WhatsApp opt-in and consent rules in India: Meta's policy, the DPDP Act, and what a business has to record
Meta requires opt-in for any message you start; the DPDP Act 2023 and 2025 Rules require consent that is specific, informed and withdrawable. What each message needs, how to collect consent that holds up, and why WhatsApp sits outside TRAI's SMS rules today.
Three sets of rules apply to a business messaging people on WhatsApp in India: Meta's Business Messaging Policy, which requires opt-in for any message you start; the Digital Personal Data Protection Act 2023 and its 2025 Rules, which require consent that is specific, informed and withdrawable; and, for SMS rather than WhatsApp, TRAI's telemarketing rules. In practice: ask before you market, record who agreed and how, keep transactional and marketing consent separate, and make STOP work.
On this page
Meta's rule: opt-in for anything you start
Meta's Business Messaging Policy says a business may send a template to a person only if that person opted in to receive messages of that kind from that business, on WhatsApp, and the opt-in named the business. The opt-in can be collected anywhere — a website form, a checkout tick-box, a QR code, a message the person sends first, a signature in a shop — but it must be a clear action by the person, and you must be able to show it. Replies inside the 24-hour window do not need an opt-in: the person wrote to you.
India's rule: the DPDP Act
The Digital Personal Data Protection Act 2023, with its Rules notified in November 2025 and enforced in stages to 2027, governs any use of a person's phone number. Consent must be free, specific, informed, unconditional and unambiguous — a pre-ticked box is none of these — and given for a stated purpose; a person may withdraw it as easily as they gave it; and the business must be able to show a record. A marketing message needs consent for marketing; a booking confirmation is a message the person's own transaction requires, and rests on that.
What that means in practice
| Message | What you need | Example of enough |
|---|---|---|
| A reply inside 24 hours of the customer's message | Nothing further | They wrote first |
| A utility template about their transaction | The transaction itself | A visit they booked, an order they placed, an invoice they owe |
| A marketing template | Recorded marketing consent, for WhatsApp, naming you | "Yes, send me offers on WhatsApp" ticked at checkout, with the time and the page |
| Any message to a person who said STOP | Not allowed | — |
Collecting consent that holds up
- Two boxes, not one. "Message me about my order" and "Send me offers on WhatsApp" are different purposes; the Act wants them separate and Meta's categories match.
- Name the channel and the business. "Receive updates" is not WhatsApp consent. "Receive WhatsApp messages from Skyline Homes" is.
- Record the source and the time. The page, the form, the QR, the keyword — and when. This is the record you produce when asked.
- A first message counts. Someone who messages your number has opted in to a conversation. Marketing later still needs the marketing box.
- Make withdrawal one word. STOP, in any language, in any message, honoured at once and everywhere.
TRAI, and why WhatsApp is different from SMS
TRAI's telemarketing regulations (the TCCCPR, amended in February 2025) govern SMS and voice: DND registration, sender headers, template registration on the DLT platform, and a seven-day life for transactional consent. WhatsApp runs over the internet and is outside them today. The Telecommunications Act 2023 lets the government extend the rules to over-the-top messaging, so a business that already keeps DPDP-grade records is the one that has nothing to change if that happens.
How Linkubit records and enforces it
Consent is a record per person, per channel, per purpose, with its source and time — never a flag on a list. Every outbound message is checked against it and against the suppression list before it sends; a STOP in any language suppresses the person across every campaign in the same second and is kept as a hash, so it survives even a request to erase the person's data. The one-click unsubscribe in every email is the same mechanism.
Is bulk WhatsApp marketing legal in India?
To people who opted in to marketing from you on WhatsApp, with a record of it and a way to stop — yes. To a purchased or scraped list — no, under Meta's policy and the DPDP Act both, and the blocks will end the number before a regulator does.
Does a customer messaging me count as opt-in?
For the conversation, yes, and for utility messages about what they asked for. For marketing, ask: one question in the thread, with their yes recorded, is enough.
What about customers from before the DPDP Rules?
The Act asks for notice to people whose data you already hold, and consent for new purposes. A one-time message asking existing contacts to confirm they want offers on WhatsApp, with STOP honoured, is the usual approach.
Read next
More on The WhatsApp Business PlatformLinkubit vs other toolsWhatsApp templatesCost calculatorPricing
Try it on your own number. Linkubit answers, qualifies and quotes on WhatsApp from your catalogue, and adds nothing to Meta’s per-message price. Start free — fourteen days of Pro, no card — or read the pricing.