Exclusive: New Crackdown On Pesky Spam To Include OTT And Messaging Apps

The proposal comes as the Telecom Regulatory Authority of India (TRAI) separately tightens its anti-spam framework

Show
Quick Read
Summary is AI-generated, newsroom-reviewed

• The government plans to extend anti-spam rules to digital platforms beyond calls and SMS
• New draft includes OTT, messaging apps, social media and push notifications under scrutiny
• Explicit consent for specific brands and products will be mandatory for commercial messages

When will the new anti-spam rules take effect?
New Delhi:

The government is considering a broader framework to curb pesky, promotional and unsolicited commercial communications, extending oversight beyond phone calls and SMSes to messaging apps, OTT platforms, social media, push notifications and other digital channels, documents reviewed by NDTV show.

The proposal builds on an earlier Department of Consumer Affairs initiative to address unsolicited business communications. That framework identified concerns such as calls from unregistered entities, inadequate consumer consent, unclear sender identity and ineffective opt-out mechanisms. The 2026 draft retains these principles while expanding their application across digital platforms and introducing provisions concerning artificial intelligence, personal-data use and intermediary accountability.

The proposed guidelines would apply to businesses, entities engaging communication service providers, intended beneficiaries, named entities and communication platforms.

They would operate alongside existing telecom, information technology, data-protection and consumer-protection laws. NDTV reached out to the ministry of Consumer Affairs but did receive a response immediately. To be sure, the proposal is at a draft stage and has not been circulated for public feedback yet.

The proposal comes as the Telecom Regulatory Authority of India (TRAI) separately tightens its anti-spam framework. TRAI's existing framework provides for consumer preference registration, consent management, complaints against spam and registration requirements for commercial senders and telemarketers.

Extending Regulation Beyond Telecom

The proposed guidelines would cover communication channels beyond conventional telecom networks. Their definition includes telecom services, OTT platforms, RCS, social media, messaging and calling applications, push notifications, software and internet-based services. This would extend consumer-protection obligations to commercial communication taking place through digital platforms, rather than limiting the framework to telecom operators, registered telemarketers and phone numbers.

Foreign entities and platforms would also be covered where the recipient of the communication is located in India.

Impact On OTT Platforms And Messaging Apps

For OTT platforms, messaging applications and social-media services, the proposal could introduce additional compliance requirements for commercial communication conducted through their infrastructure. Platforms may need to support consent verification, effective opt-outs, sender identification and grievance redressal. Businesses using these services could be required to maintain records of consumer permissions and follow-up requests.

The draft also identifies adding users to promotional groups, channels or broadcast lists without explicit consent as a prohibited practice. The precise responsibilities of each platform would depend on how the final guidelines allocate obligations between platforms, senders and beneficiaries.

Brand- And Product-Specific Consent

The draft proposes that commercial communication should be based on explicit consent for a specific brand or beneficiary and product, or on a registered consumer preference. It defines consent as freely given, specific, informed and unambiguous agreement. Explicit consent would need to be recorded digitally through a Digital Consent Acquisition (DCA) mechanism or an equivalent system.

This would distinguish consent for a particular business or product from a general permission to receive commercial communication.

Stronger Opt-Out Obligations

The draft prohibits commercial communication that disregards a consumer's opt-out or violates the applicable preference framework. Entities would have to provide a clear, free and effective mechanism for stopping further communications. Opt-out requests would need to be implemented and confirmed without unreasonable delay.

The draft also considers a cooling-off period following an opt-out. The proposed duration - 45, 60 or 90 days - remains unresolved in the document.

Restrictions On Persistent Follow-Ups

The proposal addresses repeated promotional contact after a customer makes a single enquiry. Persistent follow-up would be identified as a ground for treating communication as unsolicited or unwarranted where there is no continuing relationship, engagement or fresh consent.

This provision would be relevant to businesses that continue promotional outreach after an initial enquiry without obtaining permission for further communication.

Disclosure Of AI-generated Communication

The draft specifically addresses AI-generated voice and text. It proposes that commercial communications using AI-generated voice or text should include clear disclosure at the beginning of the interaction.

This provision is distinct from TRAI's use of AI and machine learning to detect spam. While TRAI's measures focus on identifying and regulating suspicious communications, the Consumer Affairs draft introduces a disclosure requirement for AI-generated commercial content.

Accountability Across Communication Chain

Responsibility under the proposed framework would not be limited to the entity that directly makes a call or sends a message. The sender, engaging entity, intended beneficiary and named entities could all fall within its scope. The draft also addresses unauthorised employees or agents, spoofing, impersonation and misleading identification.

This approach could require businesses to exercise greater oversight over third-party agencies, outsourced calling operations and digital communication intermediaries.

Grievance Redressal And Record Keeping

The draft requires each entity and platform to designate a nodal grievance officer. Complaints would have to be acknowledged within 24 hours and resolved within seven days, subject to shorter timelines prescribed under the telecom framework.

Entities would also be expected to maintain records of consent, opt-outs and sender identity. The proposed retention period remains unresolved between 180 and 365 days. The draft also proposes periodic self-certification and coordination with existing complaint mechanisms, including the National Consumer Helpline and telecom UCC systems.

Existing Framework

India's existing anti-spam regime is primarily governed by TRAI's Telecom Commercial Communications Customer Preference Regulations (TCCCPR), 2018, and subsequent amendments. The framework provides for registered consumer preferences through the Do Not Disturb (DND) system, consent-based commercial communication, registered senders and telemarketers. Telecom operators can take action against entities sending unsolicited commercial communications (UCC).

Recent TRAI measures bring automated and robocalls under closer scrutiny. Application-to-person calls must be declared to telecom service providers, while undeclared calls may be treated as UCC. The framework also provides for AI- and machine-learning-based spam detection and action against repeat offenders.

Commercial communication based on a customer's written or digital enquiry is subject to a seven-day limit under the revised telecom measures.

The Digital Personal Data Protection Act, 2023, provides a separate framework for the collection, processing and use of personal data. It is relevant to commercial outreach where businesses use phone numbers or other personal information to identify, profile or target consumers. The law establishes obligations relating to notice, consent, lawful processing and withdrawal of consent.

The DPDP framework is not a standalone prohibition on marketing calls. Its application depends on how personal data is collected and processed and whether the relevant legal requirements are met.

The Consumer Affairs draft specifically identifies the use of personal data collected or processed in violation of the DPDP Act to profile or target recipients as a ground for treating a communication as problematic. The proposed guidelines would operate alongside the TCCCPR, the Information Technology intermediary rules, the DPDP Act and the DPDP Rules.

The draft states that other applicable laws would prevail in the event of a conflict. Contraventions could also be examined under the Consumer Protection Act, 2019, including provisions concerning misleading advertisements, unfair trade practices and violations of consumer rights.

The Central Consumer Protection Authority could maintain and share records of repeat offenders and coordinate action with other authorities.

Got a follow‑up question on this article? Go on

• How will authorities enforce these rules on foreign messaging platforms?
• What penalties can companies face for violating consumer consent rules?
• How will spam reporting work on end-to-end encrypted messaging apps?

How may i help you today

Show full article

Track Latest News Live on NDTV.com and get news updates from India and around the world

Follow us:
Spam, OTT, OTT Spam