Consent-First Marketing in India

Consent-first marketing is simple to say: only message people who asked to hear from you, about what they asked for, at sensible times, and stop the moment they ask. It is also good business. Customers who chose to hear from you read your messages, reply to them, and come back.

This e-book walks through the rules that shape marketing to customers in India: the Digital Personal Data Protection Act, 2023, TRAI's rules for commercial SMS and calls, quiet hours, children's data, WhatsApp opt-in and email unsubscribe. It ends with a checklist you can work through this week.

Why consent-first

For years, a lot of marketing in India worked on volume: buy a list, send a blast, hope for the best. That is ending, for three reasons.

• The law expects it. India now has a general data protection law, and telecom rules for commercial messages have been tightened over the years.
• The platforms enforce it. WhatsApp limits and bans numbers that customers block and report. Email providers send bulk mail without a working unsubscribe to spam.
• Customers notice. People are tired of messages they never asked for. A business that respects their choice stands out.

Consent-first is not about sending less. It is about sending to the right people, which tends to work better.

Three ideas to keep in mind

1. PurposeConsent is for something specific. "Booking reminders" and "offers" are different purposes.
2. ChannelSaying yes on WhatsApp is not saying yes on SMS or email.
3. ProofIf you cannot show when and how someone agreed, treat it as if they did not.

The DPDP Act in plain words

The Digital Personal Data Protection Act, 2023 (often called the DPDP Act) is India's general law on personal data in digital form. Rules made under the Act fill in details and timelines. What follows is a general outline of the ideas that matter most for marketing; ask your lawyer what applies to you and from when.

Who is who

• The data principal is the person the data is about: your customer.
• The data fiduciary is the business that decides why and how the data is used: you.
• A data processor processes data on the fiduciary's behalf, such as a software provider. Using one does not move your responsibilities to them.

What good consent looks like

Under the Act, where you rely on consent, it should be:

• Free. Not forced, and not bundled as a condition for something unrelated.
• Specific. Given for a stated purpose, not "anything we like".
• Informed. The person knows what they are agreeing to.
• Unambiguous, with a clear action. They tick a box, tap a button or send a message. Silence, inactivity or a pre-ticked box is not consent.
• Limited to what is needed for that purpose.
• Easy to withdraw. Withdrawing should be about as easy as giving consent was.

The notice

When you ask for consent, you give the person a notice in clear, plain language. In general terms it tells them what personal data you will collect, the purpose, how they can withdraw consent and use their rights, and how they can complain to the Data Protection Board of India. The person should be able to read it in English or in one of the languages listed in the Constitution.

Rights of the data principal

At a general level, your customer can:

• ask for a summary of the personal data you hold and how you use it;
• ask you to correct, complete, update or erase their data;
• have their grievances heard by you, before going to the Board;
• nominate someone to act for them in case of death or incapacity.

Your duties, in short

• Use data only for the purpose it was given for.
• Keep it accurate when you use it to make decisions about the person.
• Protect it with reasonable security safeguards, including over your software providers.
• Tell the Board and affected people about a personal data breach, as the rules require.
• Erase it when the purpose is served and you have no legal need to keep it, and when consent is withdrawn.
• Publish a way for people to contact you about their data.

Your software providers

Most small businesses use software to store customer data and send messages: a billing system, a booking app, a messaging platform like Hey Tomo. Under the Act you remain responsible for how your customers' data is handled, even when a provider processes it for you. Choose providers that keep data secure, use it only on your instructions, help you honour access and erasure requests, and tell you quickly if something goes wrong. Read their terms and data processing commitments, and keep a list of who holds what.

SMS rules: TRAI and DLT

Commercial SMS and calls in India are governed by the Telecom Regulatory Authority of India (TRAI). Its Telecom Commercial Communications Customer Preference Regulations, 2018, usually shortened to TCCCPR, set up the system the industry calls DLT, for Distributed Ledger Technology. Telecom operators run DLT platforms, and every business that sends commercial SMS has to register on one.

The pieces of DLT

• Principal Entity (PE). Your business, registered on a DLT platform with its own identity. Every SMS is sent on behalf of a Principal Entity.
• Header. The sender name customers see, such as a six-letter code for your brand. You register your own headers.
• Content templates. The exact wording of each SMS you plan to send, with marked spaces for the parts that change. Templates are registered under categories such as promotional, transactional and service messages.
• Consent templates. The wording you use to ask a customer for consent, registered so that consent collected for a purpose can be recorded and checked.
• Scrubbing. Before an SMS is delivered, the operator checks it against what is registered: the right Principal Entity, header and template, and, for promotional messages, the customer's stated preferences and consent. A message that does not match is blocked.

What this means for your SMS

• You may send only text that matches a template your own business registered, exactly. Change a word and it may not be delivered.
• Each business uses its own registration. Borrowing another company's approved templates or header, including your SMS provider's, is not the right way to send your messages.
• Customers who registered a "do not disturb" preference will not get your promotional SMS unless the rules allow it, for example with their explicit consent recorded properly.

How Hey Tomo handles SMS

Hey Tomo sends SMS only through your business's own DLT registration, with your own Principal Entity, header and template IDs. You fill in the variables; you do not write free text, and AI never writes or rewrites DLT SMS wording. Hey Tomo can offer ready-made wording for common messages. Picking one adds an entry marked "Needs registration", with the wording copied exactly. Nothing sends it until your business registers it on DLT and enters the approved template ID, header and text. Your SMS provider can help you with registration.

Our guide Register SMS templates on DLT walks through it, and the glossary entry for DLT has the short version.

Quiet hours and daytime marketing

TRAI's rules restrict promotional calls and SMS to daytime hours, so a marketing SMS cannot simply be sent at midnight. Check the exact permitted window with your SMS provider, because the details are set by the regulator and can change.

Even where a channel has no fixed legal window, such as WhatsApp or email, the same courtesy applies. An offer that arrives at 11 at night reads as careless, and it is the kind of message people block.

How to think about it

• Marketing (offers, new arrivals, win-back) keeps quiet hours on every channel.
• Reminders (an appointment tomorrow, a bill due, a class at five) also keep quiet hours. They are useful, but they are not urgent at 6 in the morning.
• Service messages the customer is waiting for, such as a reply to their own question, an OTP they requested or a delivery at the door, may go at any hour.

In Hey Tomo, quiet hours apply to marketing and reminders. Only service messages may use the owner's 24/7 option. A message that comes due during quiet hours waits until the morning, and the consent check runs again before it goes.

Time zones and timing

If you have customers abroad, quiet hours should follow the customer's local time where you know it. And avoid sending everything at the exact start of the day. Spreading messages over the morning is kinder, and replies are easier for your team to handle.

Children's data and under-18s

The DPDP Act treats anyone under 18 as a child. In general terms, it expects a business to get verifiable consent from a parent or lawful guardian before processing a child's personal data. It also says businesses should not process children's data in ways likely to harm their well-being, and should not track, monitor the behaviour of, or target advertising at children. The rules under the Act set out details and some exceptions; ask your lawyer how they apply to you.

What this means in practice

• No marketing to under-18s. Ever. Hey Tomo never sends marketing to a customer marked as under 18, on any channel.
• Reminders go to the parent or guardian. A coaching centre's class reminder or a paediatric clinic's appointment reminder goes to the guardian's number, not the child's.
• Ask for age where it matters. If your business serves young people, such as coaching, sports academies or some retail, ask for date of birth or confirm "18 or over" when a customer signs up.
• When in doubt, treat them as a minor. If you do not know a customer's age and your business serves children, leave them out of marketing until you do.
• Keep it out of segments. Do not build audiences for offers that could include children, such as "students in class 10".

WhatsApp opt-in

WhatsApp's own business policies require businesses to get a customer's opt-in before messaging them, and to respect requests to stop. Combined with the DPDP Act's expectations for consent, that gives a clear rule: get a real, specific yes before you message anyone on WhatsApp.

A good WhatsApp opt-in

• Names your business, so it is clear who will message them.
• Says it is WhatsApp, not "your phone".
• Says what kind of messages: reminders, order updates, offers, or a mix.
• Is an action the customer takes: a tick in an unticked box, a tap on a button, or a message they send to you.
• Tells them how to stop.

Stop requests

People rarely type the exact word you expect. "Stop", "unsubscribe", "no more messages", "band karo", "mat bhejo" and "please don't message me" all mean the same thing. Treat a clear stop request in any language as an opt-out. Hey Tomo does. If you confirm it, keep the confirmation short, with nothing else attached.

Only through official channels

Send business WhatsApp messages only through the official WhatsApp Business Platform, and Instagram and Facebook messages only through their official business tools. Unofficial libraries, browser automation and bots risk bans and can put customer data in the wrong hands.

Email: unsubscribe and honest senders

Email has fewer India-specific rules than SMS, but the DPDP Act still applies to the personal data involved, and the large email providers set their own expectations for anyone sending bulk mail.

What every marketing email needs

• A clear unsubscribe link, easy to find, that works in one or two clicks without logging in. Large mailbox providers increasingly expect bulk senders to support one-click unsubscribe.
• A real sender name and address, so people know it is you.
• A subject line that matches the content. No fake "Re:" or "Your order" on an offer.
• A preference option, so a customer can keep receipts but drop offers.

Honour it quickly

Process an unsubscribe straight away, and keep that address on a suppression list so it is never re-added by a later import. A suppression list is a record of who asked not to be contacted; it is not deleted when you clean up old data.

Service emails

Receipts, password resets and booking confirmations are service emails. They can go to customers who have unsubscribed from marketing, as long as they stay service-only. The moment you add an offer, it becomes marketing.

Keeping records of consent

If a customer, a platform or a regulator asks "did this person agree?", you should be able to answer quickly and clearly. That means keeping a record of each consent, and of each withdrawal.

What to record

Good records also make day-to-day questions easy. When a customer writes "why am I getting these messages?", you can look up the moment they opted in and show them, politely, then offer to stop.

Good habits

• Never overwrite. Add a new entry for each change, so the history stays intact.
• Keep withdrawals and suppression lists even when you delete other old data. They are how you make sure someone who said stop is not messaged again.
• Version your wording. When you change the opt-in text, keep the old version, so you know what each person agreed to.
• Check at send time. A record is only useful if your system reads it before every message. Hey Tomo checks consent before a message is queued and again at the moment it is sent.
• Handle requests in steps. When a customer asks to see, correct or erase their data, confirm it is really them, act on it within a reasonable time, and record what you did.
• Keep imports honest. When you import customers from a spreadsheet, import their consent too, with its source. If you do not know it, do not mark them as opted in.

Six common myths

These come up again and again when small businesses talk about marketing rules. Each one sounds reasonable and leads to trouble.

"They gave me their number, so I can message them."

A number given for a delivery or a bill was given for that purpose. Using it for offers is a different purpose, and needs its own consent.

"They are an old customer, so it is fine."

Buying from you once, or ten times, is not the same as agreeing to marketing. Ask. Loyal customers are usually happy to say yes, and the ones who say no would not have read your offers anyway.

"It is a service message, so I can add a small offer."

Adding a promotion to an order update or a reminder turns it into marketing. On SMS it would no longer match your registered service template. On WhatsApp it belongs in the marketing category. Keep service messages clean.

"The rules are only about SMS."

TRAI's DLT system is about SMS and calls, but the DPDP Act covers personal data whatever the channel, and WhatsApp and email providers have their own opt-in and unsubscribe expectations.

"If they do not reply STOP, they are happy."

Many unhappy customers do not reply at all. They mute you, block you or report you. Watch opt-outs and blocks, and if a message drives either up, stop it and rethink.

"My software provider handles compliance for me."

Good software helps a great deal: it can check consent before every send, keep quiet hours and process opt-outs. But you decide who to message and why, so the responsibility for consent stays with your business.

The consent-first checklist

Work through this list with your team. Most businesses can finish it in a week.

Collecting consent

• Every opt-in names your business, the channel and the purpose.
• Marketing and service messages have separate choices.
• No box is pre-ticked. No consent is a condition for an unrelated service.
• Your notice says what data you collect, why, and how to withdraw or complain.
• You ask for age, or confirm 18 or over, where your business serves young people.

Sending

• Consent is checked before each message and again when it is sent.
• No marketing ever goes to anyone under 18; reminders go to a parent or guardian.
• Marketing and reminders keep quiet hours. Only service messages go at any hour.
• SMS uses only your own DLT registration: your Principal Entity, header and approved templates, word for word.
• WhatsApp, Instagram and Facebook go only through their official business tools.
• Every marketing email has a working unsubscribe link.
• You test new journeys in test mode, where nothing is sent.

Stopping

• A stop request in any language works, including "band karo" and "mat bhejo".
• Opt-outs take effect straight away, and the customer gets a short confirmation.
• Suppression lists and consent records are never deleted in a clean-up.

Records and rights

• Each consent and withdrawal is recorded with who, what, when, where and the wording seen.
• Customers have a clear way to ask what you hold, correct it, or have it erased.
• You know who to call, and what to do, if there is a data breach.
• You have checked your approach with a lawyer.