Can I send WhatsApp marketing messages to customers whose numbers I already have?

Question

Accepted Answer

Not just because you have the number. A phone number given for a booking or an order can be used for that booking or order under s.7(a), but a promotional message is a different purpose, and the DPDP Act has no "existing customer" or legitimate-interests route for it. Promotions need the customer's own opt-in under s.6(1), with withdrawal as easy as the opt-in was (s.6(4)), enforceable from 14 May 2027. Service messages and promotions are two different purposes s.4(1) allows processing only with consent or for one of the "certain legitimate uses" in s.7. That list is closed. The one that fits service messages is s.7(a): data the person "voluntarily provided" for "the specified purpose", as long as she has not said she does not consent. Its pharmacy illustration is close to a WhatsApp receipt: the buyer gives her number and asks for a payment acknowledgement on her phone, and the shop may send it. A booking confirmation, a check-in link or a delivery update sits in the same place. A festive offer, a "come back" discount or a new-menu broadcast is not the purpose she gave the number for. s.7(a) does not stretch to it, and nothing else in s.7(b) to s.7(i) covers marketing. That leaves consent. Unlike European rules, there is no "existing customer" carve-out. Holding the number is not a lawful basis. What a valid opt-in looks like s.6(1) requires consent that is "free, specific, informed, unconditional and unambiguous with a clear affirmative action". In practice: A separate, unticked checkbox such as "Send me offers on WhatsApp", next to the booking or checkout form. Pre-ticked fails "clear affirmative action". Not bundled. Making a booking conditional on accepting promotions fails "free" and "unconditional". Specific. Name the channel and the kind of messages. "We may contact you" does not tell her what she is agreeing to. A reply keyword or a desk opt-in also works, provided she takes the action herself. The request must come with or after a notice (s.5(1)) covering what data you use, for what purpose, how to withdraw and how to complain to the Board. Rule 3 adds that the notice must stand on its own, itemise the data, and give a link or other means to withdraw. Rule 3 is secondary-sourced in this reference, so verify it against the notified Gazette text. Offer the notice and the consent request in English or any Eighth Schedule language (s.5(3), s.6(3)). Opting out has to be as easy as opting in If opting in took one tap, opting out cannot mean writing to a support address. s.6(4) requires the ease of withdrawal to be "comparable to the ease with which such consent was given". Replying STOP on the same WhatsApp thread fits that test. After withdrawal you must stop within a reasonable time, and make your WhatsApp vendor stop too (s.6(6)). That vendor is processing on your behalf, so you stay responsible for it whatever the contract says (s.8(1)), and you need a valid contract with it (s.8(2)). Withdrawing marketing consent does not end the booking. You can still send the check-in link she asked for under s.7(a). But if she says she wants no messages at all, s.7(a) ends too: its broker illustration says processing stops once she tells you she no longer needs the service. Keep proof of every opt-in In a Board proceeding, you must prove notice and consent (s.6(10)). Store the date, the source (booking page, desk, keyword), the wording shown and the language. What about the list you already hold? Consent given before commencement survives, but you must send those people a notice as soon as reasonably practicable (s.5(2)). That only helps where you actually collected a marketing opt-in. Numbers captured only for bookings carry no marketing consent to carry forward. The clean fix is a one-time service-style message that asks guests to opt in, with no offer inside it. Whether even that message is safe under s.7(a) is untested; there are no Board decisions yet. Worked example: a 40-room hotel with 3,000 past guests The hotel's PMS holds numbers from three years of bookings. It wants to send a Diwali offer. Booking confirmations and check-in links: s.7(a). No separate opt-in. The Diwali offer: only to guests with a recorded opt-in. The booking page gets an unticked "Offers on WhatsApp" box; the desk can tick it only when the guest says yes. Marketing templates check the flag and refuse to send without it. STOP replies clear the flag automatically, and the guest profile shows the change (s.6(4), s.6(6)). Under-18 guests get no targeted offers at all. s.9(3) bars "targeted advertising directed at children", and a parent's consent does not cure it. WhatsApp's own business policy has separate opt-in rules; check those too. When this bites The notice and consent duties apply from 14 May 2027, when Rules 3 and 5 to 16 commence. Nothing here is a fine today. For a breach of these duties the ceiling is Rs 50 crore under the Schedule's residual item, and the Board can impose a penalty only if it finds the breach "significant" (s.33(1)). Not legal advice. Verify statutory text against the Gazette of India and consult qualified Indian legal counsel before acting.