Two separate rulebooks apply to the same message, and satisfying one does not satisfy the other.
The two rulebooks
The DPDP Act governs how you handle personal data of people in India: consent must be informed, specific to a purpose, freely given, and withdrawable as easily as it was given.
Meta’s WhatsApp Business policy governs whether you can use the platform at all: opt-in before marketing templates, an opt-out path, and no automation of the consumer app. Both apply simultaneously.
What counts as valid opt-in
What does not count: a pre-ticked box, consent bundled into general terms and conditions, a purchased list, or numbers scraped from a directory. Buying a list is the single fastest route to a low quality rating.
- An unticked checkbox the person actively ticks, with the purpose stated
- A message the person sent you first, for that purpose
- A QR code or click-to-WhatsApp entry where the purpose is clear
- A form where WhatsApp marketing consent is separate from the main submission
What you actually need to record
The practical requirement is being able to answer, for any given contact: when did they consent, through what channel, and to what purpose. Storing the consent source as a field on the contact record covers this.
A regulator or an irritated customer asks the same question. Being able to answer it in one lookup is the difference between a five-minute response and a problem.
Withdrawal has to be genuinely easy
The DPDP Act requires withdrawal to be as easy as giving consent. In practice that means a stop word or an opt-out button that works immediately, not an email address someone has to write to.
Suppression should apply across every number on your account, not just the campaign that prompted it. A customer who opts out from one number and is then reached from another has not really been given a way out.
The commercial reason to get this right
Set aside the legal position for a moment. Blocks and "report business" actions lower the Meta quality rating that governs your daily messaging limit. Poor consent practice produces blocks, blocks cost you a tier, and losing a tier costs you reach you spent months building.
Compliance and deliverability point the same way here, which is unusual and worth taking advantage of.