Sending WhatsApp messages to anyone without explicit opt-in consent violates WhatsApp's Business Policy, India's DPDP Act 2023, and TRAI regulations simultaneously. This guide explains exactly what consent you need, how to collect it correctly, and how to manage opt-outs — for every type of WhatsApp communication.
Three frameworks govern WhatsApp opt-in consent for Indian businesses. You must comply with all three simultaneously.
| Framework | Key requirement | Applies to |
|---|---|---|
| WhatsApp Business Policy | Explicit opt-in before sending any business-initiated message. Opt-in must mention WhatsApp specifically (not just "digital communication"). | All businesses using WhatsApp API |
| DPDP Act 2023 | Explicit, informed, specific consent for each purpose. Right to withdraw consent at any time. Must state: what data is collected, why, and by whom. | All businesses processing Indian citizens' personal data |
| TRAI Regulations | Telemarketing registrations required. NDNC (Do Not Disturb) database compliance. Cannot send commercial communications to DND-registered numbers. | Commercial/marketing communications via any digital channel |
⚠️ WhatsApp opt-in alone is not sufficient for marketing messages. Under DPDP Act 2023, you must also have documented consent for the specific marketing purpose, not just a general "receive messages" opt-in. Best practice: separate checkboxes for transactional and marketing communications.
At checkout: "☐ I agree to receive order updates and offers on WhatsApp." Two separate checkboxes for transactional vs marketing is best practice. Pre-ticked checkboxes are not valid consent under DPDP.
When a user clicks a Meta WhatsApp ad and sends a message — this constitutes implied consent for transactional communication. For marketing, collect explicit opt-in during the first conversation via a WhatsApp Flow.
"I consent to receive WhatsApp updates from [Brand]" with mobile number field. Date and location recorded. Most compliant method — signed physical evidence of consent.
Customer messages "JOIN" or "YES" to your number. WA.Expert records the opt-in with timestamp. Used widely in retail: "Send 'DEALS' to 9XXXXXXXXX to get our weekly WhatsApp offers."
During first WhatsApp interaction: Flow screen with clear "Yes, I'd like to receive [types of messages] from [brand]" toggle. Separate toggles for transactional and promotional. Data saved to WA.Expert CRM.
"Reply YES to receive WhatsApp updates from [Brand]" — sent after account creation. Double opt-in method. Higher quality consent, lower volume — used for premium / financial services.
WhatsApp's Business Policy and DPDP Act both require you to honour opt-out requests promptly. Here's what that means in practice:
💡 WA.Expert automatically detects STOP and common opt-out keywords in any language, marks the contact as unsubscribed, and excludes them from future broadcasts. No manual intervention needed.
Build a compliant opted-in list — templates, methods, best practices.
Read →Account restricted for sending without consent — recovery guide.
Read →WA.Expert records every consent, detects STOP keywords, and auto-excludes unsubscribed contacts from broadcasts.