India’s 9 phone security rules that are worrying tech firms

India is moving to introduce a comprehensive set of security compliance requirements for smartphones sold in the country, a move that could significantly affect global device manufacturers including Apple, Samsung, Google, and Xiaomi.

The proposed measures, outlined in government and industry documents reviewed by Reuters, are intended to enhance cybersecurity standards and reduce vulnerabilities across mobile operating systems used by hundreds of millions of Indian consumers.

The proposals have drawn objections from technology companies and industry groups, which argue that several of the requirements pose operational, technical, and commercial challenges.

Read more-Samsung outlines ‘AI living’ strategy at CES as it expands connected devices

Concerns range from the protection of proprietary source code and global privacy commitments to the potential impact on device performance, software update timelines, and compliance costs. As discussions continue between policymakers and manufacturers, the outcome is expected to have broader implications for how multinational technology firms adapt their products and governance models to meet India’s evolving regulatory environment.

Below are key security requirements India is proposing for smartphone makers like Apple and Samsung, prompting opposition from tech companies, according to four sources, as well as industry and government documents seen by Reuters.

1-Source code disclosure

Manufacturers must test and provide proprietary source code for review by government-designated labs to identify vulnerabilities in phone operating systems that could be exploited by attackers.

Industry group MAIT, which represents Apple, South Korea’s Samsung, Google, China’s Xiaomi 1810.HK, has told the government this is “not possible” due to corporate secrecy and global privacy policies.

2-Background permission restrictions

Apps cannot access cameras, microphones or location services in the background when phones are inactive. Continuous status bar notifications are required when these permissions are active.

Manufacturers say this lacks any global precedent and there is no specific test method prescribed.

3-Permission review alerts

Devices must periodically display warnings prompting users to review all app permissions, with continuous notifications. Companies say notice should be limited to “highly critical” permissions.

4-One-year log retention

Devices must store security audit logs, including app installations and login attempts, for 12 months.

MAIT argues consumer phones lack the storage capacity for a year of data.

5-Periodic malware scanning

Phones must periodically scan for malware and identify potentially harmful applications.

Manufacturers warn that constant on-device scanning significantly drains the battery and slows hardware performance.

6-Option to remove pre-installed apps

All pre-installed apps bundled with the phone operating system, except those essential for basic phone functions, must be deletable.

Companies argue many apps are critical system components that cannot be removed.

7-Informing government of major updates

Phone makers must notify a government organisation before releasing any major updates or security patches.

Manufacturers argue this is “impractical” because security fixes must be released quickly to protect users from active exploits, while government delays could leave users vulnerable.

8-Tamper-detection warnings

Devices must detect if phones have been rooted or “jailbroken”, where users bypass built-in security restrictions, and display continuous warning banners to recommend corrective measures.

Companies say there is no reliable mechanism to detect jailbreaking.

9-Anti-rollback protection

Phones must permanently block installation of older software versions, even if officially signed by the manufacturer, to prevent security downgrades.

There is no global standard related to this requirement, manufacturers say.