Quick answer: Yes. As at 12 October 2026 no Indian law in force that we read bans it. Meta’s policy binds now: the person gave you their number and opted in to your named business. TRAI’s rules cover the SMS and calls around WhatsApp, not the message. DPDP consent duties start 13 May 2027; a CCPA draft would add consent and AI-disclosure rules.
Is WhatsApp marketing legal in India?
WhatsApp marketing means a business sending promotional messages, usually marketing templates, to people’s WhatsApp accounts. It is legal in India. Of the rules in force today, Meta’s contract governs it most closely; a consumer-protection draft would change that. Five instruments matter: Meta’s WhatsApp Business Messaging Policy (binding now); TRAI’s Telecom Commercial Communications Customer Preference Regulations, 2018 (TCCCPR), which govern commercial SMS and calls; the Digital Personal Data Protection Act, 2023 (DPDP Act) and DPDP Rules, 2025, mostly from 13 May 2027; section 43A of the Information Technology Act, 2000, until the DPDP Act omits it on that date; and the Central Consumer Protection Authority’s (CCPA) draft Guidelines for Prevention and Regulation of Pesky, Promotional and Unsolicited Commercial Communications, 2026, which would cover WhatsApp directly but are a draft, not in force as at 12 October 2026.
What WhatsApp marketing is not: a promotional SMS or sales call, both squarely inside TRAI’s rules (see AI cold calling under TRAI’s TCCCPR rules). And “legal” is not “allowed by Meta”: messaging a purchased list may break no Indian statute in force today, but it breaks Meta’s policy on day one.
India WhatsApp consent-and-commencement table
“In force” means the provision applies to a marketing WhatsApp sent on 12 October 2026.
| Instrument | In force as at 12 October 2026? | What it requires of a marketing WhatsApp | Who enforces |
|---|---|---|---|
| WhatsApp Business Messaging Policy (last updated 23 September 2026) | Yes (contractual, applies now) | The person gave you their number or username and opted in to messages from you; templates only, outside a 24-hour customer service window; honour opt-outs made on or off WhatsApp; a human escalation path when automation replies | Meta: message limits, account restriction or removal “in our sole discretion” |
| Meta opt-in rules (developer docs, updated 16 June 2026) | Yes | Opt-in states the person is opting in to communication from the business, names the business, and complies with law; may be general rather than WhatsApp-specific | Meta |
| Meta per-user marketing limits and messaging limits | Yes | No legal duty, but delivery is capped: an adaptive per-person marketing limit (error 131049) and a portfolio limit of 250 unique people outside a service window per moving 24 hours for new portfolios, rising to 2,000, 10,000, 100,000 and unlimited | Meta (automatic) |
| TCCCPR 2018, consolidated by TRAI on 21 May 2026 | Yes, for SMS and calls on access-provider networks | Nothing written for the WhatsApp message itself; full rules apply to any commercial SMS or call used to collect the opt-in or advertise your WhatsApp number (sender registration, registered header or number series, preference scrubbing, an opt-out in promotional SMS, whitelisted links) | TRAI, through the access providers |
| TCCCPR (Third Amendment) Regulations, 2026, notified 18 September 2026 | No: 30 days after Gazette publication, some parts 60 or 90 | Does not extend the TCCCPR to OTT platforms, though one stakeholder asked TRAI to | TRAI, through the access providers |
| Telecommunications Act, 2023, section 28 | Yes, since 26 June 2024 (notification S.O. 2408(E) of 21 June 2024) | A power, not a duty: the Central Government may make rules on prior consent and a “Do Not Disturb” register for “specified messages” | Central Government (Department of Telecommunications) |
| DPDP Act: Data Protection Board and definitions | Yes, since 13 November 2025 | No new duty on a sender yet | Data Protection Board of India |
| DPDP Act s 6(9) and Rules rule 4: consent managers | No: from 13 November 2026 | Optional: consent managers can register with the Board; a person’s right to give, review or withdraw consent through one (section 6(7)) starts on 13 May 2027 | Data Protection Board of India |
| DPDP Act ss 3 to 17 (except s 6(9)) and DPDP Rules rules 3, 5 to 16 | No: from 13 May 2027 | Consent (free, specific, informed, unconditional, unambiguous, by clear affirmative action) or a section 7 legitimate use; a standalone notice; withdrawal comparably easy to giving consent; verifiable parental (or lawful guardian) consent and no targeted advertising for under-18s; erase on withdrawal | Data Protection Board of India; penalties up to ₹50 crore, ₹200 crore for children’s-data breaches, ₹250 crore for security failures |
| IT Act, 2000, section 43A | Yes, until 13 May 2027 | Reasonable security practices for sensitive personal data or information you hold | Compensation to the person affected |
| CCPA draft Guidelines for Prevention and Regulation of Pesky, Promotional and Unsolicited Commercial Communications, 2026 (as reported; primary text not reachable) | No: draft, not in force as at 12 October 2026 | As reported: covers OTT messaging apps (on the plain words, WhatsApp); explicit, verifiable consent; complaints acknowledged within 24 hours and resolved within seven days; no persistent follow-ups after a single enquiry without fresh consent; upfront disclosure of AI-generated voice or text; no adding people to promotional groups or broadcasts without explicit consent | CCPA, under the Consumer Protection Act, 2019 (as reported) |
Read down the second column: Meta governs a WhatsApp campaign today, TRAI the SMS and calls around it, IT Act section 43A any sensitive data, the DPDP Act arrives on 13 November 2026 and 13 May 2027, and the CCPA draft, if finalised as reported, would be the first rule aimed at WhatsApp marketing itself.
Does TRAI’s TCCCPR cover WhatsApp messages?
The definition. Regulation 2 defines “Commercial Communication” as “any voice call or message using telecommunication services, where the primary purpose is to inform about or advertise or solicit business for” (A) goods or services, (B) a supplier or prospective supplier of them, (C) a business or investment opportunity, or (D) a provider or prospective provider of one.
The scope. Chapter II is headed “Commercial communication through access provider network”, and regulation 3(1) makes every access provider ensure that “any commercial communication using its network takes place only using registered headers or the number resources allotted to the Senders from special series”. The definition of access providers “includes” five classes of licensed telephone, cellular, unified and universal access providers and virtual network operators. WhatsApp is none of them, and its templates are not sent from registered headers or 140xx numbers or scrubbed on an operator’s distributed-ledger (DLT) platform.
TRAI’s record on OTT apps. TRAI’s 14 September 2020 recommendations on over-the-top (OTT) services said market forces may respond without intervention while developments are monitored, no intervention was needed on OTT privacy and security “at the moment”, and it was not the moment for a comprehensive OTT framework. Its 7 July 2023 OTT consultation is “Closed” with no recommendations listed from it as at 12 October 2026. In comments on the draft of the TCCCPR Third Amendment (notified 18 September 2026), a stakeholder asked TRAI “to extend the applicability of relevant provisions of the TCCCPR, 2018, to third-party applications and OTT-based communication platforms”; the amendment does not.
The part that cuts the other way. The definition says “any … message using telecommunication services”, and regulation 3(2) says no unregistered sender “shall make any commercial communication”, so do not treat WhatsApp as permanently outside TRAI’s reach. Section 28 of the Telecommunications Act, 2023 defines a “specified message” as one offering, advertising or promoting goods, services, an interest in property, or a business, employment or investment opportunity, and lets the Central Government make rules, “in consonance with” TRAI regulations, for user-protection measures including prior consent, a “Do Not Disturb” register and reporting of malware or specified messages. Section 28 has been in force since 26 June 2024: the Department of Telecommunications’ notification S.O. 2408(E) of 21 June 2024 brought sections 1, 2, 10 to 30 and others into force on that date. The TRAI instruments we read do not apply section 28 to WhatsApp. And the CCPA’s draft guidelines, covered below, would reach WhatsApp directly through consumer law.
In one sentence: TRAI’s commercial-communication rules run through telecom operators’ networks, so a WhatsApp template is outside their machinery today, and the change most likely to bring WhatsApp marketing under an Indian regulator is the CCPA’s draft, not TRAI.
Will the CCPA’s draft guidelines cover WhatsApp marketing?
If finalised as reported, yes. We could not reach its text on 12 October 2026: the CCPA’s guidelines page (updated 29 September 2026) and the Department of Consumer Affairs’ announcements do not list it, and consumeraffairs.nic.in timed out. What follows is as reported by secondary sources; the draft is not in force. An industry body’s comments letter of 24 July 2026 calls it “issued by the Department of Consumer Affairs”; Adgully reported on 15 September 2026 that it would be issued under section 18(2) of the Consumer Protection Act, 2019. Adgully’s report of 15 September 2026 says it would extend the rules from calls and SMS to “Over-The-Top (OTT) messaging apps, Rich Communication Services (RCS), push notifications, and social media platforms”, which on the plain words would include WhatsApp. As that report summarises it:
- Consent: commercial communication without “explicit, verifiable digital consent”, or against a registered opt-out, would be an Unsolicited Commercial Communication; after an opt-out, brands could not seek fresh consent for a cooling-off period of up to 90 days.
- Complaints: every brand and platform would designate a Nodal Grievance Officer to acknowledge complaints within 24 hours and resolve them within seven days, and keep consent and audit records for up to 365 days.
- Prohibited practices: forced additions to promotional group chats; “persistent follow-up messages after a single inquiry”; and AI-generated voice or text without “clear, upfront disclosures”.
As reported, a breach would be treated as an unfair trade practice or misleading advertisement under the 2019 Act, where the CCPA can, after a hearing, issue orders including penalties under its sections 20 and 21. It is a draft, so the final text may differ. Nor is this the CCPA’s first draft on the subject: its draft Guidelines for the Prevention and Regulation of Unsolicited and Unwarranted Business Communication, 2024, dated 20 June 2024, already reached “voice calls, SMS, and instant messaging applications including through social media platforms”, and as at 12 October 2026 the CCPA’s guidelines page does not list it as issued.
Where TRAI still reaches a WhatsApp campaign: the opt-in route rule
The opt-in route rule: a WhatsApp message sits outside TRAI’s machinery, but the channel you use to ask for the WhatsApp opt-in may not. Meta lists four opt-in methods: SMS, website, by phone through an interactive voice response (IVR) flow, and in person or on paper. Two run on telecom networks.
- An SMS asking someone to opt in is a commercial communication if its primary purpose is to solicit business. It needs a registered sender and header, an opt-out mechanism, and recipients who have not blocked that category or who have registered consent; from an unregistered sender it is unsolicited commercial communication by definition. Schedule-I scrubbing covers messages containing “URLs/ APKs/ OTT links/ call back numbers … using whitelisted data uploaded by the Senders”, so whitelist a WhatsApp click-to-chat link first.
- An outbound call or IVR that asks for the opt-in is a promotional call if it sells: 140xx series, preference scrubbing and, if automated, written robo-call notice to your operator.
- A website form, a Click to WhatsApp ad, a QR code or a paper form does not touch the TCCCPR.
What Meta’s WhatsApp Business Messaging Policy requires
Meta’s policy (last updated 23 September 2026): “You may only contact people on WhatsApp if: (a) they have given you their mobile phone number or username; and (b) you have received opt-in permission from the recipient confirming that they wish to receive subsequent messages or calls from you.” Meta’s opt-in page adds three requirements: say the person is opting in to communication from the business, name the business, and comply with applicable law. Opt-in “can be general and not specifically for WhatsApp”, a lower bar than the DPDP Act’s “specific” consent from 2027. Also:
- Templates outside the window. Conversations start only with an approved template; free-form replies only inside the 24-hour customer service window, which “opens and resets with each user message”.
- Opt-outs on or off WhatsApp. Respect any request, “either on or off WhatsApp”, to block, discontinue or opt out, including removing the person from your contacts list.
- AI agents. Automation is allowed in the window, but you “must also have available prompt, clear, and direct escalation paths”: in-chat human agent transfer, phone number, email, web support, in-store visits or a support form.
- Restricted products. India is on Meta’s allowed list for over-the-counter drugs, not online gambling or alcohol; payday loans, paycheck advances, peer-to-peer lending, debt collection and bail bonds are prohibited “irrespective of the global or local licenses” you hold.
You are “solely responsible” for the opt-in method and its legality. Meta “may limit or remove your access” or “limit your ability to send messages” after significant negative feedback, harm to WhatsApp or its users, a policy breach, or “to maintain a high quality experience on WhatsApp, as determined by us in our sole discretion”. If that has happened, see fixing a restricted WhatsApp Business account.
Does Meta limit marketing messages to Indian users?
Yes, through three global limits; we found no India-only rule.
- Per-user marketing limit. WhatsApp “may limit the number of marketing template messages a WhatsApp user receives from any business in a given period of time when they are less likely to be receptive and engage with those messages”; marketing sent inside an open customer service window does not count. A blocked send fails with error 131049; wait at least 24 hours before retrying.
- Portfolio messaging limit. New portfolios can message 250 unique people outside a customer service window per moving 24 hours; it can rise to 2,000, 10,000, 100,000 and unlimited.
- Marketing message experiment. “A very small percentage” of users receive no marketing templates unless a customer service or free entry point window is open (error 130472, not billed).
The only country carve-out on Meta’s per-user page is the United States. On 12 October 2026 we searched nine Meta pages, including both changelogs, for “India”: every hit concerned pricing, billing, payments or India-only features such as address messages, none a marketing limit. For costs, see WhatsApp Business API cost per message.
What the DPDP Act and DPDP Rules 2025 require, and when
A WhatsApp number and chat history are digital personal data, but the Act applies in stages. G.S.R. 843(E) of 13 November 2025 commenced the Board and definitions that day, consent managers (section 6(9)) on 13 November 2026, and sections 3 to 5, 6 (except (9)), 7 to 17 and penalties on 13 May 2027; the DPDP Rules (G.S.R. 846(E)) match. We found no amending notification on 12 October 2026; check the eGazette. From 13 May 2027:
- Scope (section 3). Processing abroad “in connection with any activity related to offering of goods or services” to people in India is covered. Processing by an individual for a personal or domestic purpose, and data made public by the person or by someone legally obliged to publish it, is not.
- Grounds (sections 4 and 6). Consent or a legitimate use, for a lawful purpose. Consent must be “free, specific, informed, unconditional and unambiguous with a clear affirmative action”, limited to the data necessary, so a pre-ticked box fails. The request must be in clear and plain language, with the option to read it in English or any Eighth Schedule language, and give contact details for a Data Protection Officer or other authorised person; withdrawal must be comparably easy, and you must be able to prove notice and consent.
- Notice (section 5 and rule 3). A standalone notice itemising the data, purpose and goods or services, with the means to withdraw consent, exercise rights and complain to the Board.
- Consents you already hold (section 5(2)). Send a notice “as soon as it is reasonably practicable”; you may keep processing “until and unless” the person withdraws.
- Legitimate use (section 7(a)). Data the person voluntarily provided may be used for the specified purpose, unless they have said they do not consent; the Act’s illustration is a person who “electronically messages” a real-estate broker for help finding a rental. Replying to a lead who messaged you is covered; marketing other products later is a new purpose.
- Vendors and erasure (section 8). You remain responsible for your processors, need a valid contract with each, and must have data erased on withdrawal or once the purpose is served, unless law requires retention.
- Children (section 9). A child’s data (under 18) needs verifiable parental consent, as does a person with a disability who has a lawful guardian (the guardian’s), and you may not do “tracking or behavioural monitoring of children or targeted advertising directed at children”, subject to prescribed exemptions.
- Penalties (Schedule). Up to ₹250 crore for failing to take reasonable security safeguards, up to ₹200 crore for breaching the section 9 children’s-data duties or failing to notify a data breach, and up to ₹50 crore for breaching a provision not specifically listed, such as consent or notice.
A WhatsApp opt-in that satisfies Meta is not automatically a DPDP consent.
Does the IT Act apply to WhatsApp marketing?
Narrowly. Until 13 May 2027, section 43A makes a body corporate that possesses, deals with or handles “sensitive personal data or information” in a computer resource it owns, controls or operates pay compensation if it is negligent in implementing and maintaining reasonable security practices and procedures and thereby causes wrongful loss or gain. All those conditions must be met; the sensitive categories are set by rules we could not open, so check them if your list holds financial or health data.
Worked example: four leads, three instruments
An example business in Pune sells training courses and wants to send a marketing template about a new batch. It is illustrative, not a client.
| Lead | Meta policy today | TCCCPR today | DPDP Act from 13 May 2027 | Verdict |
|---|---|---|---|---|
| A. Tapped a Click to WhatsApp ad and asked about fees | Replies inside the 24-hour window are allowed, by an AI agent if a human escalation path exists; for templates after the window closes, ask in-chat for an opt-in naming the business | Not engaged (no SMS or call) | Replying about fees fits section 7(a); a later marketing template is a new purpose, so take consent in the chat, with notice | Reply now; ask for opt-in before marketing later. If the CCPA draft is finalised as reported: disclose the AI agent upfront, and do not keep following up after the single enquiry without fresh consent |
| B. Ticked an unticked “send me course offers on WhatsApp from [business name]” box on the website, with a linked notice | Meets all three opt-in requirements | Not engaged | Consent by clear affirmative action, specific purpose, standalone notice: build it to rule 3 now | Send |
| C. 5,000 numbers bought from a list broker | Fails limb (a) and limb (b): they never gave you the number and never opted in | Recruiting them by SMS or call needs sender registration, a registered header or 140xx number and preference scrubbing; from an unregistered sender it is unsolicited commercial communication | No consent; section 7(a) does not fit data they never gave you | Do not message |
| D. Past customer who opted in to WhatsApp offers in 2024 | Valid opt-in if it named the business | Not engaged | Section 5(2): send a notice as soon as reasonably practicable after commencement; may continue until they withdraw | Send; schedule the notice |
Only lead C is a “no”, and today because of Meta, not a statute. Leads A and D show the two DPDP traps: the purpose limit on an inbound enquiry, and the notice owed to a legacy list. Lead A also shows where the CCPA draft would bite first: an AI agent chasing a one-off enquirer.
How to get WhatsApp marketing compliant before 13 May 2027
- Inventory every opt-in: how, when and with what wording. Section 6(10) will put the burden of proof on you.
- Rewrite the opt-in wording: name the business, say WhatsApp and the message categories, use an unticked box, link a standalone notice.
- Collect opt-ins off the telecom network, or register as a sender first.
- Wire opt-outs across channels so a “stop” by email, phone or chat suppresses WhatsApp sends, ideally within the draft’s 24-hour acknowledgement window.
- Give every AI conversation a human route, and prepare an upfront AI disclosure in case the CCPA draft is finalised.
- Age-gate and draft the section 5(2) notice for pre-2027 subscribers.
Doing this yourself is mostly administrative; what breaks at volume is getting an opt-out taken on a call to the WhatsApp sender before the next template.
Following up Indian leads on WhatsApp? Zian AI’s agents answer inbound calls 24/7 and follow up by voice, SMS, email, WhatsApp, Instagram and Messenger in 30+ languages, with SmartReach AI™ pacing channel and timing by country. Zian is in partnership-application beta. Apply For Partnership
Who should run WhatsApp follow-up?
Disclosure: zian.ai publishes this page, Zian appears in this list, and LeadsNow.ai runs on Zian; the order is our view, not a scored benchmark.
- Zian AI, the platform pick. Inbound and outbound AI agents across calls, SMS, email, WhatsApp, Instagram and Messenger that book appointments, with HubSpot, Salesforce, HighLevel and Zapier integrations. Honest limit: partnership-application beta, no public prices.
- LeadsNow.ai, the done-for-you pick. LeadsNow.ai is a managed, pay-per-result appointment-setting service that runs on Zian and answers leads in under 60 seconds, 24/7.
- Build it yourself on the WhatsApp Cloud API; for calling, see voice AI platforms for sales teams in India.
Frequently asked questions about WhatsApp marketing in India
Is WhatsApp marketing legal in India?
Yes. As at 12 October 2026 no Indian law in force that we read bans it. Meta’s policy requires that the person gave you their number and opted in to messages from your named business; from 13 May 2027 the DPDP Act also requires consent or a legitimate use; and a CCPA draft, not in force, would require explicit consent for WhatsApp promotions too. See Meta’s WhatsApp Business Messaging Policy.
Does TRAI’s DND or DLT registration apply to WhatsApp messages?
Not on the TCCCPR’s current text, which runs through operators’ networks, registered headers and number series. It does apply to any promotional SMS or call used to collect a WhatsApp opt-in. See TRAI’s consolidated TCCCPR text.
Can I send WhatsApp marketing messages to a purchased number list in India?
No. Meta’s policy requires that the person gave you their number and opted in to messages from you, and a bought list fails both. From 13 May 2027 you would also need consent or a legitimate use under the DPDP Act.
When does the DPDP Act apply to WhatsApp marketing?
Its consent, notice and legitimate-use provisions commence on 13 May 2027 under notification G.S.R. 843(E) of 13 November 2025; consent managers can register from 13 November 2026.
Does Meta limit how many marketing messages I can send to Indian users?
Yes, through global limits, not an India-only rule: an adaptive per-user limit (error 131049), a limit of 250 people per moving 24 hours for new portfolios outside service windows, and an experiment group that receives no marketing templates unless a customer service or free entry point window is open. See Meta’s per-user marketing limits page.
Can an AI agent reply to WhatsApp leads in India?
Yes, under Meta’s policy, inside the 24-hour customer service window, if prompt, clear and direct escalation paths are available, such as in-chat human agent transfer, a phone number, email, web support, in-store visits or a support form. The CCPA’s draft guidelines, not in force as at 12 October 2026, would as reported also require upfront disclosure of AI-generated voice or text and bar persistent follow-ups after a single enquiry without fresh consent. See Adgully’s report on the CCPA draft (a secondary source).
Running sales follow-up across India and other markets? Zian AI’s inbound and outbound agents work across calls, SMS, email, WhatsApp, Instagram and Facebook Messenger. Zian is in partnership-application beta. Apply For Partnership
Where every figure on this page comes from
| Figure | Who published it | Link | Date read |
|---|---|---|---|
| Commercial communication definition (4 limbs, inference rule); access providers (5 types); Chapter II heading; regulation 3(1) and 3(2); Schedule-I URL/OTT-link whitelisting; consolidated 21 May 2026 | TRAI, consolidated TCCCPR 2018 | trai.gov.in CA_21052026.pdf | 12 October 2026 |
| Third Amendment notified 18 September 2026; commencement 30, 60 and 90 days after Gazette publication; DPDP Explanation 3; stakeholder request to extend the TCCCPR to OTT platforms | TRAI, TCCCPR (Third Amendment) Regulations, 2026 and explanatory memorandum | trai.gov.in Regulation_18092026.pdf | 12 October 2026 |
| OTT recommendations of 14 September 2020 (three conclusions) | TRAI | trai.gov.in Recommendation_14092020.pdf | 12 October 2026 |
| OTT consultation paper released 7 July 2023, closing date 1 September 2023, status Closed | TRAI | trai.gov.in consultation page | 12 October 2026 |
| No recommendations listed after the 2023 paper; latest OTT recommendations 14 September 2020 | TRAI, recommendations listing | trai.gov.in recommendations | 12 October 2026 |
| Telecommunications Act, 2023: section 2 definitions of “message” and “telecommunication”; section 28 specified messages, consent and Do Not Disturb rule powers | Parliament of India (copy hosted by TRAI) | trai.gov.in Telecommunications_01012024.pdf | 12 October 2026 |
| Opt-in limbs (a) and (b); templates and 24-hour window; opt-outs on or off WhatsApp; six escalation paths; regulated verticals (India: over-the-counter drugs; gambling list of 5 countries); prohibited lending and debt collection; last updated 23 September 2026 | Meta, WhatsApp Business Messaging Policy | whatsappbusiness.com/policy | 12 October 2026 |
| Three opt-in requirements; four opt-in methods; general opt-in allowed; updated 16 June 2026 | Meta for Developers, Get opt-in for WhatsApp | developers.facebook.com getting-opt-in | 12 October 2026 |
| Per-user marketing limit; error 131049; 24-hour retry wait; US carve-out; updated 17 June 2026 | Meta for Developers, Per-user marketing template message limits | developers.facebook.com per-user-limits | 12 October 2026 |
| Per-user limits added 6 February 2024; retry limits added 30 April 2026 | Meta for Developers, WhatsApp changelog | developers.facebook.com changelog | 12 October 2026 |
| Messaging limits 250, 2,000, 10,000, 100,000, unlimited; 2,000 deliveries in 30 days; portfolio level | Meta for Developers, Messaging limits | developers.facebook.com messaging-limits | 12 October 2026 |
| Marketing message experiment; error 130472; not billed | Meta for Developers, Experiments | developers.facebook.com experiments | 12 October 2026 |
| DPDP Act sections 2(f) (under 18), 3, 4, 5, 6, 7(a), 8, 9, 44(2); Schedule penalties ₹250 crore, ₹200 crore and ₹50 crore | Parliament of India, via India Code | indiacode.nic.in a2023-22.pdf | 12 October 2026 |
| DPDP commencement: 13 November 2025, 13 November 2026, 13 May 2027 (G.S.R. 843(E)) | Ministry of Electronics and IT, Gazette of India No. 757 | egazette.gov.in 267647.pdf | 12 October 2026 |
| DPDP Rules commencement (rule 4 at one year; rules 3, 5 to 16 at eighteen months); rule 3 notice contents (G.S.R. 846(E)) | Ministry of Electronics and IT, Gazette of India No. 760 | meity.gov.in DPDP Rules | 12 October 2026 |
| IT Act section 43A conditions | Parliament of India, via India Code | indiacode.nic.in IT Act | 12 October 2026 |
| Telecommunications Act sections 1, 2, 10 to 30 (including section 28) in force from 26 June 2024 | Ministry of Communications (Department of Telecommunications), notification S.O. 2408(E), Gazette of India No. 2288, 21 June 2024 | sancharsaathi.gov.in gazette notification (read via the Internet Archive copy of 26 October 2025) | 12 October 2026 |
| CCPA 2026 draft: OTT/RCS/social media scope; explicit, verifiable digital consent; 24-hour / seven-day complaint timelines; cooling-off of up to 90 days; group-chat, persistent follow-up and AI-disclosure prohibitions (SECONDARY: CCPA text not reachable) | Adgully, 15 September 2026 | adgully.com report | 12 October 2026 |
| Draft “issued by the Department of Consumer Affairs”; comments dated 24 July 2026 (SECONDARY) | Finance Industry Development Council, letter to the Reserve Bank of India | fidcindia.org.in comments | 12 October 2026 |
| Draft to be issued under section 18(2) of the Consumer Protection Act, 2019; reported 15 September 2026 (SECONDARY) | Adgully | adgully.com | 12 October 2026 |
| CCPA guidelines page lists neither the 2024 nor the 2026 commercial-communications guidelines (last updated 29 September 2026) | Central Consumer Protection Authority | ccpa.doca.gov.in guidelines | 12 October 2026 |
| 2024 draft Guidelines for the Prevention and Regulation of Unsolicited and Unwarranted Business Communication: dated 20 June 2024; scope “voice calls, SMS, and instant messaging applications including through social media platforms” | Central Consumer Protection Authority (draft, Annexure-A); public feedback invited 20 June 2024 per All India Radio News | consumeraffairs.nic.in 2024 draft (read via the Internet Archive copy of 1 June 2025) | 12 October 2026 |
General information as read on 12 October 2026, not legal advice. For a specific campaign, ask an Indian privacy or telecom lawyer.