DPDP and marketing consent: 2 regimes, and the one in force is not DPDP

A business marketing to Indian customers is subject to 2 separate bodies of law that are usually merged into 1 in the advice it receives. They have different scopes, different machinery and, most importantly today, different commencement dates.

The regime that is in force

The Telecom Commercial Communications Customer Preference Regulations, 2018, made by the Telecom Regulatory Authority of India on 19 July 2018, have been in force since 2018. Regulation 2, as first notified, defines what they reach:

"“Commercial Communication” means any voice call or message using telecommunication services, where the primary purpose is to inform about or advertise or solicit business for (A) goods or services; or (B) a supplier or prospective supplier of offered goods or services; or (C) a business or investment opportunity; or (D) a provider or prospective provider of such an opportunity"

Voice calls and messages, sent for a promotional purpose. The machinery built on that definition runs through Access Providers, registered senders, headers and customer preferences, and its operative terms are set by the regulation and its amendments rather than by the DPDP framework.

Note what this article does not do. The words quoted above are the definition as first notified on 19 July 2018. TRAI's own regulation listing records an amendment and a corrigendum of 21 December 2018 and a Second Amendment of 12 February 2025, and a draft Third Amendment went out for consultation in 2026 proposing further changes to the definitions in regulation 2. This site holds none of them, so it has not verified that the definition still reads this way, and nothing here states what the current consolidated telecom obligations are. What the archived text establishes is that this regime existed and was commenced years before the DPDP consent provisions, which is the only comparison drawn below.

The regime that is not

The DPDP consent standard is section 6(1):

"The consent given by the Data Principal shall be free, specific, informed, unconditional and unambiguous with a clear affirmative action, and shall signify an agreement to the processing of her personal data for the specified purpose and be limited to such personal data as is necessary for such specified purpose."

This governs the personal data used for a marketing purpose in any channel, because the Act regulates personal data rather than communication technologies. A phone number, an email address and a device identifier are all personal data if the individual is identifiable, and the channel is irrelevant to that question.

But section 6 sits in the 18 month commencement group of notification G.S.R. 843(E), computed as 13 May 2027 and interpretation until officially confirmed. The only part of section 6 that arrives earlier is sub-section (9), on registration of Consent Managers, in the 1 year group.

So a business told to obtain "DPDP compliant marketing consent" today is being pointed at a provision that is not in force. The obligations in force today come from the telecom regime, so far as regulation 2 as currently amended reaches the channel in question, and from whatever other law applies. That is not an argument for doing nothing, for the reason set out at the end, but it is a reason to be precise about which rulebook a requirement comes from.

The 2 regimes are cumulative, not alternative

Section 38(1) settles this:

"The provisions of this Act shall be in addition to and not in derogation of any other law for the time being in force."

When section 6 commences, complying with the telecom regime will not discharge the DPDP obligation, and vice versa. They ask different questions. The telecom rules ask whether this communication may be sent to this number. The DPDP rules ask whether the personal data behind the campaign may be processed for that purpose at all, and whether the individual can withdraw.

Section 6(4) is where that second question has teeth for marketing:

"Where consent given by the Data Principal is the basis of processing of personal data, such Data Principal shall have the right to withdraw her consent at any time, with the ease of doing so being comparable to the ease with which such consent was given."

Comparable ease, applied to marketing, is a statement about the unsubscribe path relative to the sign up path. A 1 tap opt in against an unsubscribe that requires signing in and finding a preferences screen is the shape most exposed to it. The statute says comparable rather than identical, we have found no Indian decision construing it, and section 6 is not in force, so this is a reading of the words and not a finding that any particular flow is non compliant.

Where the boundary is genuinely unclear

The most repeated proposition in this area is that the telecom rules cover SMS and calls but not WhatsApp or email, leaving those channels to DPDP alone. The archived regulation supports part of that and does not settle the rest.

What the document's text shows: the word WhatsApp appears 0 times in the text layer of its 113 pages. "Email" appears 4 times, none of them in a definition or an operative regulation, all in the explanatory material. The definitions are built around telephone numbers, Access Providers and "Telecom resources", which regulation 2 defines as any telegraph used to send voice call or messages. Regulation 2 nowhere defines "telecommunication services", and it defines "Message" only by borrowing clause (3) of section 3 of the Indian Telegraph Act, 1885, so the outer edge of the operative phrase is set by that Act rather than by anything in this regulation.

What the document does not say: that a message sent through an over the top application is outside "any voice call or message using telecommunication services". That is a reading, and a contestable one, since such messages do travel over telecommunication networks. This site does not decide it. A marketing team that treats app messaging as wholly outside the telecom regime is relying on an inference, not on the text, and the amendments this site does not hold may bear on it.

The 1 hard prohibition

Section 9(3) is the exception to everything above, because it is not a consent question:

"A Data Fiduciary shall not undertake tracking or behavioural monitoring of children or targeted advertising directed at children."

On the face of the sub-section no consent unlocks it, parental or otherwise, because it is not written as a consent requirement. That is a reading of the structure, not a construction any authority has given it. Section 9(4) and section 9(5) provide the routes out, and Rule 12 with the Fourth Schedule exercises the 9(4) power for listed classes and purposes, none of which is drawn for delivering advertising, although Part B item 5 does reach processing done to keep harmful advertisements away from children. None of this is in force yet. G.S.R. 843(E) puts sections 7 to 10 in the same 18 month group as section 6, and Rule 1(4) puts Rules 3, 5 to 16, 22 and 23, Rule 12 among them, in the 18 month group of the Rules' own commencement clause, so the prohibition and its exemptions arrive together on the computed date of 13 May 2027, interpretation until officially confirmed. If your audience is likely to include children and you run behavioural advertising, that is a design question rather than a consent screen question.

What to actually do before 2027

The precise position is that the DPDP provisions governing marketing data are not in force today and are due on a computed date roughly 9 months away, while the telecom regime has been in force since 2018. How far that regime reaches a particular campaign turns on the definition in regulation 2 as currently amended, which this site does not hold. The useful preparation follows from the difference between the 2 questions.

The telecom regime is about the send. The DPDP regime is about the record: which individuals, for which stated purpose, on what evidence, and how they get out. The Act's only transitional provision is section 5(2), which covers consent given before its commencement: notice as soon as it is reasonably practicable, after which processing may continue until the individual withdraws. Whether that provision reaches consent taken today is unsettled, since the Act commenced in stages from 13 November 2025 and section 5 is itself in the 18 month group. Our recommendation, not a requirement, is that a list assembled today with no purpose captured and no withdrawal path is unlikely to be cured later by adding a consent banner; the notice checker tests whether the purpose you state would satisfy Rule 3, and what valid consent requires sets out the standard the record will be measured against.