marketing compliance in india (2026): dpdp, rera, dark patterns and trai, one checklist

five sets of rules now touch an ordinary indian lead-gen campaign: dpdp, rera, the dark patterns guidelines, trai's tcccpr and asci. here is what each asks of your forms, pages, sms and calls, with dates, sources and a 30-day audit.

this guide sits under our landing page for lead generation pillar, which mentions these rules in passing; here they sit in one place. this is general information, not legal advice.

• india's dpdp rules were notified in november 2025. consent managers can register from 13 november 2026, and notice and consent duties apply from 13 may 2027 (pib).
• section 11(2) of the rera act, 2016 requires every property ad to show the registration number and the authority's website. maharashtra, tamil nadu and gujarat add qr codes.
• the ccpa's dark patterns guidelines of 30 november 2023 name 13 practices, and they cover advertisers as well as platforms.
• promotional calls go on trai's 140 series. since trai's 18 september 2026 amendment, ai and robocalls must be declared to your operator first (trai).

what does marketing compliance in india cover in 2026?

for a typical lead-gen business, marketing compliance in india covers five rulebooks and one question: what data and claims does each channel touch? forms and crms answer to dpdp, property ads to rera, page design to the dark patterns guidelines, sms and calls to trai, and ad content to asci. the matrix below maps them.

in our campaigns one lead often touches all five: a meta ad, a landing page, a crm, a voice call and whatsapp. for lodha developers, 45 flats were sold with sales attributed 100% to digital, which took a crm record of every lead's source. that same record is what you will need to show consent.

dpdp act for marketers: what must lead forms, opt-ins and crms do before may 2027?

before 13 may 2027, every form, chat opt-in and crm that holds indian leads needs four things: a plain notice of what you collect and why, consent tied to each purpose, withdrawal as easy as giving consent, and a record of when and where consent was given. fix forms first; they collect the most data.

the act's text is on india code. section 6 asks for consent that is free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and section 5 asks for a notice with the request. the rules phase in over 18 months, and consent managers must be indian companies (pib).

two parts surprise marketers. section 7(a) allows processing without consent when someone volunteers data for a purpose, but lawyers read it narrowly, so don't build a campaign on it. section 9 needs verifiable parental consent for anyone under 18 and bars tracking and targeted advertising directed at children.

sports for life's whatsapp ai agent runs with 0 manual first-touch. when no person makes first contact, the automation itself must store the opt-in, purpose and opt-out. this is general information, not legal advice.

dpdp consent notice checklist for lead forms

law-firm summaries of rule 3 describe a notice that itemises the data, names the purpose and links an easy withdrawal route (s.s. rana). section 5 adds rights and complaints. check each form:

hashing reduces exposure but doesn't replace consent, as our conversion tracking guide explains.

what are the dpdp penalties?

the act's schedule sets ceilings: up to ₹250 crore for failing to take reasonable security safeguards, up to ₹200 crore for breach notification and children's data failures, and up to ₹50 crore for other provisions, where a defective notice or consent would most likely fall. the board sets each amount case by case. this is general information, not legal advice.

is a cookie consent banner required in india?

no indian law names cookies, so no rule today says "show a cookie banner". but once dpdp consent duties apply on 13 may 2027, cookies and pixels that process personal data for ads or analytics will most likely need consent. plan the banner now; strictly necessary cookies are the lowest risk.

commentary agrees the act is silent on cookies but covers personal data collected through them (bar & bench). there is no meity banner guidance yet, and no gdpr-style "legitimate interests" ground, so consent is the safe default beyond running the site. this is general information, not legal advice.

rera advertisement rules: what does each state ask of a digital property ad?

every property ad in india must show the project's rera registration number and the state authority's website under section 11(2), and no project can be advertised before registration under section 3. maharashtra, tamil nadu and gujarat add qr codes. put a fixed rera block on every creative, landing page and footer.

a search ad has no room for a qr code, so the number goes in a description or callout asset and the full block on the page, as our landing page design guide shows. property cycles are long; for one developer, average time-to-lead was 18 days, so a faulty ad can run for weeks.

for maharashtra we saw only the press summary. check current state orders before launch. this is general information, not legal advice.

dark patterns guidelines india: which of the 13 patterns show up on a landing page?

the ccpa's guidelines for prevention and regulation of dark patterns, 2023 list 13 practices and apply to advertisers and sellers, not only platforms. on lead-gen pages the common ones are false urgency, confirm shaming, forced action, nagging and pre-ticked boxes. each has a simple honest alternative that rarely costs conversions.

the guidelines were issued on 30 november 2023 under the consumer protection act, 2019, as summarised on the government's vikaspedia portal. after a june 2025 ccpa advisory, 26 e-commerce platforms declared they had self-audited (pib), and the e-commerce amendment rules, 2026 make that audit yearly from 1 january 2027, as reported by inc42. those target e-commerce, but show the direction. this is general information, not legal advice.

tcccpr rules: what can you send by sms and call, and from which numbers?

trai's tcccpr 2018 regulations put every commercial sms and call through dlt registration. the 2025 amendment added header suffixes and mandatory opt-outs. the september 2026 amendment brought ai and robocalls under prior declaration and set a seven-day enquiry window. promotional calls belong on the 140 series, never 1600.

our lead management automation guide builds these into a seven-day cadence, and our ai voice agent guide covers call scripts. the 1600 series is reserved for rbi, sebi, irdai and pfrda regulated entities and government, so a developer or academy can't use it. whatsapp sits outside tcccpr; meta's opt-in rules and dpdp govern it. this is general information, not legal advice.

for marut drones, ai voice follow-up reached leads within minutes across 13 states. that speed now needs declared numbers and a day-8 stop.

do asci's influencer and ai-label rules apply to your ads?

yes, if you run paid creator posts or ai-made ads. asci's influencer guidelines require clear disclosure of paid or gifted posts. its september 2026 guidelines require labels on synthetic content that could mislead a buyer, from late december 2026. deepfakes without consent and fake endorsements stay banned with or without a label.

asci released its labelling guidelines on 29 september 2026, effective three months after publication (asci); our ad creative strategy guide covers the label table and the date readings. this is general information, not legal advice.

a 30-day marketing compliance audit plan

spend one week per area: forms and data, then pages and property ads, then sms, calls and whatsapp, then records and sign-off. start with whatever touches the most leads. keep screenshots of every fix with dates. most fixes are copy and settings, not code.

• days 1 to 7, forms and crm: list every form, instant form, chat opt-in and portal feed, check each against the notice checklist, and add consent fields to the crm.
• days 8 to 14, pages and ads: check every live page against the 13-pattern table, and every property creative and page against your state's rera orders.
• days 15 to 21, sms, calls and whatsapp: confirm dlt templates, opt-out text and 140-series numbers, declare ai calling, and stop automated touches on day 8 without fresh consent.
• days 22 to 30, tags and sign-off: list every cookie and pixel, decide which wait for consent, set retention dates, then book a legal review.

who wrote this, how and why

puneetraj chavan is the founder of rapchik media, with 8+ years running performance marketing and automation for 30+ brands across india and the us. he wrote this because the rules now shape how rapchik builds every form, page and follow-up flow.

how: sources were checked on 1 november 2026; press summaries are labelled "as reported". client results are marketing outcomes from rapchik case studies, not legal reviews. this is not legal advice, and a lawyer should review your setup.

why: clients kept asking which rule applies to which channel, and the answers were spread across six of our guides and a dozen regulators, so we put them on one page.

• data and consumer law: pib on dpdp rules · dpdp act on india code · pib on dark patterns self-audits · bar & bench on cookies under dpdp
• telecom: trai tcccpr 2018 · trai amendment, 12 february 2025 · trai press release 119/2026 · trai press release 91/2026
• rera and ads: haryana rera order on section 11(2) · andhra pradesh rera advertisement guidelines · maharera orders · asci sgc labelling guidelines

want forms, pages and follow-ups built with these rules in mind? see our services or talk to us.

found this useful? share it

written by puneetraj chavan

founder of rapchik media. 8+ years scaling 30+ brands across india and the us, from agri-drones to a us job portal. strategy and execution, same brain.

more about me →

want this on your brand?talk to puneetraj on whatsapp reply within 24h →