WhatsApp marketing consent under India's DPDP Act

Please read this first

This guide is general information, not legal advice. It explains the rules in plain words to help you ask the right questions. For decisions about your own business, talk to a lawyer.

The points about the law below come from the text of the Act as published by MeitY (The Digital Personal Data Protection Act, 2023), read in November 2026.

Two sets of rules apply

When you send marketing on WhatsApp in India, two sets of rules apply at once:

1. India's law: the Digital Personal Data Protection Act, 2023 (the DPDP Act), and the rules the Government makes under it.
2. WhatsApp's own rules: the opt-in rules Meta sets for every business that uses the WhatsApp Business Platform.

You need to follow both.

What the DPDP Act asks

The DPDP Act applies to digital personal data. It defines personal data as "any data about an individual who is identifiable by or in relation to such data". A customer's WhatsApp number and name are data about an identifiable person. The Act calls the person a Data Principal, and the business that decides why and how the data is used a Data Fiduciary (section 2 of the Act).

Consent must be a clear yes

Section 6(1) of the Act says consent must be "free, specific, informed, unconditional and unambiguous with a clear affirmative action". It must be for the specified purpose, and limited to the personal data needed for that purpose.

In practice, for WhatsApp:

• A box the customer ticks themselves is a clear action. A box that is already ticked is not.
• A yes to order updates is not a yes to offers. Ask for each purpose on its own.
• Do not make buying something depend on agreeing to offers.

Tell people before you ask

Section 5(1) of the Act says every request for consent must come with, or after, a notice. The notice tells the person what personal data you will use and for what purpose, how they can withdraw consent and use their right to complain to you, and how they can complain to the Data Protection Board.

Section 6(3) says a request for consent must be in clear and plain language, and the person must be able to read it in English or any language in the Eighth Schedule to the Constitution. Section 5(3) says the same for the notice.

A simple example of wording next to a tick box: "Send me offers and new arrivals from [your business name] on WhatsApp. Reply STOP any time to stop." Your full notice needs the points above too.

Saying no must be as easy as saying yes

Section 6(4) of the Act gives people the right to withdraw consent at any time, "with the ease of doing so being comparable to the ease with which such consent was given". Section 6(5) says withdrawal does not make processing done before it unlawful. Section 6(6) says that after a withdrawal, the business must stop processing that person's data within a reasonable time, unless a law requires or allows it.

If someone said yes with one tap, they should be able to say no with one word, such as STOP.

Complaints and erasing data

Section 13 of the Act gives people the right to an easy way to raise a grievance with the business. Section 8(7) says that, unless a law requires you to keep it, you must erase personal data when the person withdraws consent or when the purpose is no longer served, whichever is earlier.

When the rules apply

Section 1(2) of the Act says the Act comes into force on dates the Central Government notifies, and different parts can start on different dates. Section 40 lets the Government make rules under the Act. Check which parts and rules are in force on the day you read this, on MeitY's website.

What WhatsApp's rules ask

Meta's Get opt-in for WhatsApp page says this (checked November 2026):

• A business may contact people on WhatsApp only if they gave their mobile number and agreed to get messages from that business.
• The opt-in must clearly say the person is agreeing to messages from the business, and name the business.
• The opt-in can be general and does not have to mention WhatsApp, as long as the business follows the law where it operates.
• Meta suggests a separate opt-in for each category of message, such as order updates and offers. It says this lowers the risk that people block you for messages they did not expect.
• Meta suggests clear instructions on how to opt out of each category, and honouring those requests.

The same page says people can turn off marketing messages from a single business, and can block or report a business. Meta limits sending for businesses whose quality stays low.

A simple checklist

• Ask for consent for offers on its own, with an empty box the customer ticks.
• Give the notice: what data, what purpose, how to withdraw, how to complain.
• Name your business in the wording.
• Say how to stop, such as replying STOP.
• Keep proof: when, how, and what they saw.
• Stop at once when someone says STOP or turns off promotions.
• Erase a person's data when they withdraw, unless a law says you must keep it, and stop messaging them.
• Have a way for people to contact you with a complaint.

How Qubox keeps consent for you

Qubox was built around consent. Here is what it does today.

• Consent per purpose. Each contact has a separate yes or no for updates and for offers, per project.
• Proof with every yes. Every change is kept in a history with how it was given, the proof and who recorded it. You can see it as a timeline on each contact.
• Imports need proof. When you import contacts, a yes is only accepted with proof typed in.
• STOP and START. When someone sends STOP, Qubox records it and stops messages that need consent, for that project. START turns it back on.
• WhatsApp's "Stop promotions". When someone turns off promotions from you in WhatsApp, Qubox stops sending them offers.
• Checked at the moment of sending. Offers need a yes to offers, and updates need a yes to updates. Before a campaign goes out, Qubox shows who will be skipped and why, then checks each person again at the moment of sending.
• Erase on request. An admin can erase a person from a project. Their number is then blocked in that project so they are not added again by mistake.
• Records kept. Messages are kept for 24 months and consent proof is kept.

For Shopify stores, customers choose on the thank-you page, with boxes that start empty. See Qubox for Shopify.

Sources

• The Digital Personal Data Protection Act, 2023, MeitY — definitions (s. 2), notice (s. 5), consent and withdrawal (s. 6), erasure (s. 8(7)), grievances (s. 13), commencement (s. 1(2)), rules (s. 40)
• Get opt-in for WhatsApp, Meta for Developers — opt-in rules, separate opt-ins by category, opting out, blocking and reporting

Questions