WhatsApp Opt-In Compliance Checklist for Indian Businesses

WhatsApp Opt-In Compliance Checklist for Indian Businesses

WhatsApp opt-in compliance in India means obtaining clear customer permission before sending business messages, recording that permission, and respecting the purpose and frequency the customer agreed to. Your process must work with both India’s privacy requirements and WhatsApp Business Platform rules, not just collect a phone number at checkout.

This matters whether you run a D2C store, school, clinic, NGO, agency, local service business or a small company in Pune. A customer giving you a mobile number does not automatically mean they have agreed to receive promotional WhatsApp messages.

What WhatsApp Opt-In Compliance Means in India

A WhatsApp opt-in is a customer’s affirmative agreement to receive messages from your business on WhatsApp. The agreement should identify, in understandable language:

• Who will send the messages
• What type of messages the customer will receive
• The purpose of the messages
• How often messages may be sent, where relevant
• How the customer can stop receiving them
• Where the business’s privacy notice can be read

The customer should take a positive action. Examples include ticking an unchecked consent box, selecting a WhatsApp preference in an account area, sending a clearly described WhatsApp keyword, or submitting a form that separately asks for WhatsApp communication.

A mobile number collected for delivery, appointment booking or account creation is not automatically marketing consent. You may be able to use that number for a service message connected to the customer’s request, but promotional messages require a more specific basis and clearer permission.

Consent should match the intended message

Consent for order updates is not necessarily consent for a sale announcement. Consent for school fee reminders is not automatically consent for unrelated coaching services. Consent for a clinic appointment reminder does not automatically permit health-product promotions.

The safest approach is to divide communication into clear categories:

• Transactional or service messages
• Customer support conversations
• Marketing and promotional messages
• Operational alerts, such as service disruption notices
• Community, donor or volunteer updates for NGOs

You can ask for more than one category of consent, but do not combine unrelated purposes into one vague statement.

WhatsApp consent is not a one-time permanent permission

A customer can withdraw consent. They can also change their preferences, ask for fewer messages, or opt out of one message category while continuing to receive another.

Your systems need to make withdrawal effective across the business. If a person opts out through WhatsApp, the opt-out should not be ignored because the original opt-in was stored in a different CRM, spreadsheet or ecommerce plugin.

Indian Legal and Platform Requirements to Consider

There is no single “WhatsApp consent form” prescribed for every Indian business. Compliance usually involves the Digital Personal Data Protection Act, 2023, applicable privacy obligations, consumer expectations, and WhatsApp’s own Business and messaging policies.

Legal requirements and platform policies can change. Treat this checklist as an operational guide, not a substitute for advice on a regulated campaign.

Digital Personal Data Protection considerations

A phone number is personal data. When you collect it and use it to send WhatsApp messages, you should be able to explain the purpose and basis for that use.

Good practice under India’s privacy framework includes:

• Give a clear notice when collecting the number
• State the purpose of WhatsApp communication
• Avoid collecting more information than needed
• Provide a practical method to withdraw consent
• Keep records showing how consent was obtained
• Restrict access to customer data within your team
• Use vendors and messaging providers with appropriate safeguards
• Delete or stop using data when there is no valid business purpose to retain it

The DPDP Act uses concepts such as notice, consent, withdrawal and data principal rights. The detailed implementation environment may develop through rules, notifications and sector-specific requirements, so businesses should review current legal guidance before launching a large campaign.

WhatsApp Business Platform requirements

For API-based messaging, businesses generally need to use an approved WhatsApp Business Platform setup, often through a Meta partner or business solution provider. Promotional messages usually require approved message templates and must comply with category, quality and policy requirements.

A business should not assume that using a bulk sender, unofficial automation tool or browser extension makes its campaign compliant. Unofficial tools can create account, security and customer-data risks.

WhatsApp also expects businesses to:

• Send messages to people who have provided their number and permission where required
• Honour opt-outs
• Use accurate business identification
• Avoid misleading content
• Avoid prohibited products and services
• Manage customer service conversations appropriately
• Follow template and quality rules
• Avoid spam-like volume or irrelevant messages

The exact technical requirements depend on whether you use the WhatsApp Business app, a platform integration or an API provider.

TRAI, DND and commercial communication

Many Indian businesses assume that checking a customer’s number against the Do Not Disturb system resolves all messaging compliance issues. It does not.

TRAI rules and telecom commercial communication frameworks are highly relevant to commercial calls and SMS, but WhatsApp is an internet-based messaging service with its own platform policies. A DND status should not be treated as a replacement for WhatsApp consent, and WhatsApp consent should not be treated as permission for every other communication channel.

If your campaign also uses SMS, voice calls, email or automated calling, review the requirements for each channel separately.

WhatsApp Opt-In Compliance Checklist

Use the following checklist before collecting consent or starting a customer messaging campaign.

1. Identify the sender

The customer should know which organisation will contact them. If a group company, franchise, agency or marketplace is involved, explain the relationship where it could be confusing.

For example, “Receive updates from ABC Organics on WhatsApp” is clearer than “I agree to receive communications from our partners.”

Do not hide the sender behind a generic label such as “selected brands” unless the customer can easily identify those brands and the purpose of sharing.

2. Define the message category

Write down what you plan to send. Your internal definition should answer:

• Is this an order or service update?
• Is this a promotional offer?
• Is this an event or fundraising appeal?
• Is this a reminder?
• Is this a support conversation?
• Is this a message from a school, clinic or NGO to an existing community?

If the category is unclear, the consent wording will also be unclear.

3. Use a separate, affirmative action

Do not rely on:

• A pre-ticked checkbox
• A phone number entered for delivery
• A statement hidden in general terms and conditions
• A customer’s failure to object
• A WhatsApp number displayed publicly
• A previous message sent by the customer for a different purpose

The customer should actively choose to receive WhatsApp communication. Keep marketing consent separate from acceptance of terms and conditions, especially where the customer must accept terms to complete a purchase.

4. Make the consent wording specific

A useful opt-in statement could be:

I agree to receive order updates and customer support messages from ABC Organics on WhatsApp at the number provided. I understand that I can opt out at any time. See the privacy notice for details.

For marketing, use separate language:

I agree to receive product updates, offers and relevant promotional messages from ABC Organics on WhatsApp. I can withdraw this consent at any time by replying STOP or using the unsubscribe option.

If you expect frequent communications, say so in plain language. You do not need to promise an exact number of messages if the frequency varies, but avoid giving the customer no idea whether they will receive one message a month or several messages a week.

5. Link to a privacy notice

Your privacy notice should explain how you collect, use, store and share the phone number and related information. It should mention WhatsApp or customer messaging where relevant.

The notice should also identify important service providers, such as:

• WhatsApp or Meta as the communication platform
• A WhatsApp Business solution provider
• Your CRM or helpdesk
• Your ecommerce platform
• An agency operating messages on your behalf

You do not need to overload the WhatsApp opt-in screen with legal text. Use a short, readable statement and link to a detailed notice.

6. Record consent evidence

A database field containing “yes” is weak evidence unless you can show how and when the consent was collected.

Record, where practical:

• Customer name or internal customer ID
• Phone number in standardised format
• Date and time of opt-in
• Source of opt-in
• Exact consent wording or version
• Consent category
• Website page, form, QR code or campaign source
• Language shown to the customer
• The person or system that captured the consent
• Withdrawal date and method, if applicable

For a website, store the form version and relevant technical logs. For a QR code at a store or event, identify the location and the wording printed near the code. For an agency campaign, maintain a record of which business collected the consent.

7. Create an opt-out process before the first campaign

Every marketing campaign should have a working unsubscribe method. A simple “Reply STOP to opt out” instruction can be useful, but your process must actually recognise that reply and update the customer’s status.

Also support natural requests such as:

• Stop
• Unsubscribe
• No more messages
• Remove me
• Do not contact me
• बंद करें
• संदेश बंद करें

A human support agent should be able to mark a customer as opted out if the message is unclear but the intention is obvious.

How to Collect WhatsApp Consent Correctly

The collection method should fit how your customer interacts with the organisation.

Website and ecommerce checkout

A separate checkbox near the phone field is usually the clearest option. It should not be selected by default. Place the wording where the customer can see it before submitting the form.

If you collect consent at checkout, distinguish between:

• WhatsApp order and delivery updates
• WhatsApp support
• Promotional messages

A customer may reasonably expect an order update after purchasing. They may not expect future sale announcements. Separate choices reduce confusion and make your records easier to manage.

Landing pages and lead forms

For a lead campaign, explain what will happen after submission. For example, a coaching institute should not say only “Submit your number for details” if it will later send repeated promotional broadcasts.

State whether a counsellor will contact the person, whether WhatsApp will be used, and whether the person may receive follow-up messages. If multiple courses or brands are involved, identify them.

QR codes in stores, events and packaging

QR codes are useful for local retailers, schools, NGOs and event organisers. The printed material next to the code should explain the action.

“Scan to join the WhatsApp updates list for the Pune workshop” is more informative than “Scan for offers.” If the QR code opens a chat, the pre-filled message should not misrepresent what the customer is agreeing to.

For an NGO, distinguish donor updates, volunteer coordination, beneficiary communication and fundraising appeals. These groups may need different preferences and different access controls.

In-person and telephone interactions

A staff member can ask for WhatsApp consent during a store visit, clinic booking or school enquiry, but the record should show what the customer agreed to. Avoid marking consent simply because an employee believes the customer “seemed interested.”

If consent is collected by phone, record the date, purpose and wording used. A call recording may help if lawfully obtained and securely stored, but it is not a replacement for a clear, properly managed consent record.

Imported lists and agency databases

Do not purchase or import a WhatsApp list merely because the numbers are relevant to your target audience. You need a defensible explanation of how each person agreed to receive messages from your business for the intended purpose.

If an agency collected the leads, obtain:

• The exact opt-in wording
• The collection source
• The date range
• The agreed purpose
• The withdrawal history
• The data-sharing arrangement
• A process for handling complaints

An agency cannot solve a consent gap by uploading an old spreadsheet to a WhatsApp provider.

Managing Consent After Collection

Consent compliance is an ongoing operating process. It involves people, data systems and campaign controls.

Keep communication preferences separate

Use separate fields or preference records for:

• WhatsApp service messages
• WhatsApp marketing
• SMS
• Email
• Phone calls
• Donor or volunteer updates
• Product categories or interests

A customer who unsubscribes from WhatsApp marketing may still need an order cancellation notice or clinic appointment update. Your system should distinguish the two without using the exception as an excuse to send promotions.

Synchronise opt-outs

Connect the WhatsApp inbox, CRM, ecommerce platform, helpdesk and campaign tool where possible. If full integration is not practical, maintain one clearly designated suppression list and define who updates it.

Before each campaign, exclude:

• Customers who opted out
• Invalid or reassigned numbers
• People outside the campaign’s consent scope
• Duplicate contacts
• Customers who requested a different language or category
• Contacts under review after a complaint

Suppression data should be protected. Do not delete the opt-out record in a way that allows the same customer to be contacted again accidentally.

Review dormant consent

There is no universal Indian rule that makes every old opt-in invalid after a fixed number of months. However, old consent becomes harder to rely on when the business, purpose, sender or message category has changed.

Review consent when:

• Your brand name changes
• A new company or partner becomes the sender
• You launch a new product category
• You move from service messages to promotions
• You acquired a customer list through a merger
• Your customer has been inactive for a long time
• Your privacy notice changes materially

When in doubt, run a fresh preference campaign rather than assuming old permission covers a new use.

Control employee and agency access

WhatsApp customer data should not be available to every employee. Use role-based access, strong passwords and multi-factor authentication where supported.

Set rules for:

• Exporting phone lists
• Downloading customer information
• Using personal phones for customer messaging
• Sharing screenshots
• Adding customers to groups
• Retaining chat histories
• Removing former employees and vendors

Clinics, schools and NGOs should take extra care because their conversations may reveal health, education, family, financial or vulnerability-related information. Avoid placing unnecessary sensitive details in broadcast messages.

Special Considerations for Indian Businesses

Regional languages

Consent should be understandable to the customer. If your campaign targets Marathi-speaking customers in Maharashtra, or customers who prefer Hindi, Tamil, Bengali or another Indian language, provide the key consent explanation in that language where practical.

Do not use a translation that changes the scope of the permission. Keep the Hindi, Marathi or regional-language version aligned with the English version stored in your consent records.

Schools and children

Schools often communicate with parents and guardians, not directly with children. Identify the actual recipient and keep school announcements, fee reminders, transport updates and promotional messages separate.

Where a communication relates to a child, review applicable requirements and obtain consent from the appropriate parent or guardian. Do not use school contact lists for unrelated commercial promotions without a clear basis and proper notice.

Clinics and healthcare providers

Appointment reminders and prescription-related communication may involve sensitive personal information. Use the minimum necessary detail and confirm that the number belongs to the intended patient or authorised contact.

Do not expose diagnoses, test results or treatment details in group messages. A private, authenticated process may be more appropriate for medical information than a normal broadcast.

NGOs and donor communication

An NGO may hold separate records for donors, volunteers, beneficiaries and event participants. Consent for one relationship should not automatically be applied to another.

Explain whether messages will include donation requests, impact updates, event invitations or volunteer coordination. If a donor opts out of fundraising appeals, you may still need a separate preference for legally or operationally necessary receipts and acknowledgements.

D2C and retail promotions

Discounts and festival campaigns can generate complaints when they are frequent or poorly targeted. Make sure the promotional message identifies the business, contains accurate offer terms, and provides an accessible opt-out.

Do not send a campaign to all historical customers simply because they once purchased. Check whether the intended use matches the permission collected.

Common Compliance Mistakes

Assuming a customer’s WhatsApp message is marketing consent

A customer asking, “Where is my order?” has initiated a service conversation. That does not necessarily mean they want future promotional broadcasts.

Use the conversation to resolve the request. If you want marketing permission, ask separately and clearly.

Hiding consent in terms and conditions

Long terms may cover important contractual matters, but they are a poor place for a separate WhatsApp marketing choice. Customers should not have to search through legal text to understand what messages they will receive.

Sending through a personal number

Personal WhatsApp accounts create weak controls around access, records, employee departures and opt-outs. They also make it harder to maintain consistent customer service and audit trails.

Use an appropriate official business setup for the scale and nature of your communication.

Continuing after an opt-out

Sending one more promotional message “because the campaign was already scheduled” is still a poor practice. Suppression should happen before the next send, and scheduled campaigns should be capable of removing recently opted-out contacts.

Buying a list

A purchased list may contain invalid numbers, stale permissions or people who never agreed to hear from your business. It can damage customer trust and create platform-policy problems even if the list seller claims it is compliant.

Mixing customer groups in a broadcast

A school, clinic, NGO or agency may have several audiences. Sending the same message to donors, beneficiaries, staff and volunteers can reveal relationships or create confusion. Segment based on purpose and permission.

Frequently Asked Questions

Is a customer’s phone number enough for WhatsApp consent in India?

No. A phone number allows you to identify a possible contact, but it does not by itself prove permission for promotional WhatsApp messages. Collect a clear, affirmative opt-in and retain evidence of what the customer agreed to receive.

Can I send order updates without marketing opt-in?

A service message directly connected to a customer’s order, booking or request may be treated differently from promotional communication. Keep the content limited to the relevant service and do not add unrelated offers unless the customer has separately agreed to marketing messages.

Can I use one opt-in for WhatsApp, SMS and email?

It is better to provide channel-specific choices. A person may agree to email but not WhatsApp, or may want order updates on WhatsApp but marketing only by email. Separate preferences make withdrawal and campaign targeting clearer.

How should I handle a customer who says “stop” in response to a message?

Treat the request seriously and update the customer’s WhatsApp marketing status promptly. You can ask one concise clarification only if the request is genuinely ambiguous; do not continue promotional messaging while waiting for a response.

Do I need to keep proof of WhatsApp consent?

You should keep reasonable evidence showing when, where and how consent was obtained, along with the wording and purpose. A simple yes/no field without source or version information may be difficult to audit later.

Can an agency collect WhatsApp consent for my business?

An agency can collect leads or operate campaigns on your behalf, but you remain responsible for checking the quality and scope of the consent used for your messages. Put the roles, data handling, opt-out process, security controls and deletion requirements in writing.

Where to Start

Start with a small audit rather than a large campaign.

1. List every place where you collect mobile numbers.
2. Separate service, marketing and community-message purposes.
3. Rewrite the opt-in wording in plain language.
4. Add an unchecked, channel-specific consent choice.
5. Configure a central opt-out or suppression process.
6. Record consent source, time, wording and category.
7. Review your WhatsApp provider, CRM and agency access.
8. Test the process using sample customers before sending at scale.
9. Review the campaign against WhatsApp policies and your privacy notice.
10. Obtain legal advice for healthcare, children’s data, financial services or large-scale profiling.

Your technical setup should reflect the consent process, not work around it. For help planning a compliant WhatsApp Business workflow, you can talk to the Govindani Infotech team on WhatsApp; service scope and pricing are confirmed by the team directly.