CHENNAI: In an apparent violation raising privacy concerns, telecom giants Airtel and Reliance Jio, which account for 75% of India’s subscriber base, seem to have silently made face authentication as the only mode of Aadhaar authentication for purchasing new SIM cards and for replacing damaged or lost ones.
Visits to at least eight outlets of the two service providers in Chennai and interaction with multiple consumers showed that, without exception, face authentication was used as the only mode of verification, failing which SIM cards were denied. Importantly, this was done without seeking explicit consent from the consumers.
The practice, followed for the past one year, is in violation of UIDAI’s guidelines, which say face authentication is “consent based” and it is one among the many modes of authentication, which includes OTP and biometrics like fingerprints and iris. The Department of Telecommunications (DoT) also clarified the same. This practice was not followed by other prominent players in the market when TNIE checked.
TNIE noticed that when customers approach for a SIM card at outlets, they are asked to stand in a well-lit spot and blink a couple of times for authentication. Many were innocently under the impression that their pictures were being taken, as they were not informed that face authentication was being done. The locations of the outlets TNIE visited included Mogappair, Korattur, Anna Nagar, Adyar, and Ayanavaram. It was found that users whose face authentication failed were denied SIM cards.
Taslima Begam*, a resident of TNHB Colony in Anna Nagar, said staff at the Airtel and Reliance Jio showrooms in Anna Nagar asked for her Aadhaar number when she approached for a new SIM. “They then began clicking my pictures. A few minutes later, they told my husband that I needed to update my Aadhaar to proceed with the SIM purchase. At no point did they ask for fingerprint authentication, which I had used two years ago.” She also pointed out that she has been regularly using biometric verification of Aadhaar for purchases at fair price shops.
S Chandran*, a lecturer from Mogappair, shared a similar experience. “While buying a new SIM for my cousin, the staff held a phone in front of her face and asked her to blink. The screen displayed a tick mark. I assumed they were taking her photograph. When I asked the Airtel staff why fingerprint verification was not done, they said the process was over. No one mentioned that face authentication was done.”
A union government employee from Padi recounted, “At the Airtel showroom in Korattur, the staff who captured a photo of my friend asked him to unlock his Aadhaar on his mobile app. Only then did I realise it was face authentication and not clicking of a picture”
An Airtel spokesperson acknowledged that there had been a “communication gap” among showroom staff and said that, effective July 30 (Wednesday), fingerprint authentication has been implemented in Chennai. “The staff concerned had been instructed not to deny SIM cards to anyone because of failed face authentication,” the spokesperson added.
A Reliance Jio spokesperson, however, said face authentication is ‘mandatory’ for SIM replacements, while it is merely advisory for new connections. However, the spokesperson did not clarify why face authentications were being done without seeking consent.
Official sources in the DoT confirmed to TNIE that Aadhaar authentication has been made mandatory for issuing new SIM cards from January this year. However, a SIM card cannot be denied solely on the basis of failed face authentication. “Aadhaar authentication includes OTP, fingerprint, and iris scan. If any specific complaints are received, they will be looked into,” an official said.
Violates UIDAI guidelines
The practice, followed by Airtel and jio for the past one year, is in violation of UIDAI’s guidelines, which say face authentication is “consent based” and it is one among the many modes of authentication, which includes fingerprints, iris, and OTP. However, this was not followed by other prominent players in the market when TNIE checked
(*names changed)