TRAI's SMS & Calling Rules for D2C: The 2026 Compliance Checklist for India

Ask a D2C founder about their messaging compliance and the answer is almost always about WhatsApp — the per-message pricing, the quality tiers, the frequency caps. Fair enough, because that's where a lot of the revenue moves. But most brands still lean on SMS for OTPs, order updates and the occasional sale blast, and a growing number are testing RCS and automated calls. All of that sits under a very different rulebook: TRAI's Telecom Commercial Communications Customer Preference Regulations, the TCCCPR, and it has been getting sharper teeth through 2025 and into 2026.

The stakes aren't abstract. Get your headers, consent or opt-out wrong and you don't just risk a fine — you risk a registered header quietly falling out of delivery, which means your OTPs and order updates stop landing and your support tickets spike overnight. Here's what the current regime actually requires of an Indian D2C brand, laid out as a checklist you can run against your own setup, plus where the rules are heading next so you're not caught out.

What the TCCCPR is, and why it's your problem

The TCCCPR is TRAI's framework for controlling unsolicited commercial communication. It works through a chain of accountability. You, the brand, are a Principal Entity. You register your sender headers and your message content templates on the DLT — Distributed Ledger Technology — platform, usually via your SMS or messaging vendor. Telemarketers and telecom operators sit in between, and the operators do the enforcement.

That structure matters because it means compliance is not something your vendor "handles" invisibly. The header is registered to you. The template is approved against your content. When a complaint or a mismatch triggers action, it's your sender identity that gets flagged. So a D2C brand that treats SMS as a fire-and-forget vendor task is carrying a risk it can't see. The Second Amendment to the TCCCPR, notified on 12 February 2025, tightened almost every link in that chain — who can send what, from which number, with what consent, and what happens when it goes wrong.

The header rule: your content must match its label

The most visible 2025 change was the content-type suffix on SMS headers. Every registered header now ends in a letter that declares what it's allowed to carry, and telecom operators began enforcing it from May 2025.

The four categories are simple to remember, and getting them wrong is the fastest way to break your own delivery.

The rule that trips brands up is content-matching. You cannot slip a discount code out through a transactional or service header because those routes reach even DND-registered numbers and feel like a delivery shortcut. Operators check content against the header's category, and a promotional message on a service header can get the message blocked and the header itself flagged. Keep a clean separation: one set of headers for genuine service and transactional traffic, a properly registered promotional header for marketing, and never mix the two.

Calls: the 140-series, and the rise of the 1600-series

Voice has its own numbering discipline. Promotional and telemarketing calls in India run on the 140-series — if your brand or your calling partner dials out with an offer, that's the series it should originate from. Calling from an ordinary 10-digit mobile to push promotions is exactly the behaviour the regime is built to stop.

The newer piece is the 1600-series, designated for service and transactional voice calls so customers can recognise a legitimate business call. TRAI directed its adoption first for RBI, SEBI and PFRDA-regulated entities — banks, insurers, the BFSI world — on phased deadlines through 2025 and into 2026, with the scope extending toward utilities and logistics. Most D2C brands aren't inside that first mandate, so there's no need to rush a 1600 number for a skincare or apparel label today. What matters is reading the signal: identity-verified, purpose-tagged calling is becoming the default, and the day a customer expects a "real" business call to come from a recognised series is not far off.

Consent and opt-out: the parts that scale into penalties

Numbering and headers are the visible half. Consent is the half that turns a small process gap into a large, repeated liability.

Inferred versus explicit consent

The regulations distinguish inferred consent from explicit consent. Inferred consent covers your existing relationship — a customer who bought from you can reasonably get service messages about that purchase. Explicit consent is what you need to go beyond that, and it isn't permanent. It's recorded against the specific purpose you asked for, and for certain service calls its validity is capped at seven days. The practical lesson is to stop thinking of consent as a checkbox you tick once at signup. It's a living record tied to purpose, and a vague "I agree to receive communications" catch-all is weak ground under both the TCCCPR and India's DPDP Act.

The opt-out clock

Every promotional message must carry a working opt-out. Once a customer opts out, you can't solicit them again for 90 days. That sounds obvious, and yet it's where automation quietly breaks compliance — a customer opts out of SMS, but your campaign tool re-adds them from a fresh CSV upload two weeks later. At a few hundred sends nobody notices. At scale, opt-out breaches are exactly what generate the complaint volume that trips enforcement.

And enforcement got faster. The Second Amendment lowered the action threshold to 5 valid complaints in 10 days, down from 10 complaints in 7 days, and widened the complaint window. A brand that used to have a comfortable margin before anyone acted now has far less. Suppressing opt-outs cleanly across every channel and every tool is no longer hygiene — it's what keeps your headers alive.

The penalties, and the cost you'll actually feel

The Second Amendment built in graded financial disincentives. Public analyses of the amendment describe escalating penalties for misreporting and repeat violations — in the region of ₹2 lakh, ₹5 lakh and ₹10 lakh for first, second and subsequent offences — a smaller charge for improper template registration, and, for unauthorised use of numbering resources, disconnection of telecom resources for up to two years plus blacklisting across operators. A first serious offence can bring a temporary bar on outgoing services.

Those numbers get attention, but the cost most brands feel first is quieter: deliverability. A flagged promotional header doesn't announce itself. Your sale-day blast just underperforms, your OTPs start bouncing for a subset of numbers, and your team burns a week diagnosing a "vendor issue" that's actually a compliance one. Treating the rules as a delivery-protection measure, not just a legal one, is the mindset that keeps the channel healthy. This is the same first-party discipline that underpins good retention, which is why we fold messaging compliance into how we build every client's CRM Hub rather than bolting it on afterward.

What's coming next: caller-ID apps enter the frame

The regime isn't standing still. TRAI floated a draft Third Amendment to the TCCCPR in 2026 aimed at caller-identification and call-management apps — the Truecaller category — seeking to bring them under the same anti-spam framework, route the complaints they collect into the official DND system, and restrict how they tag or block calls from the designated 140 and 1600 series. It's a draft in consultation, not a rule you need to act on today, and its direct obligations fall on the apps rather than on senders like you.

Why it matters to a D2C brand is the trajectory it confirms. India is steadily moving toward a world where every business message and call is tagged, traceable and matched to a registered purpose, and where the number a customer sees is meant to tell them exactly what kind of contact this is. Brands that build clean header hygiene, honest consent and reliable opt-out now will find each new rule a small adjustment. Brands still treating SMS as an unregulated blast channel will keep meeting these regulations the hard way — one flagged header, one deliverability crater, one support fire at a time.

Run the checklist this week: confirm your promotional and service headers are cleanly separated and content-matched, check that opt-outs suppress across every tool you use, and make sure your consent records name a purpose rather than hiding behind a catch-all. It's an afternoon of work that protects the channel your OTPs and order updates depend on.

Sources: TRAI Telecom Commercial Communications Customer Preference Regulations and its Second Amendment (notified 12 February 2025) — the content-type header suffix system (-P, -S, -T, -G) enforced by telecom operators from May 2025, the 140-series for promotional calls and 1600-series for service/transactional calls mandated first for RBI/SEBI/PFRDA-regulated entities and expanding, the tightened complaint threshold of 5 valid complaints in 10 days, the mandatory opt-out with a 90-day no-solicitation window, the 7-day validity on explicit consent for certain service calls, and the graded financial disincentives and service-suspension provisions; and TRAI's draft Third Amendment (2026) bringing caller-ID / call-management apps under the framework. Compliance specifics summarised from TRAI directions and published legal analyses of the 2025 amendments; verify current obligations against TRAI's official regulations at trai.gov.in before acting.