India is facing rising criticism after ordering all new mobile phones sold in the country to include a government-backed tracking app, a move that critics say gives the state sweeping access to users’ personal data.

The app, Sanchar Saathi, is meant to combat theft, phone smuggling and call-center fraud, and must be preinstalled on every handset manufactured or imported for the Indian market. The decision has triggered privacy concerns from opposition figures and digital-rights groups, who warn that users cannot meaningfully refuse or disable the software.

Priyanka Gandhi, general secretary of the Congress Party, wrote on X that “Sanchar Saathi is a snooping app,” adding that the line between fraud prevention and surveillance was “very fine.”

According to the BBC, the app’s permissions allow it to place and manage calls, read messages, access call and message logs, view photos and files, and use a phone’s camera. The Internet Freedom Foundation said the mandate “converts every smartphone sold in India into a vessel for state-mandated software that the user cannot meaningfully refuse, control, or remove.”

Communications minister Jyotiraditya Scindia defended the measure, saying the app “exists to protect them from fraud and theft” and was “completely optional,” The New York Times reported. “If you don’t wish to register, you shouldn’t register and can remove it at any time,” he said.

However, the government’s order requires manufacturers to ensure the app’s “functionalities are not disabled,” leaving users with no way to limit or switch off its operations.

Officials cite a surge in cybercrime as justification. The government recorded 2.3 million cybersecurity incidents last year, more than twice the figure from two years earlier. Fraud remains the dominant threat, with losses reaching $2.6 billion in 2024, according to a government portal.

The Department of Telecommunications also highlighted the country’s large second-hand device market, noting cases in which stolen or blacklisted phones were resold.

Telecom companies have been told to submit compliance reports within 120 days as the policy takes effect.