WhatsApp chatbots must get explicit consent from Indian customers under DPDP Act

• The DPDP Act requires explicit and affirmative opt-in consent from customers before initiating any business messages.
• The TCCCPR establishes that transactional consent is valid only for the duration of the underlying transaction and for a maximum of 7 days.
• WhatsApp's Business Messaging Policy prohibits general-purpose AI chatbots built on large language models with open-ended conversational capacities on its API.

Businesses using WhatsApp chatbots in India must ensure explicit and affirmative opt-in consent from customers to avoid violating the DPDP Act, TCCCPR, and WhatsApp's Business Messaging Policy.

Indian businesses using WhatsApp chatbots must ensure explicit and affirmative opt-in consent from customers before initiating any business messages. This requirement stems from three regulatory frameworks: the Digital Personal Data Protection Act (DPDP Act), Telecom Commercial Communications Customer Preference Regulations (TCCCPR), and WhatsApp's Business Messaging Policy.

The DPDP Act, which came into effect in 2023, mandates that consent be free, specific, informed, unconditional, and unambiguous. The Rules under the DPDP Act were notified on November 13, 2025, with full enforcement covering consent, privacy, notice obligations, and rights kicking in on May 13, 2027.

The TCCCPR, amended in February 2025, establishes that transactional consent is valid only for the duration of the underlying transaction and for a maximum of 7 days. After that, customers must give fresh, explicit consent before any further communication is made to them.

The Digital Personal Data Protection Act (DPDP Act) is India's first complete data protection statute, passed in 2023. The DPDP Rules were notified on November 13, 2025, and will be fully enforced from May 13, 2027. The Data Protection Board of India was constituted on the same date as the notification of the DPDP Rules and is already operational.

The Telecom Commercial Communications Customer Preference Regulations (TCCCPR) apply to WhatsApp's business messaging policy, which requires explicit and affirmative opt-in consent from customers before any business message is initiated. The TCCCPR also establishes that transactional consent is valid only for the duration of the underlying transaction and for a maximum of 7 days.

WhatsApp's Business Messaging Policy prohibits general-purpose AI chatbots built on large language models with open-ended conversational capacities on its Business Application Programming Interface (API). Only purpose-built, structured automated bots are allowed.

Businesses using WhatsApp chatbots in India must ensure explicit and affirmative opt-in consent from customers to avoid violating the DPDP Act, TCCCPR, and WhatsApp's Business Messaging Policy. Failure to comply with these regulations can result in significant legal exposure.

The consequences of non-compliance are severe, as businesses that wait until 2027 to build compliant consent workflows will not have enough time. The Data Protection Board of India is already operational, and registrations for Consent Managers start from November 13, 2026.

Indian businesses must prioritize compliance with these regulations to avoid legal repercussions and maintain trust with their customers.

Businesses using WhatsApp chatbots in India must ensure explicit and affirmative opt-in consent from customers before initiating any business messages, as violating the DPDP Act and TCCCPR could lead to significant legal exposure.

Source: Original reporting via Briefly