Opt-Out Not an Option: What Indian Businesses Must Know Before Deploying a WhatsApp Chatbot

Section 6(1), DPDP Act could not be clearer on this topic. Consent must be free, specific, informed, unconditional, and unambiguous, and it also must be given through clear affirmative action by the customer.

Introduction

WhatsApp is particularly appealing as a customer engagement channel for any business operating in India, which is quite understandable, with over 500 million users on the app and almost every company offering financial services using it as a direct line to their customers. As this medium of communication becomes the default and the most convenient one, there is a predictable temptation that arises in the minds of any business owner looking for an easy way to onboard all their customers onto a chatbot. Such as to enrol the existing customer base by default and give them a way to leave if they want; calling this process a compliant one in the process. However, one must note that this approach which sometimes is framed as an opt-out model, is simply not as compliant as it seems to be. It is in fact, a potential violation of not one or two but three regulatory frameworks that apply to every Indian business using WhatsApp for customer communication. This piece outlines the three frameworks that specifically apply to the issue of chatbots at hand and examines how exactly a company is to go about the process without significant legal exposure.

The three frameworks that apply at once

The first and most significant (though not completely in force) is the Digital Personal Data Protection Act, 2023 (DPDP Act) which was passed as India’s first complete data protection statute. The Rules under Digital Personal Data Protection Rules, 2025 (DPDP Rules) were subsequently notified by the Ministry of Electronics and Information Technology (MeitY) on 13 November 2025, with full enforcement covering consent, privacy, notice obligations and rights kicking on 13 May 2027. The Data Protection Board of India was constituted on 13 November 2025 and is already operational. Consent Manager registration opens from 13 November 2026. Businesses that wait until 2027 to build compliant consent workflows will not have enough time. A Data Protection Board too was constituted on the same date with jurisdiction over the entire territory of the country and is already operational. Registrations concerning Consent Managers start from 13 November 2026, a year later from the constitution of the Board. The second framework is the Telecom Commercial Communications Customer Preference Regulations, 2018 (TCCCPR); while WhatsApp shall be classified as “an over the top service” meaning it shall sit outside Telecom Regulatory Authority of India (TRAI) and subsequently not attract the Do Not Disturb (DND) requirement by TRAI, the Telecommunications Act, 2023 gives the government the full authority to extend said jurisdiction to Over-The-Top (OTT) platforms which is a category WhatsApp does fall under. Even though no action has been formally taken, looking at the direction and intention of the legislature in their earlier nods to mandate Subscriber Identity Module (SIM) binding to OTT platforms as well, this issue may as well move in a similar direction in the future. Further, the TCCCPR’s February 2025 Amendments establish that transactional consent is valid only for the duration for said underlying transaction and that too for a maximum of 7 days. After that, the customer has to give fresh, explicit consent before any further communication is made to them. The third framework so to name is not one passed by Parliament, but is WhatsApp’s own Business Messaging Policy¹ terms, which require explicit and affirmative “opt-in” by the customer before any business message is initiated. It is important to note that from the same date, general purpose AI chatbots built on large language models which possess open-ended conversational capacities are prohibited on the Business Application Programming Interface (API) entirely. What is allowed is a purpose built, structured automated bot serving a defined business function. Any business deploying a free-form conversational chatbot on WhatsApp is automatically in violation of Meta’s Policies² and is at risk of account suspension.

Why an opt-out model fails on first principles

Section 6(1), DPDP Act could not be clearer on this topic. Consent must be free, specific, informed, unconditional, and unambiguous, and it also must be given through clear affirmative action by the customer. The practice of enrolling a customer by default and then waiting for them to object does not satisfy these conditions. It is passive consent, not affirmative. Consent is not genuinely free if the customer does not even know they have been enrolled. Section 5(2) then goes and adds a second and a completely independent ground of invalidity, which is the customer’s personal data collected for one purpose, say, a mobile number provided during account opening or know your customer (KYC), cannot be used for a materially different purpose, such as, in this case, sending WhatsApp chatbot messages, that too without obtaining fresh consent for this new purpose. Since the data was not given for this new purpose and because it was such, the original collection simply does not authorise nor legitimise it. Section 6(10) further places the entire burden on the company concerned in the case of a dispute with regards to consent. In such a case the company must show that proper notice according to procedure was indeed given and valid consent was obtained from the customer. The WhatsApp expert compliance guide for India answers all questions furthermore which makes one thing very clear; sending WhatsApp messages to anyone without explicit opt-in consent (independent of general consent asked for beforehand) violates the Business Policy, the DPDP Act, and TRAI regulations simultaneously. One must note that these are cumulative bases of liability.³

What a compliant model actually looks like

A compliant model would mean consent for communication through a chatbot on WhatsApp must be collected separately from the consent collected earlier in general, as both of these cannot be grouped together. A hidden, small checkbox buried in the initial terms and conditions that says “I agree to receive communications” certainly does not seem to satisfy the requirement under any of the frameworks mentioned earlier. What is in fact required is that the notice must name WhatsApp as the channel, specify the type of messages the customer will receive, and must also be presented independently from other information in plain language, as required by Rule 3, DPDP Rules. Consent for transactional messages and consent for marketing or advisory messages must be collected separately, because a customer may agree to one and refuse the other, and bundling them into a single checkbox creates severe compliance exposure under Section 6(1). Every chatbot interaction, communication or message must carry a clear opt-out mechanism, a mechanism which does not by default enrol the customer onto said transaction and then given them to chance to opt-out but one that requires them to explicitly opt-in to receive communications, and the option to opt-out must be honoured immediately, with all messaging ceased within a reasonable time under Section 6(6), DPDP Act. Under the TCCCPR framework, opted-out customers should not be approached again for at least 90 days. Consent communication records must be maintained with timestamps, source details, and specific purposes consented to, for a minimum of seven years under the DPDP Rules, meaning a logbook of the times the company has asked for consent to communicate through a chatbot must date back for at least seven years.

The honest and practical advice

The May 2027 enforcement date is much closer than it looks, and building compliant consent infrastructure takes time. Businesses that treat consent as a legal formality to be managed at the last minute will find that the 13 May 2027 deadline carries no viable period of cure. The Data Protection Board is operational now, and enforcement is expected to be, if not completely, majorly complaint-driven from day one. An opt-in model is not the cautious option, it is the only legally available one.