Pesky Calls Draft: CCPA Wants Consent, AI Disclosure and a 45-90 Day Opt-Out Wait

Posted on 25th Oct 2026 11:08:14 in Business, Digital Marketing

Tagged as: CCPA, pesky calls, spam marketing, MSME compliance, AI disclosure, consumer protection

A small business in India rarely has a marketing department. It has a phone number. The same number takes orders, answers complaints, chases payments and, on a slow afternoon, sends out a festival offer to a few hundred saved contacts. That is the number the country's consumer regulator is now looking at.

The Central Consumer Protection Authority (CCPA) proposed the draft Guidelines for Prevention and Regulation of Pesky, Promotional and Unsolicited Commercial Communications, 2026, on 24 September. The framework reaches across voice calls, SMS, OTT messaging apps, Rich Communication Services, push notifications and social platforms. It is not in force yet and becomes binding only after final publication. But the lobbying has already started, and it is coming from the smallest end of the market.

India SME Forum, a lobby that says it represents nearly 100,000 small businesses, wrote to the consumer affairs ministry on 15 October asking for an impact assessment before the rules are finalised. Its argument is not that spam is fine. It is that consent paperwork designed for a company with a legal team lands on a shop with one person and one SIM card.

What the Draft Actually Says

The draft is issued under Section 18(2) of the Consumer Protection Act, 2019. Any commercial communication sent without explicit, verifiable digital consent, or sent in violation of a consumer's registered opt-out preference, is classified as an Unsolicited Commercial Communication (UCC) and treated as an unfair trade practice or a misleading advertisement.

Liability is joint. The guidelines apply to telemarketers, to commercial senders and to the brand in whose name the campaign runs. A retailer that hires a calling agency cannot point at the agency when a customer complains.

The operational rules are specific, and each one has a cost attached:

• Consent before promotion. Businesses must obtain a consumer's consent before sending brand promotions through any channel.
• A cooling-off period. After a consumer opts out, brands must wait between 45 and 90 days before reaching out again, and are barred from seeking fresh consent during that window.
• Disclosure of AI. If a business uses AI-generated voices or text on behalf of a brand, it must say so clearly at the start of the communication. Without that disclosure, the message may itself be treated as unsolicited or unwarranted.
• No borrowed numbers. Using unauthorised 10-digit mobile numbers for telemarketing is prohibited.
• No forced group adds. Adding consumers to promotional group chats without their agreement is banned.
• No persistent follow-up. Repeated messages after a single inquiry are prohibited.
• A named grievance officer. Every brand and platform must designate a nodal grievance officer who acknowledges a complaint within 24 hours and resolves it within seven days, while maintaining verifiable consent and audit records for up to 365 days.
• Foreign senders covered. Entities based abroad and unregistered international applications that target recipients in India remain subject to penalties under Indian consumer law.
• Transactional messages are excluded. One-time passwords, banking alerts, account statements, order confirmations and delivery updates fall outside the guidelines. Only messages intended to advertise, solicit or promote goods, services or opportunities are caught.

Enforcement is meant to be coordinated. The CCPA plans to work with TRAI and MeitY on an interoperable single-window grievance mechanism and a shared registry of repeat offenders, with coordinated sanctions that can include suspension or disconnection of sender identities. The framework also provides for bi-annual regulatory reviews to keep pace with generative AI tools and new messaging channels.

Why Small Sellers Say the Paperwork Is the Problem

The India SME Forum's representation, which Mint reviewed, makes a point that anyone who has run a small firm will recognise. Most small businesses are run by one person who handles sales, customer service and administration at the same time, frequently from the same phone number. Consent management, record maintenance and complaint handling are not tasks sitting idle waiting for an owner.

The forum's objections are technical, not philosophical:

• Product-specific consent is unclear. A retailer or service provider selling several product lines cannot realistically collect a separate consent for each one. The forum has asked for consent to be allowed for clearly defined product or service categories, subject to consumer choice and purpose limitations.
• Consent must be easy to give. It wants simple, accessible consent methods for non-telecom channels, including customer replies, website forms and QR code subscriptions. A consent route that requires an app or a portal will simply not be used at a counter.
• Automation is not the same as concealment. The forum has asked regulators to distinguish between fully automated communications and human-reviewed messages drafted with AI tools, while still requiring clear disclosure for automated interactions.
• Impact assessment first. Before the draft is formalised, the forum wants the consumer affairs ministry to assess what the rules will cost firms that have no separate compliance team.

The ministry did not respond to Mint's queries before publication. The draft remains a draft.

Marketers Warn the Channel Could Shrink

Industry experts quoted by Mint argue the guidelines could produce a sharp increase in calls seeking consent for advertising, making it harder for businesses to reach consumers at all. Meghna Bal, director of the Esya Centre, a technology policy think tank, pointed to a 2024 study it conducted across 300 businesses, in which almost 90 per cent or more said outbound communication is imperative for revenue generation and customer acquisition, domestically and across borders. Removing the channel, she said, would make it harder for consumers to find new products.

The stakes are not marginal. Digital advertising revenue jumped 26 per cent to Rs 94,700 crore in 2025, according to a FICCI-EY report, and now makes up nearly two-thirds of India's overall advertising market. For a small seller without a storefront on a high street, outbound messaging is often the cheapest route to a first order.

Consumers, and a 97 Percent Number

The consumer side of the argument has better numbers. LocalCircles, the citizen engagement platform, found in its latest survey that 97 per cent of mobile users still receive spam calls daily, many of them from 10-digit numbers that fall outside existing telecom rules.

Sachin Taparia, founder of LocalCircles, welcomed the CCPA's move to hold brands accountable for calls made directly or through outsourced agents. In his reading, once callers must verify their identity, disclose AI-generated calls upfront and resolve complaints within seven days, consumers will be able to tell a genuine call from a fraud. His summary of the compliance burden is deliberately plain: for legitimate businesses, small or large, compliance is simple, take consent, identify yourself and honour the opt-out.

India is late to a party that other markets regulated years ago. The UK's Privacy and Electronic Communications Regulations came into force in December 2003, the EU adopted its ePrivacy Directive in July 2002, and the United States introduced its Telemarketing Sales Rule in 1995 before setting up the National Do Not Call Registry in 2003. Those frameworks govern unsolicited marketing through consent, disclosure and opt-out requirements. The US experience suggests curbs work slowly: despite a rise in complaints in FY2025, unwanted-call complaints stayed about 48 per cent below FY2021 levels after the registry and stricter telemarketing rules took hold.

A Practical Checklist for Indian Small Businesses

The draft may change before it is notified. The direction will not. For a shop, a clinic, a coaching centre or a D2C brand, the work that matters is documentation, and most of it can be started now.

• Keep a consent log. For every contact, record the number, the channel, the purpose, the date and how consent was captured. The draft contemplates retaining verifiable consent and audit records for up to 365 days.
• Split the numbers. Run sales and customer support on separate lines where possible. It is the single cheapest fix for the "same number for everything" problem the SME Forum raised.
• Ask by category. Take one consent for offers on a product category rather than a fresh consent for every item.
• Say it is AI, first. If a voice note, call or message is generated by AI, disclose it in the opening line. This is the requirement most likely to catch a small business off guard, because cheap AI calling tools are now widely used.
• Honour opt-outs the same day. Log the date, and do not re-approach until the cooling-off window, up to 90 days, has passed.
• Name a grievance owner. Even if it is the owner. Publish a contact, acknowledge within 24 hours and resolve within seven days.
• Audit your calling agency. The brand is liable for calls made by outsourced agents. Put consent, disclosure and opt-out obligations into the contract, and ask for the call recordings.
• Capture consent where you can prove it. A website form, a QR code subscription at the counter or a saved customer reply is evidence. A verbal yes remembered by the salesperson is not.
• Do not buy lists of 10-digit numbers. The draft specifically targets unauthorised use of mobile numbers for telemarketing.

What Happens Next

The CCPA has already shown it will use the Consumer Protection Act's unfair trade practice route, having fined Rapido Rs 10 lakh over dark patterns earlier this year. The pesky communications guidelines are a different rulebook, aimed at outreach rather than interface design, but they come from the same regulator with the same enforcement machinery behind them.

Between now and final publication, the argument will be about the cost of compliance. The India SME Forum wants a lighter consent regime and an impact study. Consumer groups want identity verification, AI disclosure and a seven-day complaint clock. Both can be accommodated in the final text, and both will leave small businesses with the same practical obligation: the ability to show, on request, that a customer agreed to be contacted, that the message said who was sending it, and that the customer's no was recorded and respected.

For most Indian small businesses, the real bill will not be a penalty. It will be the hour a week spent keeping that record straight. Starting the log before the rules are notified is cheaper than rebuilding it afterwards.

Sources

• Mint — Industry body flags unintended consequences of CCPA's proposed ad guidelines for small businesses (21 October 2026)
• Adgully — CCPA drafts strict rules to curb pesky calls, OTT ads, and AI marketing (15 September 2026)
• DataGuidance — India: CCPA proposed draft guidelines on unsolicited commercial communications