatory disclosure violates the fundamental right to carry on trade or business guaranteed to platforms.
• Jurisdictional overreach: provisions that would strip non-compliant intermediaries of Section 79 safe harbour protections in the IT Act constitute “gross jurisdictional overreach,” because those protections sit outside TRAI’s statutory remit.
• Consent mismatch: the consent framework should be harmonised with the Digital Personal Data Protection Act, where consent remains valid until withdrawn or the stated purpose is fulfilled, rather than creating a separate TRAI-specific regime.

Section 79 and the Safe Harbour Question

Section 79 of the IT Act is the bedrock of India’s intermediary liability regime. It says an intermediary shall not be liable for any third-party information, data, or communication link made available or hosted by it, provided it meets certain conditions. That protection, and the conditions attached to it, are what allow platforms ranging from cloud hosts to caller-ID apps to operate in India without screening every piece of user-generated content before it goes live.

TRAI’s draft TCCCPR amendment goes directly at those conditions. The draft text says that if the regulator concludes that a call management application is non-compliant, “the IT intermediary shall be liable for losing exemption from liability of intermediary under IT Act 2000”. In other words, a violation of a TRAI regulation could, under the proposal, become a trigger for losing IT Act safe harbour. That is the line IAMAI says TRAI has no business crossing, and it is the reason the dispute is being framed as a question of institutional restraint rather than a question of spam.

The narrow argument is that call management apps mis-tag legitimate 1400- and 1600-series traffic, hurting enterprises and consumers. The broader argument is that a sectoral regulator, armed with the IT Act’s intermediary framework, could reach into any digital platform that touches telecom traffic, from caller-ID apps to messaging services, with consequences designed for a different statute. India’s wider IT Act enforcement pattern, including the kind of notices already sent to large messaging platforms, shows how that authority tends to flow once a sectoral body has it. (See, for context, India’s parallel IT Act notices to WhatsApp, Telegram, and Signal, and the the Section 79 intermediary liability text on India Code.)

TRAI has framed its request as tightly scoped, but IAMAI’s submission argues that the scope of a power, once granted, is rarely the scope at which it was first requested. The institutional-restraint question, of whether sectoral regulators should be authorised agencies under a statute designed for digital intermediaries, will likely outlast the spam-tag dispute that triggered it.

From MeitY Approval to DoT Action: The Road Ahead

For now, the process is administrative rather than judicial. MeitY is reported to have agreed to TRAI’s request. The Department of Telecommunications will now take the proposal forward, working out how the regulator would formally notify platforms and what compliance would look like in practice. The matter is at a starting line, not a finish line: no platform has been notified of a specific violation under any new authority, and the underlying TCCCPR amendments are still in consultation.

The narrow reading of the move is straightforward. The consequential reading, given IAMAI’s opposition and the safe harbour stakes for any intermediary that touches Indian telecom traffic, is that India is one procedural step closer to letting a sectoral regulator act against digital platforms using a statute that was not written for the purpose. DoT will now initiate the next course of action. (For related reading on how India has used intermediary powers in recent enforcement actions, see India’s earlier Telegram block and the resulting VPN signup surge.)