Explained | TRAI's Digital Consent Acquisition rule and how it may help curb spam

Tired of your SMS inbox inundated with unsolicited messages or receiving phone calls from commercial players or spammers asking you to open bank accounts, invest in schemes, buy real estate, or get a loan for cheap? That is soon set to be a thing of the past.

The Telecom Regulatory Authority of India (TRAI) on Wednesday, November 8, issued directives to commercial entities, making it mandatory — immediately — for them to seek users' consent before sending them commercial messages through SMS. The new directive now requires "entities such as banks, other financial institutions, insurance companies, trading companies, business entities, real estate companies, etc" to seek a user's content, known as Digital Content Acquisition (DCA), before sending them any messages.

The new system will give users the choice to give their consent or even withdraw it subsequently — all of this will be part of the consent acquisition confirmation message.

According to the TRAI statement, the entities, referred to as Principal Entities (PEs) or Senders under the Telecom Commercial Communications Customer Preference Regulations, 2018 (TCCCPR-2018), will have to send a message seeking consent from customers or users through a common short code, beginning with 127 (127xxx, for instance).

TRAI explains that as things stand currently, as things stand, consent is obtained and maintained by various PEs, and it is not possible for access providers to check the veracity of consent. "Further, there is no unified system for customers to provide or revoke the consent," TRAI adds.

The DCA process offers the option for access providers to "seek, maintain, and revoke the consents of customers", as per the processes envisaged under TCCCPR-2018.

According to TRAI, the consent data collected under the new system will be shared on a Distributed Ledger Technology (DLT) Platform, established under TCCCPR-2018.

TRAI also adds that any existing consent will be nullified, and only consent granted under the DCA will be the norm going forward.

The notification was first issued by TRAI on June 2, 2023. The deadline for compliance is November 30.

1. The purpose, scope of consent, and principal entity/brand name shall be mentioned clearly.

2. Only whitelisted URLs/APKs/OTT links/call-back numbers, etc, shall be used in the consent-seeking messages.

3. The consent acquisition confirmation message to the customers will also have information related to the revocation of the consent.

4. Access Providers must develop an SMS/online facility to register the unwillingness of customers to receive any consent-seeking message initiated by a PE.

You can expect to receive messages seeking your consent to receive commercial messages from PEs in the coming days. You have the option to agree, reject, or agree and withdraw your consent at a later date.

This gives you the power to choose which entities or brands can send you commercial messages or calls. The move, as TRAI puts it, is aimed at curbing "the menace of spam through Unsolicited Commercial Communications".

For the moment, it is not clear if the directive only applies to communications through phone calls and SMS, or messages sent through other platforms, such as WhatsApp or email.