Marketing Consent Under DPDP: The Rules for Email, SMS and WhatsApp

Who this is for: marketing, growth and CRM leaders, and the founders and compliance teams who approve campaigns.

Marketing is where most Indian businesses will feel the DPDP Act first. Customer lists built up over years, WhatsApp broadcasts, SMS blasts, lead-generation partners and retargeting audiences all rely on personal data, and much of it was collected without the kind of consent the Act now requires.

This guide explains the rules for direct marketing and how to bring an existing marketing operation into line. For the general consent standard, see Valid Consent Under DPDP.

Why marketing usually needs consent

The DPDP Act allows only two lawful grounds: consent, or a specific legitimate use under Section 7. For marketing, the legitimate uses rarely help:

• There is no legitimate interests ground of the kind GDPR marketers rely on.
• Section 7(a) covers data an individual voluntarily provides for a specified purpose, such as delivering an order. It does not extend to promoting other products. See legitimate uses under DPDP.

So promotional emails, SMS, WhatsApp messages and calls to individuals will, in most cases, need consent that meets Section 6(1): free, specific, informed, unconditional, unambiguous and given by a clear affirmative action.

What valid marketing consent looks like

• Separate from the purchase. An unticked checkbox or toggle, not part of accepting the terms of service.
• Specific to purpose and channel. "Offers by WhatsApp" and "newsletters by email" are different choices. Let people pick.
• Preceded by a notice under Section 5 and Rule 3: what data, which purpose, how often, how to withdraw. See how to write a DPDP privacy notice, which includes a WhatsApp example.
• Recorded with the notice version, channel and timestamp, so you can prove it under Section 6(10).
• Free of dark patterns such as pre-ticked boxes and confirmshaming. See 7 consent dark patterns.

Channel by channel

Service messages, such as order confirmations, OTPs and delivery updates, are a different purpose and can generally rely on Section 7(a). Keep them free of promotional content, or they become marketing.

Purchased, rented and scraped lists

Lists bought from data brokers, rented from partners or scraped from websites are among the highest DPDP risks in marketing:

• You must show a valid lawful basis for your own processing. A seller's assurance that "consent was obtained" rarely covers your specific purpose and brand.
• Data scraped from the web is generally not excluded from the Act. Only data the individual made public themselves, or that is published under a legal obligation, falls outside it.
• Under Section 6(10), you carry the burden of proving consent.

If you cannot prove consent that covers your use, do not use the list.

Lead-generation partners

Leads from aggregators, affiliates and comparison sites should come with evidence: the notice shown, the consent wording, the timestamp and your organisation named as a recipient. Make this a contractual requirement, and spot-check it.

Withdrawal must work everywhere

Section 6(4) requires withdrawal to be as easy as giving consent, and Section 6(6) requires processing to stop within a reasonable time, including at processors. In practice:

• every message includes a working opt-out for that channel
• an opt-out on one platform reaches your CRM, email tool, SMS gateway, WhatsApp provider and ad audiences
• suppressed contacts are not re-added from old lists or new imports

Your existing database

Most businesses hold marketing contacts collected before the DPDP Act. Before 13 May 2027:

1. Segment contacts by source and the consent evidence you hold.
2. Send a notice under Section 5(2) to contacts processed on earlier consent, as soon as reasonably practicable.
3. Re-consent contacts whose original consent would not meet the DPDP standard, through a clear opt-in campaign.
4. Suppress contacts with no defensible basis.
5. Record the outcome for each contact.

Expect your list to shrink. A smaller list with valid consent is worth more than a large one you cannot defend, and engagement rates usually improve.

Children

Section 9(3) prohibits targeted advertising directed at children, even with parental consent. If your audience includes under-18s, marketing to them must stop, and consent from parents covers marketing to parents only.

Common mistakes

• Treating a purchase as marketing consent. Section 7(a) covers the order, not promotions.
• One opt-in for every channel. Consent should be specific.
• Uploading customer lists to ad platforms without consent. This is processing too.
• Opt-outs that don't propagate. Contacts who opt out on WhatsApp keep receiving emails.
• Re-importing suppressed contacts. Old spreadsheets undo good practice.

How ConsentifyAI helps

ConsentifyAI captures marketing consent per purpose and channel across web, app, branch and partner journeys, with versioned notices in the languages your customers read. Withdrawals from any channel propagate to your CRM, email, SMS and WhatsApp tools as events, and every consent and opt-out is recorded in a tamper-evident audit trail, ready for re-consent campaigns and proof of consent.