Compliance

WhatsApp Marketing Consent Under India’s DPDP Act: A Practical Guide

Valid WhatsApp marketing consent in India is a recorded, purpose-specific agreement the person gave freely and can withdraw just as easily. What counts as valid opt-in for WhatsApp marketing in India, what you need to record, how withdrawal must work.

Arjun Mehta Published 2 Aug 2026 6 min read

WhatsApp Marketing Consent Under India’s DPDP Act: cover card with the Compliance label, chat bubbles and a 6 min read tag

WhatsApp marketing consent DPDP in brief

WhatsApp marketing consent under India's DPDP Act is one of two rulebooks every bulk send must satisfy, and passing one does not pass the other. The DPDP Act asks for consent that is informed, specific to a purpose and freely given, and that can be withdrawn as easily as it was granted. Meta's WhatsApp Business policy separately demands opt-in before marketing templates, an opt-out path and no automation of the consumer app. WappBlaster sends only on Meta's official platform, which settles that last condition. The 4 kinds of valid consent are an unticked box the person actively ticks with the purpose stated, a message they sent first, a QR code or click-to-WhatsApp entry with a clear purpose, and a form where WhatsApp consent sits apart from the main submission. Pre-ticked boxes, bundled terms, bought lists and scraped directory numbers do not count. Storing when, through which channel and for what purpose each contact agreed turns a regulator's question into a 5-minute answer.

What makes WhatsApp marketing consent valid under the DPDP Act?

Consent must be informed, specific and freely given, with an easy way to withdraw it, and Meta separately demands opt-in for marketing templates plus an accessible opt-out.

WappBlaster sends only on Meta's official platform, since unofficial bulk senders breach Meta's terms however good your consent records are.

  • Two rulebooks apply to one message, and passing one does not pass the other.
  • Record when, where and for what each person agreed.
  • Withdrawal has to be as easy as signing up.

WhatsApp marketing consent DPDP benefits

  • Consent you can prove

    A consent-source field on each contact answers when, how and for what purpose in a single lookup.

  • One-step withdrawal

    A stop word or opt-out button that works at once meets the DPDP standard without an email chain.

  • Account-wide suppression

    An opt-out on one number keeps that person off every other number the business runs.

  • Protected messaging tier

    Clean consent brings fewer blocks and reports, so the quality rating and the daily limit hold.

  • Lists that survive scrutiny

    Dropping bought and scraped numbers removes the quickest route to a low quality rating.

Two separate rulebooks apply to the same message, and satisfying one does not satisfy the other.

Quick answer: In India, bulk WhatsApp marketing is lawful when it runs on Meta’s official platform and the recipient agreed beforehand. India’s DPDP Act requires informed, specific, freely given consent and an easy way to withdraw it. Meta separately requires opt-in for marketing templates and an accessible opt-out. Unofficial bulk senders breach Meta’s terms regardless of how good your consent is.

The two rulebooks for WhatsApp marketing consent under DPDP

The DPDP Act governs how you handle personal data of people in India: consent must be informed, specific to a purpose, freely given, and withdrawable as easily as it was given.

Meta’s WhatsApp Business policy governs whether you can use the platform at all: opt-in before marketing templates, an opt-out path, and no automation of the consumer app. Both apply simultaneously.

What does not count: a pre-ticked box, consent bundled into general terms and conditions, a purchased list, or numbers scraped from a directory. Buying a list is the single fastest route to a low quality rating.

  • An unticked checkbox the person actively ticks, with the purpose stated
  • A message the person sent you first, for that purpose
  • A QR code or click-to-WhatsApp entry where the purpose is clear
  • A form where WhatsApp marketing consent is separate from the main submission

What you need to record for DPDP consent on WhatsApp

The practical requirement is being able to answer, for any given contact: when did they consent, through what channel, and to what purpose. Storing the consent source as a field on the contact record covers this.

A regulator or an irritated customer asks the same question. Being able to answer it in one lookup is the difference between a five-minute response and a problem.

Withdrawing WhatsApp marketing consent has to be easy

The DPDP Act requires withdrawal to be as easy as giving consent. In practice that means a stop word or an opt-out button that works immediately, not an email address someone has to write to.

Suppression should apply across every number on your account, not just the campaign that prompted it. A customer who opts out from one number and is then reached from another has not really been given a way out.

The commercial reason to get DPDP marketing consent right

Set aside the legal position for a moment. Blocks and "report business" actions lower the Meta quality rating that governs your daily messaging limit. Poor consent practice produces blocks, blocks cost you a tier, and losing a tier costs you reach you spent months building.

Compliance and deliverability point the same way here, which is unusual and worth taking advantage of.

For the practical side, work through the WhatsApp opt-in checklist for DPDP, see what makes legal WhatsApp marketing software and read the rules for lawful bulk sending in India.

WhatsApp marketing consent rules under DPDP and Meta policy
Feature Rule By when Source
Consent Informed, specific to a purpose, freely given Before any marketing message DPDP Act
Withdrawal As easy to withdraw as to give Takes effect immediately DPDP Act
Marketing opt-in Opt-in before marketing templates Before the first template send Meta WhatsApp Business policy
Opt-out path An accessible way to stop messages Available in every marketing journey Meta WhatsApp Business policy
Consumer app No automation of the consumer WhatsApp app At all times Meta WhatsApp Business policy
Consent record Know when, through which channel and for what purpose Answerable whenever asked Practical DPDP requirement

Limits of WhatsApp marketing consent under DPDP

  • Contacts outside India fall under their own laws, such as GDPR for EU numbers, so DPDP-style consent alone does not cover them.
  • If a list was bought or scraped, no consent wording repairs it; remove those numbers and collect fresh opt-ins instead.

WhatsApp Marketing Consent Under India’s DPDP Act: questions

Can Indian businesses legally run bulk WhatsApp marketing?

They can, provided they use Meta’s official WhatsApp Business Platform and have the person’s consent first. Under the DPDP Act that consent must be informed and easy to withdraw; under Meta’s rules, marketing templates need an opt-in and an opt-out the recipient can find. Unofficial bulk tools break WhatsApp’s terms however good your consent records are.

Link to this answer

Can I message a purchased contact list?

No. A purchased list has no valid consent under the DPDP Act and breaches Meta policy. Commercially it is also self-defeating: the block rate on cold purchased lists damages the quality rating fast.

Link to this answer

What has to happen when someone opts out?

They stop receiving marketing messages immediately, across every number on your account, and the withdrawal must be as easy as the original consent was. Recording the withdrawal matters as much as recording the consent.

Link to this answer

Do transactional messages need opt-in too?

Utility messages tied to a transaction the customer initiated sit on a different footing from marketing, but you still need a lawful basis for processing their data. Keep the categories genuinely separate rather than sending promotions as utility templates.

Link to this answer

Does a pre-ticked checkbox count as WhatsApp marketing consent?

No. A pre-ticked box, consent buried in general terms, a bought list or numbers scraped from a directory do not count. The person has to tick an empty box themselves, with the purpose stated beside it.

Link to this answer

Is an inbound WhatsApp message from a customer valid opt-in?

It can be, for the purpose they wrote about. A message the person sent first, or a QR code or click-to-WhatsApp entry with a clear purpose, both work as opt-in for that purpose.

Link to this answer

Is an email address enough as the opt-out route?

No. Withdrawal must be as easy as consenting, so a stop word or opt-out button that takes effect at once is needed, not a mailbox someone has to write to.

Link to this answer

Still not answered?

Ask a real person. We reply on WhatsApp, usually within the hour.

Ask on WhatsApp

Arjun Mehta

Head of WhatsApp Business API, WappBlaster

Arjun Mehta leads WappBlaster’s official Meta WhatsApp Business Platform practice, bulk campaigns, chatbot, shared inbox and BSP migrations for 1,000+ India, UAE, USA and UK brands.

Ready to automate post-call follow-up?

Join 3,500+ businesses on Auto WhatsApp After Call, ₹2499 ($22.99)/yr per user.

Start Free Trial View product