WhatsApp is the highest-performing channel most Indian brands have and the one where consent practice is weakest. Meta policy requires opt-in. DPDP requires specific, informed, revocable consent for a stated purpose. Those are different standards, and clearing the first does not clear the second.
Six opt-in patterns
A pre-ticked checkbox at checkout fails. Consent has to be an affirmative action, and a box the user must notice and untick is not affirmative.
Bundled consent covering email, SMS and WhatsApp together fails on granularity. Someone who wants order updates on WhatsApp but no promotional email has no way to say so.
A phone number collected for delivery and later used for promotions fails on purpose limitation. This is probably the single most widespread violation in Indian ecommerce.
The user messaging your business first is solid ground for a service conversation and weak ground for ongoing marketing. An inbound product query is not consent to a weekly broadcast.
An unticked, unbundled checkbox that names WhatsApp and the purpose, with a link to a short notice, holds up. It also produces the smallest list, which is why teams avoid it.
Purchased or partner-sourced numbers have no defensible basis. Delete them.
The record-keeping problem
Even teams with a clean opt-in flow usually cannot answer the question that matters: for this number, show me when consent was given, through which form, for what purpose, against which version of the notice.
Most WhatsApp Business API providers store an opt-in flag. A flag is not a record. You need timestamp, source, purpose and notice version, held somewhere you control rather than inside a vendor you might replace.
Run this audit
Pull twenty numbers at random from your list. For each, try to produce those four data points. The share you can fully document is your real position. Teams doing this for the first time usually land between ten and forty percent, and the gap is almost always numbers collected before anyone was thinking about DPDP.
The fix for undocumented numbers is a re-permission campaign: message once, say what you send and why, ask them to confirm. You will lose a large part of the list. You will also be able to defend what stays.
General information, not legal advice. Rules current as of July 2026.