I. Background
Pesky, promotional and unsolicited commercial communications can be intrusive and disruptive for consumers, particularly when received without their consent. They can result in consumers being constantly exposed to unwanted commercial messages, making it harder to distinguish important communications from promotional content. In some cases, such communications may also encourage unwanted purchases or expose consumers to potential fraud and other risks. In view thereof, Central Consumer Protection Authority (CCPA) has proposed a draft of the Guidelines for Prevention and Regulation of Pesky, Promotional and Unsolicited Commercial Communications, 2026 (Draft Guidelines).
Currently, the Telecom Commercial Communications Customer Preference Regulations, 2018 (TCCCPR 2018) regulate commercial communications only through telecom networks (calls/SMS). The Draft Guidelines seek to expand this regulatory perimeter to include digital channels, including OTT messaging or calling apps (e.g., WhatsApp, Telegram), Rich Communication Services (RCS), social media platforms (e.g., Instagram), and other electronic means, whether licensed or not.
Further, the Draft Guidelines require upfront disclosure of AI-generated voice or text communications, although the disclosure standards have not presently been detailed. Overall, the Draft Guidelines appear designed to fill the gap left by the TCCCPR 2018 by bringing OTT messaging or calling apps, social media and app-based communications within the consumer-protection framework and placing greater emphasis on the overall business/brand’s responsibility for promotional communications.
II. Key Scope
The Draft Guidelines seek to define several key terms, including:
- ‘Commercial Communication’ broadly covers any communication – via telecom, OTT messaging, apps, social media or other digital services – sent primarily to advertise or promote goods, services or business opportunities (excluding communications saved by Clause 4).
- ‘Unsolicited Commercial Communication’ means any Commercial Communication sent without the recipient’s consent or registered preferences, or sent with intent to deceive.
- ‘Communication Platform and Channel’ includes any telecom resource, OTT messaging or calling app, RCS, social media platform or other electronic means enabling message or call transmission, whether licensed or not.
- ‘Consent’ requires a freely given, specific, informed and unambiguous indication of agreement to receive Commercial Communications for a particular brand and product.
- ‘Explicit Consent’ is such consent recorded in verifiable digital form in accordance with applicable legal and regulatory requirements.
- ‘Consent Registry’ is a mechanism maintained by a platform through which consumers can opt out of, or limit, Commercial Communications.
III. Applicability
The Draft Guidelines are intended to apply to any person or entity that: (a) sends or causes to send Commercial Communications (the ‘Sender’); (b) is the intended beneficiary of such communications; or (c) is named in the communication – where such communication is sent via unregistered 10-digit mobile/fixed-line numbers (i.e., not registered as a Telemarketer or Principal Entity under the TCCCPR 2018) or through app-based or other Communication Platforms and Channels.
IV. Exclusions
The Draft Guidelines do not apply to the following categories of communications:
- transactional or service communications (e.g., order confirmations, one-time passwords and banking alerts) sent via headers or templates registered as transactional under the TCCCPR 2018;
- communications sent with valid, unrevoked Explicit Consent obtained per the Draft Guidelines;
- government or regulatory communications issued in the discharge of a public duty or for law and order purposes (e.g., public health, safety and disaster management);
- communications necessary to perform an existing contract, provided they do not solicit unrelated products or services;
- employer-employee communications and professional-client communications in the ordinary course of an existing engagement; and
- any other category exempted by CCPA order in the consumer or public interest.
V. Prohibition and Consent Framework
- Covered persons must not engage in unsolicited Commercial Communications that violate the conditions set out in Annexure 1 of the Draft Guidelines (briefly set out below).
- Commercial Communications require Explicit Consent for the specific brand and product. For telecom-based calls and messages, consent must comply with TCCCPR 2018; for other platforms, an equivalent verifiable consent mechanism to be prescribed by CCPA.
- After a consumer opts out, the brand (or its agent) cannot seek fresh consent during a cooling-off period aligned with the TCCCPR 2018. The Draft Guidelines propose 45, 60 or 90 days as options.
- Opt-out requests must be honoured without unreasonable delay, within the timelines under the Clause 7 grievance redressal mechanism.
VI. Grievance Redressal
Every Entity and Communication Platform must designate a Nodal Grievance Officer with published contact details. Opt-out requests and complaints must be acknowledged within 24 hours and resolved within 7 days. Consumers may also file grievances via the National Consumer Helpline, the DND/UCC complaint facility of the relevant Telecom Service Provider, or the platform’s Consent Registry.
VII. Record-Keeping, Audit and Self-Certification
Every Entity and Communication Platform and Channel shall maintain verifiable records of Consent, opt-out requests and Sender Identity for a period of 180/365 days as may be prescribed by the CCPA, and shall produce such records on demand by the CCPA. The CCPA may require Entities engaging in Commercial Communication to furnish periodic self-certification of compliance with the Draft Guidelines and the TCCCPR 2018, as amended.
VIII. Grounds Constituting Unsolicited and Unwarranted Commercial Communication (as per Annexure 1)
Commercial Communication would be considered unsolicited and unwarranted if, inter alia, it is made:
- using an unregistered, unverified or unauthorised Sender Identity;
- after the consumer has opted out;
- without Explicit Consent for the specific brand and product;
- without identifying the maker and purpose;
- through an unauthorised employee or agent;
- without giving a clear, simple, free and effective option to opt out and confirmation of opt-out where the consumer avails of it;
- using a spoofed or impersonated Sender Identity;
- by adding a consumer to a promotional group or broadcast without explicit consent;
- through persistent follow-ups after a single enquiry without fresh consent;
- using AI-generated voice or text without upfront disclosure; and
- using personal data collected in violation of the Digital Personal Data Protection Act, 2023 (DPDP Act, 2023) to target the recipient.
IX. Relationship with Other Laws
The Draft Guidelines supplement (and do not derogate from) existing laws, including the TCCCPR 2018, the IT Rules 2021, the DPDP Act 2023, and the DPDP Rules 2025. In case of conflict, the other law prevails. Notably, the Guidelines contemplate that where a platform is also an intermediary under the Information Technology Act, 2000, compliance with the IT Rules 2021 does not by itself satisfy the Draft Guidelines, and vice versa.
X. Contravention
A contravention of the Draft Guidelines may constitute a misleading advertisement (Section 2(28)), unfair trade practice (Section 2(47)), or violation of consumer rights (Section 2(9)) under the Consumer Protection Act, 2019 (CPA 2019). The CCPA may, after a hearing, issue orders under Sections 20 and 21 of the CPA 2019, including penalties and product recalls. (The earlier draft of Clause 10 had contemplated coordinated action with TRAI, including Sender Identity disconnection, but this appears to have been struck off in the version now made public.
XI. Comments
Several provisions in the draft carry “(need to revise)” notations (e.g., “Consent” and Record-Keeping under Clause 8), indicating that the Draft Guidelines are preliminary. Key parameters are still open; for example, the cooling-off period (45, 60 or 90 days) and the record retention period (180 or 365 days) are yet to be finalised. Businesses will need to await these details before finalising their compliance processes.
However, even at this preliminary stage, businesses using non-telecom channels may wish to: (a) assess whether their consent mechanisms meet the “Explicit Consent” standard; (b) review opt-out and complaint-handling processes against the 24-hour/7-day timelines; (c) prepare disclosures for AI-generated communications; and (d) evaluate record-keeping systems pending finalisation of the retention period.
The content of this document does not necessarily reflect the views / position of Khaitan & Co but remain solely those of the author(s). For any further queries or follow up, please contact Khaitan & Co at editors@khaitanco.com.
