Is Bulk WhatsApp Marketing Legal in India? Official Rules

Not legal advice. This article is general information for business owners, based on public documents from Meta, MeitY and TRAI as of the date above. It is not legal advice. Laws and platform policies change; speak to a qualified lawyer about your situation.

Short answer: Sending marketing messages to many customers on WhatsApp can be done lawfully in India when you use Meta’s official WhatsApp Business Platform, message only people who have agreed to hear from you, use Meta-approved templates, honour opt-outs, and handle personal data as India’s Digital Personal Data Protection Act, 2023 requires. What gets businesses into trouble is the “bulk sender” approach: unofficial tools, purchased contact lists and messages nobody asked for. AiBukko runs campaigns on the official API for exactly this reason.

Why this question comes up

Search for “bulk WhatsApp” and you’ll find tools promising to send thousands of messages from any number, with no approvals. For a salon, clinic or retail shop, that sounds like a cheap way to announce a sale. The risk is real: those tools usually break WhatsApp’s terms, the number can be restricted or banned, and messaging people without permission can create problems under Indian data protection law.

There are three sets of rules to think about:

1. WhatsApp’s own policies (Meta’s terms for businesses).
2. India’s data protection law (the DPDP Act, 2023 and the DPDP Rules, 2025).
3. TRAI’s rules on commercial communication (which apply to telecom SMS and calls).

1. What WhatsApp’s policy requires

The WhatsApp Business Messaging Policy applies to both the WhatsApp Business app and the WhatsApp Business Platform. The parts that matter for marketing:

• Opt-in first. You may only contact people if they have given you their phone number and you have received their opt-in permission to receive messages from you. Meta’s opt-in guidance says the opt-in must clearly state that the person is opting in and name your business, and you must comply with applicable law. Opt-in can be collected on a website, by SMS, by phone, or in person or on paper.
• Honour opt-outs. You must respect every request to stop messaging, whether made on WhatsApp or elsewhere, and must not “confuse, deceive, defraud, mislead, spam, or surprise people.”
• Approved templates. On the Platform, you “may only initiate conversations using an approved Message Template.” Promotional messages are sent as marketing templates, which Meta reviews.
• Enforcement. Meta may limit or remove access for businesses that receive significant negative feedback or that message people “at scale in an unauthorized manner.” Users can block or report a business, and Meta can limit how many messages it sends.
• Restricted products. Some goods and services can’t be promoted, or can only be promoted in certain countries (the policy lists categories such as alcohol, drugs and medical and healthcare products). Check the policy before promoting anything regulated.

Meta also applies limits of its own on the Platform, such as messaging limits for templates sent outside a customer service window and a cap on how many marketing templates a given person receives from businesses.

Official API vs unofficial bulk tools

The official route is the WhatsApp Business Platform, used directly or through a provider such as AiBukko. Tools that automate a regular WhatsApp account, or use a pool of numbers to dodge limits, are not sanctioned by Meta. Using them is the quickest way to get a number banned.

2. India’s DPDP Act, 2023: consent and notice

The Digital Personal Data Protection Act, 2023 governs how digital personal data is processed in India. A customer’s name and mobile number are personal data. Key points for marketers, in plain English:

• Notice. When asking for consent, you must give the person a notice explaining what personal data you’re collecting and why, and how they can withdraw consent or complain (Section 5).
• Valid consent. Consent must be given freely and be specific, informed, unconditional and unambiguous, shown by a clear affirmative action, limited to the data needed for the stated purpose (Section 6). A pre-ticked box or a number copied from a bill is unlikely to qualify.
• Easy withdrawal. A person can withdraw consent at any time, and withdrawing must be as easy as giving it. After withdrawal, you must stop processing their data for that purpose within a reasonable time.
• Security and breaches. Businesses (called “Data Fiduciaries”) must take reasonable security safeguards and report personal data breaches as the Rules require (Section 8).
• Penalties. The Act’s Schedule sets significant financial penalties for breaches of these duties.

Timeline: MeitY notified the Digital Personal Data Protection Rules, 2025 on 13 November 2025. Some provisions took effect on publication; most of the obligations on businesses take effect in phases over the following months. Check the official MeitY documents, and your lawyer, for which rules apply to you today.

3. TRAI rules: what they cover

TRAI’s Telecom Commercial Communications Customer Preference Regulations, 2018 (TCCCPR), most recently amended in February 2025, govern unsolicited commercial communication sent through telecom networks: promotional SMS and voice calls. They set up the DLT registration system for headers and templates and define “Unsolicited Commercial Communication” as commercial communication that is neither as per the recipient’s consent nor their registered preferences.

These regulations are written for telecom access providers, senders and telemarketers using telecom resources. Whether and how these rules apply to a particular channel, including WhatsApp, is a question to put to your lawyer. The principle is the same either way: send commercial messages only to people who agreed to receive them.

A compliant WhatsApp campaign checklist

1. Use the official WhatsApp Business Platform, directly or through a provider like AiBukko.
2. Collect opt-in properly: a clear statement naming your business and the kinds of messages you’ll send, plus a DPDP-style notice. Keep a record of when and how each person opted in.
3. Never buy or scrape contact lists.
4. Use approved marketing templates for offers and announcements.
5. Include an easy way to opt out and act on it quickly.
6. Send what people expect, at a sensible frequency and time of day.
7. Watch your quality. Rising blocks and reports are a signal to slow down.
8. Check product restrictions in Meta’s policy before promoting regulated goods.
9. Secure customer data and limit who in your team can export contacts.

How AiBukko helps you stay on the right side

AiBukko is a WhatsApp platform by Vraja Labs that runs on Meta’s official WhatsApp API. For campaigns, that means:

• Messages go out through the official Platform, not an unofficial bulk tool.
• Campaigns use templates that Meta approves before sending.
• Replies to a campaign land in the shared multi-agent inbox, so your team can answer customers quickly.

Using the official API does not replace consent. Your business still needs to collect opt-in, keep a record of it and honour every opt-out. For how AiBukko handles data, see AiBukko security.

See WhatsApp marketing campaigns, and how it works for retail shops and salons.

Frequently asked questions

Is it legal to send WhatsApp marketing messages in India?

It can be, when you use the official WhatsApp Business Platform, message only people who opted in, follow Meta’s policies and meet the DPDP Act’s consent and notice requirements. This is general information, not legal advice.

Can I send WhatsApp offers to every number in my customer database?

Only to people who have agreed to receive messages from your business. A phone number on a bill is not the same as opt-in.

Will my number be banned for sending bulk WhatsApp messages?

Meta may restrict businesses that message people at scale in an unauthorized way or receive lots of negative feedback. Using the official API, opted-in lists and approved templates reduces that risk.

Does the DLT registration for SMS apply to WhatsApp?

DLT is part of TRAI’s framework for telecom SMS and calls. WhatsApp business messaging follows Meta’s own template approval process. Ask your lawyer how the rules apply to your business.

Does the DPDP Act apply to small businesses?

The Act applies to processing of digital personal data in India and does not exempt businesses simply for being small, though the Government can notify exemptions for certain classes of Data Fiduciaries. Check the current Rules with your lawyer.

Next steps

Book a demo to see how AiBukko runs WhatsApp campaigns on Meta’s official API.

Sources

• WhatsApp Business Messaging Policy: https://business.whatsapp.com/policy
• Meta, Get opt-in for WhatsApp: https://developers.facebook.com/docs/whatsapp/overview/getting-opt-in
• Meta, Template fundamentals (messaging limits, per-user marketing template limits): https://developers.facebook.com/documentation/business-messaging/whatsapp/templates/overview
• Digital Personal Data Protection Act, 2023 (MeitY): https://www.meity.gov.in/static/uploads/2024/02/Digital-Personal-Data-Protection-Act-2023.pdf
• Digital Personal Data Protection Rules, 2025 (MeitY): https://www.meity.gov.in/documents/act-and-policies/digital-personal-data-protection-rules-2025-gDOxUjMtQWa
• MeitY, Explanatory note to the DPDP Rules, 2025: https://www.meity.gov.in/writereaddata/files/Explanatory-Note-DPDP-Rules-2025.pdf
• TRAI, TCCCPR (Second Amendment) Regulations, 2025: https://www.trai.gov.in/sites/default/files/2025-02/Regulation_12022025.pdf
• TRAI press release No. 11/2025 on TCCCPR amendments: https://www.trai.gov.in/sites/default/files/2025-02/PR_No.11of2025.pdf