WhatsApp Opt-In Checklist for Karnataka Retailers

Most consent problems start with a spreadsheet that nobody questions. It may contain numbers from bills, alterations, repairs, wedding enquiries, exhibitions, Instagram leads and staff phones. Those contacts are useful for serving the original request. They are not automatically permission for weekly new-arrival or festival campaigns.

WhatsApp's business policy is direct: a business may contact a person only when the person gave the mobile number and opted in to receive later messages on WhatsApp. The opt-in must clearly name the business and make clear that the channel is WhatsApp. The policy also requires businesses to honour stop, block and opt-out requests, whether the request arrives inside or outside WhatsApp.

The practical test is simple. Could your staff show why this customer expected this message from this shop? If the answer is only ‘the number is in our billing software’, do not add that person to a campaign. Ask first.

This guide is operational guidance, not legal advice. The Digital Personal Data Protection Act, 2023 and the 2025 Rules have staged commencement dates. As of 6 October 2026, important notice and consent rules in the Rules are scheduled to commence eighteen months after the Gazette publication of 13 November 2025. Do not use that transition period as an excuse to wait. Meta's opt-in policy applies now, and building a clean ledger now is cheaper than cleaning a mixed list later.

Keep the request short enough to understand at the counter. It should identify the shop, say that messages will come on WhatsApp, describe the categories and explain how to stop. Avoid a buried tick box, a pre-ticked box or a broad line such as ‘I agree to marketing’. The customer should know what will happen next.

Use separate choices when customers may want service updates but not offers. For example, a jewellery customer may want repair-ready alerts and gold-scheme reminders but not bridal collection campaigns. A boutique customer may want alteration updates but not weekly arrivals. Category-level choices reduce surprises and help staff send only relevant messages.

Counter card example in English: ‘Yes, I want WhatsApp messages from Lakshmi Silks about new arrivals, relevant offers and store events. I can reply STOP at any time.’ Kannada support line: ‘ನಾನು ಲಕ್ಷ್ಮೀ ಸಿಲ್ಕ್ಸ್‌ನಿಂದ ಹೊಸ ಸಂಗ್ರಹ, ಸಂಬಂಧಿತ ಆಫರ್‌ಗಳು ಮತ್ತು ಅಂಗಡಿ ಕಾರ್ಯಕ್ರಮಗಳ WhatsApp ಸಂದೇಶಗಳನ್ನು ಪಡೆಯಲು ಒಪ್ಪುತ್ತೇನೆ. ನಿಲ್ಲಿಸಲು STOP ಎಂದು ಉತ್ತರಿಸಬಹುದು.’ Have a Kannada speaker review the final wording so both versions carry the same meaning.

Do not bundle permission with a bill, warranty, repair intake or required order update. If the customer must provide a phone number to receive an invoice or pickup alert, give a separate voluntary choice for campaigns. Service necessity and marketing permission are different decisions.

At the billing counter, place a QR code beside a short consent statement. It can open a chat with a pre-filled JOIN message. The customer sends it from their own phone, creating a clear trail.

On your website, use an unticked checkbox beside the mobile field. State the shop name, WhatsApp channel and message categories next to the box, not only in a distant privacy policy. Save the version of the wording shown at the time.

For Instagram and click-to-WhatsApp enquiries, ask inside the conversation before adding the person to ongoing campaigns: ‘Would you like new-arrival and offer messages from [Shop] on WhatsApp? Reply YES to join. Reply STOP anytime.’ An enquiry about one product is not a lifetime subscription.

For an old customer list, run a permission-refresh exercise instead of quietly importing everyone. Use a permitted one-to-one route or ask during the next store visit. Mark people as unknown until they actively agree. Do not repeatedly chase non-responders; silence is not consent.

The owner should be able to answer three questions quickly: who can receive marketing, what did each person agree to, and who has stopped. A controlled spreadsheet can work at small volume. With multiple staff or branches, use a central system with an automatic suppression list.

Never let staff export an old list, remove the status column and upload it as a new audience. The suppression status must travel with the customer record. If someone replies STOP, asks at the counter, phones the shop or uses a web form, mark the stop centrally. Meta's policy says opt-out requests must be respected inside or outside WhatsApp.

Keep only the information needed for the stated purpose. Restrict access to staff who send or review campaigns. Use individual logins, remove access when someone leaves and review exports. A customer's jewellery interest, purchase history and chat can reveal more than a phone number alone; do not copy it into personal phones or unrelated groups.

The DPDP Act says consent withdrawal should be as easy as giving consent and, when consent is the basis for processing, processing should cease within a reasonable time after withdrawal unless another law permits or requires it. Your safest shop-floor rule is stronger and simpler: suppress marketing immediately, then keep only the minimum record needed to prove and enforce that suppression.

Treat every campaign as a small stock dispatch: check the destination, quantity, cost and owner approval before it leaves. Marketing messages cost money. Rates and taxes can change, so use the current Meta rate shown by your provider rather than copying an old rupee figure from a blog.

Labhaya is designed around this discipline. A shop sends a collection from its own WhatsApp number to its own opted-in customers. The system can show the estimated message cost and a monthly cap before sending. Customers can tap products, ask a price or book a visit; the shop can then follow up with relevant pieces. The software does not turn an unconsented number into a valid contact, and it does not remove the owner's responsibility to review the audience.

When using the WhatsApp Business Platform, a business-initiated conversation must use an approved message template and is subject to applicable pricing. Consent and template approval solve different problems: consent answers whether the person expected the message; approval answers whether Meta allows that template format and category. You need both where applicable.

Illustrative example: A Jayanagar saree shop has 3,200 phone numbers collected over four years. Only 900 records show clear WhatsApp campaign consent. The owner wants to send a Deepavali preview. The wrong move is to upload all 3,200 because ‘they have bought before’. The better move is to send only to the 900 active opt-ins, excluding anyone who stopped or chose service-only updates.

Before sending, the owner sees an estimated Meta message charge based on the current rate in the account and sets a hard cap. If the displayed estimate were Rs 900 before applicable tax, that would be an example for approval, not a quoted market rate. The actual amount depends on the current price, message category, delivery and tax treatment. The owner approves only after checking the figure shown for that campaign.

The campaign carries six sarees in a swipeable collection. A customer taps two Kanjeevaram pieces and asks for the price. That action opens a useful sales conversation. The staff member follows up from the shop's own number with those relevant pieces and offers a visit slot. Another customer replies STOP; the system suppresses that number immediately from future marketing. The result report counts the stop as important feedback, not as a nuisance to ignore.

The shop can now explain every send, control cost and protect the number it depends on. Permission quality is part of campaign performance.

Karnataka stores often serve customers in Kannada, English, Hindi, Tamil or Telugu. The consent record should store the customer's language preference, but language is not permission by itself. Ask in the language the customer understands and keep the meaning consistent across versions.

Train staff with two scripts, not a legal lecture. Joining script: ‘Would you like collection and offer messages from our shop on WhatsApp? You can stop anytime.’ Stopping script: ‘Done. We will not send more promotional WhatsApp messages.’ Staff should never argue, demand a reason or offer a discount only if the customer stays subscribed.

Give one person responsibility for the ledger and one backup. Review it before Ugadi, Varalakshmi Vratam, Gowri-Ganesha, Dasara, Deepavali and wedding-season campaigns, when pressure to use old lists is highest. Seasonal urgency is not a consent exception. Collect permission steadily at the counter throughout the year instead of trying to repair the list one day before a festival.

If your shop also sends promotional SMS or voice calls, check the separate TRAI requirements for those telecom channels. TRAI describes consent as voluntary permission linked to a specific purpose, product or service and maintains a registration framework for bulk commercial SMS and voice. Do not assume that a WhatsApp opt-in automatically covers SMS or calls, or that compliance on one channel settles the others.

Day one: stop importing numbers whose source and permission are unknown. Export the current audience, add status, source, timestamp, category and wording-version fields, and mark doubtful records unknown. Day two: approve one short English and Kannada counter script. Day three: place the QR code and train every billing and sales staff member. Day four: test STOP from a real phone and confirm that the number is suppressed everywhere. Day five: send a small campaign to a clean segment, review the cost before approval and watch replies.

After each campaign, review opt-outs and blocks alongside clicks, replies, visit bookings and orders. A rise in negative feedback is a list-quality warning. Pause the next send, inspect the source and wording, and fix the process before increasing volume.

Kill switch: if your team cannot prove the source, wording and status for most of the intended audience, do not send. If opt-outs or complaints jump after a campaign, stop using that acquisition source until it is audited. A festival deadline is cheaper to miss than losing customer trust or damaging the quality of your business number.

WhatsApp Business Messaging Policy: https://business.whatsapp.com/policy/ — official rules on opt-in, business identification, message templates, data handling and opt-out requests.

Digital Personal Data Protection Act, 2023: https://www.indiacode.nic.in/bitstream/123456789/22037/2/a2023-22.pdf — official Act text, including consent and withdrawal principles.

Digital Personal Data Protection Rules, 2025 Gazette notification: https://www.meity.gov.in/static/uploads/2025/11/53450e6e5dc0bfa85ebd78686cadad39.pdf — official Rules text and staged commencement dates.

MeitY DPDP Rules collection: https://www.meity.gov.in/documents/act-and-policies/digital-personal-data-protection-rules-2025-gDOxUjMtQWa — official Rules, corrigendum and enforcement-timeline materials.

TRAI TCCCPR overview and sender guidance: https://www.trai.gov.in/tcccpr and https://www.trai.gov.in/advice-to-senders — official guidance for commercial SMS and voice communication. It is included to keep channel obligations separate, not to claim that every WhatsApp campaign requires DLT registration.

Sources were checked on 6 October 2026. Policies, prices and commencement dates can change. Confirm the current Meta rate in your account and take professional advice for your store's legal position.