Last reviewed: 27 August 2026. Basis: DPDP Act, 2023 and DPDP Rules, 2025 (notified November 2025).
Marketing is the function most likely to draw the first DPDP Act complaint, because it touches the most people, uses the most channels and is the easiest thing for a data principal to notice and object to. Under Section 6, marketing consent must be free, specific, informed, unconditional and unambiguous, and withdrawal must be as easy as giving it. This page maps that standard to each channel, explains how to triage a CRM with no consent records, and shows how to measure campaigns without personal data. Most obligations become enforceable in May 2027, but consent collected today is what you will rely on then.
Why marketing is the fastest route to a DPDP Act marketing consent penalty
Marketing processes personal data for the company’s own benefit, and Section 7 gives it no shelter. The legitimate uses cover voluntary provision for a specified purpose, employment, medical emergencies and State functions. Promotional messaging is not on the list, and there is no GDPR-style legitimate interests test to fall back on. In our reading, consent under Section 6 is the only lawful basis for outbound marketing, obtained with a Section 5 notice that names the purpose plainly.
Volume and visibility make marketing uniquely exposed: one badly worded checkbox becomes lakhs of defective consents, and the unwanted message itself is the evidence. On penalties, marketing failures generally fall in the “other breaches” band of up to Rs 50 crore in the Schedule, and if the audience includes anyone under 18, Section 9’s ban on tracking and targeted advertising directed at children moves exposure to the Rs 200 crore band. Our penalties Schedule explainer covers how gravity, duration and repetition are weighed.
WhatsApp marketing consent under DPDP: opt-in is not the same as a phone number
Meta’s WhatsApp Business policy requires an opt-in before marketing templates are sent, and many teams treat that opt-in as proof of DPDP consent. It is not. The platform opt-in is usually a bundled line in checkout terms, an auto-ticked box, or inferred because the customer messaged first. Section 6 requires consent that is specific (marketing named as a purpose, separate from order updates), unconditional (the purchase cannot depend on it) and unambiguous (an affirmative act, not silence). A customer asking for delivery status has, at most, volunteered their number for that purpose under Section 7; they have not consented to a weekly catalogue.
The second gap is withdrawal. If a customer opted in with one tap, replying “STOP” must work across every template and every sending vendor, without a helpline call. Keep a consent record per number showing the wording shown, timestamp, source and any withdrawal event. That record is your defence when the Board asks.
Channel-by-channel consent table
The standard is the same on every channel; the mechanics differ.
| Channel | What lawful consent looks like | Common failure | Withdrawal that satisfies parity |
|---|---|---|---|
| WhatsApp Business | Separate, unticked opt-in naming promotional messages; record of wording and timestamp | Treating a service conversation as marketing opt-in | Reply STOP honoured within one business day across all vendors |
| SMS | TRAI DLT consent registration for the headers and templates used, plus DPDP consent for the purpose (DLT registration alone is telecom compliance, not DPDP consent) | Promotional templates registered as transactional; consent “acquired” from a purchased list | Reply STOP or a one-tap link; sync suppression to the DLT consent register |
| Unticked marketing checkbox at signup, or a double opt-in confirmation; transactional email stays separate | Bundling marketing into “I agree to the terms” | One-click unsubscribe link in every message; no login required | |
| App push | OS permission prompt plus in-app purpose notice; promotional pushes separate from service alerts | Using the OS prompt (which only controls delivery) as consent for profiling | In-app toggle mirrored to the backend, not just the device |
| Retargeting pixels and cookies | Consent before non-essential tags fire; a reject option as prominent as accept | Firing Meta and Google pixels on page load before any choice | Re-open the banner from a persistent footer link; clear identifiers on withdrawal |
| Lookalike and custom audiences | Consent notice that names sharing hashed identifiers with ad platforms as a purpose | Uploading the entire CRM to an ad platform under a generic “improve our services” purpose | Remove withdrawn contacts from uploaded audiences at the next sync, and log it |
| Purchased or rented lists | Consent that the list seller obtained for your marketing, in writing, verifiable per record | Assuming the seller’s consent covers a new fiduciary and a new purpose | Practically impossible; suppress and do not use |
On SMS: TRAI’s DLT framework is enforced by telecom operators to control spam; the DPDP Act is enforced by the Board to protect the person. A template can be DLT-compliant and still unlawful under Section 6 because the consent was never specific or was withdrawn. Run both registers, and make sure a STOP on one updates the other.
Email marketing under the DPDP Act: notice, separation and unsubscribe
From May 2027, sending to a contact without a consent record you can produce is processing without a lawful basis, however old the list.
What the notice must say
Section 5 requires the notice to describe the data and purpose and to explain how to withdraw consent, exercise rights and complain to the Board. For a marketing signup that is a short, visible line at the point of collection, not a link to a 4,000-word policy. Our Section 5 notice guide has wording that survives both legal and conversion-rate review.
Transactional versus promotional
Order confirmations, invoices and password resets can rely on Section 7 voluntary provision. Add a “you might also like” block and the same email becomes marketing. Keep the streams separate so a marketing withdrawal does not break service messaging.
Unsubscribe parity
If signup took one click, unsubscribe must take one click. Preference centres that require a login, “are you sure” interstitials, or a ten-day processing window fail Section 6 in our reading. Honour the request in the sending platform, the CRM and every downstream sync; a person who unsubscribes and receives one more email has a clean complaint.
CRM data DPDP compliance: triaging a legacy database with no consent record
“We have 8 lakh contacts and no idea where half came from. Do we delete them?” Not necessarily, but you cannot keep marketing to them as if nothing changed. We recommend a triage, run before May 2027.
Step 1: classify every record by provenance
Tag each contact with the best evidence you have: an opt-in event with wording and timestamp; a customer relationship with an order date; an event badge scan; an imported file with no source. Provenance also tells you how long you can defensibly keep the record under Section 8.
Step 2: apply a decision rule
| Provenance | Treatment |
|---|---|
| Documented opt-in that names marketing | Keep; consent already meets Section 6 |
| Customer with a purchase but bundled or unclear consent | One re-permission message, then suppress non-responders; silence is not consent |
| Event or webinar contacts with no marketing consent | One re-permission message via the channel they used, then suppress |
| Imported or purchased lists with no traceable source | Suppress immediately; delete after the re-permission window closes |
| Contacts inactive for over three years | Delete unless a legal retention duty applies; purpose served |
Step 3: run the re-permission campaign properly
A re-permission campaign is itself processing, so keep it to one message per channel, name the purpose, make “no” as easy as “yes”, and treat no response as no. Indicative response rates in Indian B2C re-permission campaigns run between 5 and 20 percent, so budget for a much smaller but defensible list. Suppress non-responders during the window (you need a record of who declined), then delete once the window closes and no other purpose such as accounting, warranty or dispute requires retention. Our DPDP Starter Templates include a re-permission notice and a suppression log format.
Consent managers, records and the role they play for marketing
The Act creates a consent manager, registered with the Board under the Rules, through which a data principal can give, review and withdraw consent across fiduciaries. These provisions apply 12 months after notification, ahead of most other obligations. A consent manager will not replace your own capture, but it changes two things for marketing.
First, a withdrawal can arrive through a consent manager rather than your unsubscribe link, so your suppression pipeline needs an intake for third-party signals. Second, when a person can see every consent they have given in one dashboard, vague purposes such as “communications and offers” will look weak beside specific ones. Design consent records now with fields a consent manager could consume: purpose code, wording version, timestamp, channel, source and status. The Act and Rules Explorer traces the consent manager provisions against the Rules.
Cookie consent in India under the DPDP Act: what the banner must actually do
The Act has no cookie clause, but a retargeting pixel or analytics cookie that identifies a device and links it to browsing behaviour is processing digital personal data for marketing, so Section 6 applies. That matters for the banner most Indian sites copied from a European template and never configured.
Non-essential tags must not fire until the person acts; a banner that says “we use cookies” while the Meta pixel has already loaded is notice without consent. “Reject all” must be as visible as “Accept all”; burying rejection behind “Manage preferences” fails parity in our reading. Withdrawal must be reachable later through a persistent footer link that reopens the choice and clears identifiers set under the earlier consent.
Dark patterns to remove before 2027
The patterns we most often flag, each undermining a Section 6 condition: pre-ticked marketing boxes (not unambiguous); consent bundled into “I agree to the terms” (not specific); discounts or app access conditional on marketing consent (not unconditional); accept buttons in brand colour with reject in grey text, or confirmshaming copy such as “No, I don’t want to save money” (not free); unsubscribe links that lead to a login page (withdrawal harder than consent). Each is cheap to fix and expensive to defend.
Children and marketing
Section 9 prohibits tracking, behavioural monitoring and targeted advertising directed at anyone under 18, and requires verifiable parental consent for a child’s data. Brands with a teenage audience (edtech, gaming, fashion, snacks) should assume retargeting and lookalike pipelines will pull in under-18s unless designed to exclude them. The marketing consequence is simple: do not profile or target where you cannot rule out a child. Our DPDP 101 guide covers Section 9 in more depth.
Measuring campaigns without personal data
Consent-first does not mean measurement-blind, but it does mean moving from person-level tracking to aggregate and modelled measurement wherever the consent rate does not justify the risk.
Server-side event collection behind a consent gate counts conversions from consented users without leaking data to third-party scripts. Cohort analysis on data stripped of direct identifiers, and geo or time-split holdout tests (run a campaign in one set of cities against a matched control), give incrementality readings that need no individual tracking. Attribution can lean on first-party data you hold consent for, such as order counts by promo code, and on platform-side aggregated reports rather than user-level exports. Where a metric needs personal data, ask whether the purpose was in the notice; if not, it is out of scope until the notice is updated. Raw event logs tied to an identifier should have a defined lifetime, since Section 8 expects erasure once the purpose is served. Keep the aggregates, delete the rows.
Frequently Asked Questions
Is a WhatsApp Business opt-in enough for DPDP Act compliance?
No. The platform opt-in is a Meta policy requirement and is often collected in a bundled or inferred way. Section 6 needs a separate, specific, unambiguous consent for promotional messaging, backed by a Section 5 notice, and a withdrawal route that is as easy as the opt-in was.
Do we have to delete our whole CRM if we have no consent records?
No, but you cannot continue marketing to it unchanged. Classify records by provenance, run a single re-permission message where a genuine relationship exists, suppress non-responders and untraceable imports, and delete once the window closes and no other retention purpose applies.
Are cookie banners legally required in India under the DPDP Act?
The Act does not name cookies, but non-essential cookies and pixels that identify a device for advertising process digital personal data for a marketing purpose. That requires consent before the tags fire, a reject option as easy as accept, and a way to withdraw later, which in practice means a properly configured banner.
When do these marketing obligations become enforceable?
Consent manager provisions apply 12 months after the Rules were notified in November 2025, and most substantive obligations including notice, consent and data principal rights become enforceable in May 2027. Fix capture and withdrawal flows now rather than re-permissioning twice.
Related explainers
Next step
If your signup forms, WhatsApp templates, cookie banner and unsubscribe flows were built for conversion rather than for Section 6, a short review will show exactly which screens must change before May 2027. Book a Consent UX review and we will return a screen-by-screen fix list, a CRM triage plan and the consent record schema your systems should be capturing today.