Is Bulk WhatsApp Legal in India? 6 Rules 2026

This distinction is the whole page, so it is worth being precise.

I looked for an Indian statute that names bulk messaging on WhatsApp and makes it an offence, and I did not find one. What exists instead is a contract you agreed to when you opened a WhatsApp Business account, enforced by Meta at a speed no regulator can match.

Meta's Business Messaging Policy says it in terms:

> "If you use or operate a service which utilizes WhatsApp in violation of our terms or policies, such as messaging people at scale in an unauthorized manner, we have the right to limit or remove your access to WhatsApp Business Services."

> "If we terminate your account for violations of the WhatsApp Business Terms of Service, the Business Messaging Policy, or the WhatsApp Messaging Guidelines, we may prohibit you and your organization from all future use of WhatsApp products and services."

Both from the WhatsApp Business Messaging Policy, section "Enforcement and Updates", checked 30 Jul 2026.

Read that second sentence again. Not the number — you and your organization, from all future use.

So the honest answer to "is it legal" is that you are asking a question that will not hurt you, and skipping the one that will. Nobody is going to prosecute a salon owner for sending 5,000 promotional messages. Meta is going to take the number away. If that number is on your signboard, your Google listing, your delivery riders' phones and years of customers' address books, losing it is a far more expensive outcome than a fine would have been. There is no insurance for it and, as the enforcement section below shows in Meta's own words, there is not always an appeal.

The Indian statute that does have something to say is the Digital Personal Data Protection Act 2023, and it says it about the list, not about the sending — covered under rule 3.

If you read nothing else on this page, read this table. Every rule traces to a published source, named in the third column.

Notice what is not in that table: any requirement to register with an Indian authority, buy a licence, or file anything with a telecom operator. That is the difference between this channel and the voice channel, and it is why copying a TRAI checklist onto a WhatsApp page produces advice that is confidently wrong.

Rule 1. Opt-in is a two-part test, and most people fail the second half

Meta's wording is precise, and the precision matters:

> "You may only contact people on WhatsApp if: (a) they have given you their mobile phone number; and (b) you have received opt-in permission from the recipient confirming that they wish to receive subsequent messages or calls from you."

(WhatsApp Business Messaging Policy, "Create a Quality Experience", checked 30 Jul 2026.)

Having someone's number is limb (a). Almost every Indian business passes limb (a) — you have numbers from bookings, bills, warranty cards, delivery slips, walk-ins. Almost nobody passes limb (b), because nobody ever asked. A number written on an invoice is not permission to send a Diwali offer.

On what a valid opt-in has to say, Meta's developer documentation is short and usable:

> "Businesses must clearly state that a person is opting in to receive communication from the business."

> "Businesses must clearly state the business's name that a person is opting in to receive messages from."

> "It is up to businesses to determine the method of opt-in."

(Meta for Developers, getting opt-in for WhatsApp, checked 30 Jul 2026.)

That third sentence is the good news, and it is worth dwelling on. Meta's requirement is about what the opt-in *says*, not about where it happens — so the opt-in does not have to be collected inside WhatsApp. A tick box on your booking form, a line on the enquiry slip at your counter, an IVR confirmation, an SMS reply: any of them can satisfy the rule as long as they name your business and say plainly what the person is agreeing to receive. So the fix for a business that has 4,000 numbers and zero opt-ins is not to buy software. It is to add one sentence to the form your customers already fill in, and to start counting from today.

Rule 2. Outside the 24-hour window, you cannot say what you like

A business-initiated message has to be a template Meta approved in advance, filed under a category — marketing, utility, authentication or service. Editing the wording later means resubmitting it. Once a customer replies, you get a 24-hour window in which the conversation is free-form and the agent can quote, book, reschedule or send a payment link in ordinary language.

This has a commercial consequence people miss: the free-form window is where the money is, and it is also the cheap part. Service replies inside that window are free on Meta's side. Two Indian platforms publish an India per-message rate card openly — MyOperator lists "Marketing ₹0.95 | Authentication ₹0.13 | Utility ₹0.13 | Service Free" with the note "Price for Indian destination numbers. Subjected to change as per Meta's policies", and Trikon lists Marketing ₹0.86, Utility ₹0.145 and "Service conversations: Unlimited free". Both read on their own pages on 21 Jul 2026, and both state that Meta sets and revises these charges. Read them for what they are: the rates those two platforms publish for India, not a figure I can show is Meta's own list price with nothing added on top. Treat the range as approximate and re-check before you budget.

Even allowing for that, the shape of the rate card is instructive. A business that gets customers to message first pays close to nothing. A business that pushes marketing templates outward pays roughly six to seven times per message what a utility message costs — ₹0.95 against ₹0.13 on MyOperator's card, ₹0.86 against ₹0.145 on Trikon's. That is a pricing signal about what Meta wants the channel used for, and it is more instructive than any policy document.

Rule 3. The list has to be yours — and DPDP is a 2027 problem, not a today problem

A purchased database of 20,000 Hyderabad numbers fails rule 1 on its face: those people never gave you their number and never gave you permission. That is enough to end the discussion.

But you will read that the Digital Personal Data Protection Act 2023 already makes holding that list unlawful, and that needs a correction, because the commencement dates are public. On 14 Nov 2025 the DPDP Act 2023 and the DPDP Rules 2025 were brought into force on staggered timelines and the Data Protection Board was established. Consent Manager registration and the Board's inquiry powers follow on 14 Nov 2026. The obligations that actually bite a marketing list — notice and consent, data-principal rights, reasonable security safeguards, breach reporting — are notified for 14 May 2027 (Shardul Amarchand Mangaldas & Co, "Enforcement of the DPDP Act and notification of the DPDP Rules", checked 20 Jul 2026).

So if a page tells you DPDP already requires documented consent for every number you hold, check the date it comes into force. That does not make a bought list safe — Meta's rule forbids it and Meta's rule is enforceable this afternoon. It means the enforcement you should actually plan around in 2026 is Meta's, and the DPDP work is something to build in now rather than retrofit in eighteen months. Keep a record of where each number came from and when the person agreed. In 2026 that record protects your number. From 2027 it does a second job.

Rule 4. Every bulk-sender tool you can buy is the thing the policy names

The desktop applications, the Chrome extensions that drive WhatsApp Web, the modded clients, the lifetime-licence senders advertised on the same search results page you probably arrived from — these work by automating a normal WhatsApp account. That is precisely the conduct Meta's policy describes as "messaging people at scale in an unauthorized manner", and the stated consequence is that Meta may "limit or remove your access to WhatsApp Business Services".

The practical trap is that these tools work for a while. They send, the messages arrive, and the owner concludes the warnings were exaggerated. The detection and the ban land later, usually after the number has been used long enough to matter. A tool that fails immediately costs you the licence fee. A tool that fails in month four costs you the number.

The official path is the WhatsApp Business Platform: your own number, connected through Meta's flows, with Meta billing your own account for messages. If you want the mechanics of that connection and what it costs, they are laid out in WhatsApp Business API cost in India.

Rule 5. Opt-out is not a courtesy, it is the input to your quality rating

Meta's policy states it may act "if you receive significant amounts of negative feedback". Negative feedback means blocks and reports, and those come overwhelmingly from people who wanted out and could not get out. Honour a stop request immediately, permanently, and across every list — not just the campaign it arrived on. Give people a visible way to say stop rather than making them hunt for it. A smaller list that nobody resents outperforms a larger one that generates blocks, and it does so twice: better response now, and a higher sending ceiling later.

Rule 6. You cannot send 10,000 messages on day one, whatever your tool promises

This is the fact that quietly makes most "bulk WhatsApp" plans impossible, and it is missing from most of the pages currently ranking for this query.

Meta's messaging limits are counted in unique customers you can message in a rolling 24 hours, not in messages. A newly created account starts near the bottom of that ladder. Meta's wording:

> "Newly created business portfolios have a messaging limit of 250."

(WhatsApp Business Platform messaging-limits documentation, checked 30 Jul 2026. Meta's own wording frames the limit at business-portfolio level rather than per number.)

The limit then rises in steps, and Meta publishes the whole ladder: 250 → 2,000 → 10,000 → 100,000 → unlimited unique customers per rolling 24 hours (WhatsApp Business Platform messaging-limits documentation, checked 30 Jul 2026).

You do not climb it by waiting. Meta's stated condition for moving up is sending "2,000 delivered messages outside of customer service windows to unique WhatsApp user phone numbers within a 30-day moving period, using templates with a high 'quality rating'". Read that carefully, because it contains the whole argument of this page: the ladder is climbed with *delivered messages to unique people using templates that do not annoy them*. A purchased list fails on delivery, on uniqueness and on quality at the same time, which is why blasting does not merely risk a ban — it locks you at the bottom rung while a business sending to its own opted-in customers walks past you.

Your own current limit is displayed in WhatsApp Manager. Read it there rather than trusting a tier figure a vendor quotes at you.

Individual templates carry their own rating too. A template marked Active – Low Quality has "received negative feedback from multiple customers or low read-rates, and can be sent to customers but are in danger of being paused or disabled soon" — so the specific message that annoyed people can be switched off underneath you while the rest of the account keeps working.

What this means concretely: a business starting today with 3,000 opted-in customers cannot send them all in one evening. At 250 unique customers per 24 hours the first campaign takes twelve days. That is not a bug to route around, it is the system doing what it was designed to do — make you earn volume by not annoying people. Plan the first campaign in waves, and stop believing any tool that offers to send 10,000 messages tonight.

If your number has already been restricted, this section is the one you came for. The mechanism is a ladder, and Meta publishes the rungs.

(WhatsApp Business Platform policy-enforcement and messaging-limits documentation, checked 30 Jul 2026.)

Three things follow from reading it as a ladder rather than a switch.

First, bans are almost never sudden. They are the fourth or fifth event in a sequence that started with a warning most owners never read, because the warning arrives in a Business Manager notification rather than on the phone in their pocket. If you are running campaigns, someone has to check that account, weekly.

Second, the trigger is people, not volume. Meta does not ban you for sending a lot. It bans you for blocks and reports per message sent. A relevant campaign to 5,000 opted-in customers is safer than an irrelevant one to 500 strangers. This is why "go slower" is incomplete advice and "send to people who want it" is the whole of it.

Third, plan for the block that does happen. Because appeals are not guaranteed, the recoverable position is one where a 30-day block is survivable: a second contact route your customers know, a real phone line that gets answered, and a record of your opt-ins ready to produce. A business whose only channel is one WhatsApp number is one Flagged rating away from being unreachable.

One honest gap. I could not find Meta documentation that maps specific rung durations to specific violations, so I cannot tell you that offence X gets 7 days and offence Y gets 30. Anyone publishing that table is guessing.

Now the arithmetic, including the part that does not flatter us.

Take an invented example — Sunrise Fitness, Warangal, not a client. 3,000 members who have given opt-in, one campaign a month, and an existing WhatsApp number the gym has used for years. Two bills, and only one of them is ours.

Meta's bill, on the gym's own account. Meta charges the gym directly for the templates it sends. For scale, the two published India rate cards in our ledger put a marketing template between ₹0.86 and ₹0.95 — Trikon ₹0.86, MyOperator ₹0.95, both read on their own pages on 21 Jul 2026 and both flagged by their own publishers as Meta-set and subject to change. At that range, 3,000 marketing templates is ₹2,580 to ₹2,850. Dvaarik adds zero markup and never touches that money; it lands on the gym's Meta invoice where they can verify it themselves. Replies inside the 24-hour window are free on Meta's side.

Our bill, from one prepaid credit balance. Here is month one both ways, because whether we supply a phone number changes it materially. The reply figure is an assumption for the worked example, not a benchmark: assume 300 of the 3,000 members write back.

Run that forward across the three months the Care Plan is required, on the own-number path:

Three-month total: ₹20,000 of credits loaded, billed ₹23,600 including GST, of which ₹16,800 is spent and ₹3,200 carries forward — credits never expire. Plus ₹7,740 to ₹8,550 to Meta for 9,000 marketing messages at that same published range. Call it ₹31,340 to ₹32,150 of cash out over three months, and the ₹40,000 setup is free for our ten founding clients in return for the Care Plan at the founding rate for those three months and an honest testimonial after go-live.

Now the uncomfortable number. Divide it: about ₹3.50 per delivered marketing message, against a Meta-side cost of roughly ₹0.90. If all you want is to push 9,000 promotional messages out of the door, that arithmetic is bad and you should not buy from us. For comparison from our ledger of published competitor pricing, read on their own pages on 21 Jul 2026: Trikon lists WhatsApp Starter at ₹1,500/month and Pro at ₹5,000/month, both shown as limited-time prices against struck-through list prices of ₹2,500 and ₹8,000, with the Meta message rates on top. Botsense lists its WhatsApp platform at ₹24,999/year Starter with a mandatory ₹15,000 one-time setup, and ₹49,999/year Growth with ₹25,000 setup, stating "All prices exclude Meta WhatsApp conversation charges (paid directly to Meta)". Rates in this market moved within weeks during collection, so treat 21 Jul 2026 as a hard check date.

The honest version of our case is not that we are cheaper. It is the terms — ₹2 per conversation and ₹2 per minute from the very first one, no subscription, no minimum volume, no lock-in — and it only earns its keep when the replies need handling: when 300 people write back at 9pm asking about timings, fees and whether the trainer is available on Sunday, and there is nobody to answer them. Sending is the cheap half. Answering is the half that converts, and it is the half we build. The mechanics of that are in WhatsApp campaigns with AI replies; the full price list is on /pricing.

Three cases where you do not need us, and one where you should not send at all.

You have under a few hundred contacts and they have saved your number. Use the free WhatsApp Business app's broadcast lists. They cost nothing, they are entirely within the rules, and each list is widely reported — though I could not render the figure from Meta's own help page, so treat it as reported rather than quoted — to hold up to 256 contacts. The catch is in WhatsApp's own help centre for broadcast lists on the Business app: only people who have your number saved in their address book will receive the message. That is a real constraint and also a real filter — the people who saved you are the people who wanted to hear from you. If that describes your list, the Business Platform, the templates, the approvals and the credit balance are all overhead you are buying for no gain.

You want a self-serve campaign console with a shared team inbox. That is a software product and we are not one. Dvaarik is a studio — one person builds each agent by hand, there is no signup, no trial and no self-serve console for you to configure at midnight. A BSP with published plans will serve you better and faster. Judge them on two questions you can ask in writing before paying: is your per-message price exactly Meta's, and will Meta invoice my own account. If either answer is soft, you have found a markup.

Your campaign has nothing to say. The most common reason a WhatsApp number gets blocks is not a technical failure. It is a monthly message that exists because someone decided there should be a monthly message. If you cannot name what the recipient gets from it, not sending is the highest-return decision available to you and it is free.

And the case where you genuinely should not send at all: you have a bought list. There is no compliant way to use it, no tool that makes it safe, and no version of this page that gives you permission. Start collecting opt-ins today and you will have a usable list in a quarter.

A compliance page that projects total certainty is telling you something about its author. Here is what I could not pin down, stated plainly, on 30 Jul 2026.

• Whether a Flagged quality rating drops your messaging limit, and how fast. Vendor pages state, often word for word, that seven days at Flagged costs you one tier immediately. We went looking for that sentence in Meta's own documentation on 30 Jul 2026 and could not find it, on the messaging-limits page or the phone-number page — and the messaging-limits page states no downgrade rule at all. It may well be true and simply undocumented now. We are not going to print it as Meta's wording when we cannot show you where Meta wrote it, and we would treat any page that does as having copied it from another page rather than from the source.
• The per-user marketing message cap. Several sources report that a person can receive only about two marketing messages a day across all businesses combined. I could not confirm the figure in Meta's own documentation. If it is right it matters a great deal for campaign timing, so ask your provider to point you at the source before you plan around it.
• Whether messaging limits are now per business portfolio rather than per number, and from when. Meta's own wording refers to portfolios having a messaging limit, which supports the portfolio reading. The specific date of that change comes from third-party write-ups, not from Meta, so I have not stated one.
• Which violation earns which block duration. Meta publishes the ladder — warning, 1 or 3 days, 5, 7 or 30 days, lock, removal — but not a mapping from offence to rung.
• Whether any Indian regulator has asserted jurisdiction over commercial messaging on OTT apps. I found no primary instrument extending the telecom commercial-communication framework to WhatsApp. That is an absence of evidence rather than a ruling, and it is exactly the kind of thing that changes. Re-check before you build a large programme on it.
• What Meta's India rates will be next quarter, and how closely a platform's published card tracks Meta's own charge. The two Indian platforms whose rate cards we quote both attach their own warning that the figures move with Meta's policies, and neither publishes a line stating that its card is Meta's charge with nothing added. Ours carries the same warning about volatility.

Applying the same scrutiny to us. Here is the division of labour, honestly split.

The agent that answers WhatsApp is one of seven we build — Receptionist, Leads, Sales, WhatsApp, Instagram, Booking and Payments — and it shares a brain with the phone agent, so a customer who moves from a WhatsApp reply to a phone call does not get a different price or a different answer. Details on the WhatsApp agent page.

So: is bulk WhatsApp legal in India? Yes, through the official Business Platform, to people who opted in, at a pace Meta lets you earn. The six rules above are not bureaucratic friction — most of them reduce to "send things people asked for, through the official channel", written out longhand, and the last is a speed limit that exists because too many businesses ignored the rest. The failure mode is not a court case. It is a number that stops working, on a platform that says it may prohibit you and your organization from all future use. That is the risk worth pricing, and it is the one the tool sellers on this search results page will not price for you.

If you want to talk through whether your list is actually sendable — including the case where the honest answer is that it is not yet — tell us your problem on WhatsApp at +91 93923 98750, or use /contact. You can message our own live agent first on WhatsApp at +91 79956 76588 and watch it work before you decide anything. Setup is free for our first ten founding clients and the trade is stated plainly on /pilot.