In 2026, sending bulk WhatsApp legally in India is straightforward if you follow four rules: (1) use the official Meta WhatsApp Business API, (2) only message contacts with verifiable opt-in, (3) only send Meta-approved templates outside the 24h service window, and (4) provide one-tap unsubscribe. Here is the complete legal playbook for DPDP Act + Meta Business Messaging Policy.
DPDP Act 2023 — what bulk senders must do
- Notice & consent — before contact, explain what data you collect and why, and obtain explicit consent.
- Purpose limitation — only use data for the stated purpose; don’t cross-pollinate.
- Data minimisation — collect only what you need.
- Withdrawal of consent — must be as easy as giving it (i.e. one-tap).
- Grievance officer — publish contact for complaints.
- Records — keep auditable proof of consent (timestamp + source + IP).
Meta Business Messaging Policy basics
- Outside the 24h customer-service window, you can only send approved templates.
- Templates fall into four categories: marketing, utility, authentication, service.
- Quality rating (Green / Yellow / Red) determines your daily messaging tier. Spam = Red.
- Repeated user blocks or reports drop your quality rating fast.
- Buying / scraping numbers without opt-in violates policy and risks number ban.
Capturing verifiable opt-in
Acceptable opt-in sources Meta documents and audits:
- Web form with checkbox (unchecked by default) and clear consent text.
- WhatsApp chatbot “send me updates” button.
- Checkout opt-in at ecommerce.
- QR scan + reply YES.
- IVR with verbal consent capture.
- Click-to-WhatsApp ad initiation by user.
WappBlaster captures all of these with timestamp + source + IP, ready for DPDP audit.
Unsubscribe handling
- Every marketing template should include “Reply STOP to unsubscribe” or a one-tap unsubscribe button.
- Opt-outs must be honoured across all future marketing — category-wise opt-out is best.
- Keep an audit log of opt-outs with timestamp.
Sample opt-in language (adapt with your lawyer)
“By ticking this box and sharing your WhatsApp number, you consent to {Brand} sending transactional and promotional WhatsApp messages under the WhatsApp Business Platform. You can withdraw consent anytime by replying STOP or using the unsubscribe link.”
This is not legal advice — have counsel review for your sector, especially BFSI and health data.
What enforcement actually looks like in 2026
Meta enforces messaging behaviour through quality rating and template blocks. Indian privacy regulators focus on consent evidence and breach notification. The practical risk for sloppy marketers is not always a court case first—it is lost reach when your number turns red and throughput collapses.
Protecting your number quality rating
- Segment hard — never blast everyone the same message.
- Use the right category — marketing for promo, utility for transactional.
- Spread sends across the day; avoid 10k-in-a-minute bursts.
- Honor opt-outs within minutes, not hours.
- Use 24h service-window replies for free, fast support conversations.
Stay legal — and scale
👉 Book a 1:1 compliance & setup call. WappBlaster ships DPDP-aligned consent, Meta-policy templates and opt-out handling out of the box at ₹7,999/yr.
