India's 2026 anti-spam rules: what TRAI's new amendment means for senders

TRAI's September 2026 amendment makes Indian operators flag likely spam senders with AI and share the flags, requires automated calls to be declared in advance, suspends misused SMS headers within 6 hours and limits inquiry-based consent to 7 days. It also protects the official 140, 1600 and 1601 number series from blanket spam-tagging by caller ID apps. Senders need clean consent records and correctly classified numbers.

Not legal advice. This is a plain-English summary of public TRAI documents, dated as shown and fetched on 26 September 2026. Read the regulation itself and take advice from Indian counsel before changing how you message customers in India.

#What does the 2026 amendment change?

On 18 September 2026 TRAI announced the Telecom Commercial Communications Customer Preference (Third Amendment) Regulations, 2026 (regulation 5 of 2026) in press release 119/2026 (TRAI, 2026). It amends the 2018 regulations (TCCCPR 2018), which were last amended in February 2025 (TRAI, 2025). The draft was published on 13 March 2026, followed by public comments and an open house on 3 June 2026.

The main changes for businesses that send SMS or place calls to Indian numbers:

UCC means unsolicited commercial communication, TSP means telecom service provider (the operator) and A2P means application-to-person.

When it applies. Under regulation 1(3), the amendment takes effect 30 days after publication in the Official Gazette. The exceptions: regulations 4, 6, 8(a) and 18 apply after 60 days (these cover A2P declaration, the termination charge, header misuse and a DLT interface for virtual network operators), and the amendments listed in the annexure after 90 days (appeals, complaint corroboration, wrong-category templates). We couldn't find the Gazette publication date, so we don't give calendar dates here.

#How did India's anti-spam rules get here?

The 2026 amendment is the latest step in an eight-year framework. The dates below come from TRAI's own documents:

The direction is consistent: from consent paperwork toward network-level detection, and from per-number action toward per-sender action.

#What are the 140, 1600 and 1601 number series?

They are dedicated number series, so people can tell official service calls from promotions:

The 1600 series is assigned by the Department of Telecommunications. TRAI set phased adoption deadlines between 1 January and 15 March 2026 for banks, non-bank lenders, mutual funds, brokers and pension entities (PR 135/2025). For the 1601 series, TRAI announced a first phase on 10 August 2026, with "complete migration and onboarding … within 90 days" of the order (PR 113/2026). Numbers go to the entities themselves, "not to intermediaries or aggregators".

Operators' own AI systems also may not flag 140xx, 1600xx or 1601xx numbers as spam to recipients. Individual users can still block any number they like.

#What does the 7-day inquiry consent rule mean?

If someone only asked a question (they requested a quote or filled in a contact form) and didn't give explicit consent to marketing, you can message them about it for seven days from the inquiry. After that you need registered consent.

Three conditions from the regulation text:

1. The inquiry must be made "in writing or through digital means". A verbal request on a call isn't enough.
2. The sender must keep it in a verifiable form.
3. The window is counted from the date of the inquiry, not from your first reply.

In practice, store the inquiry timestamp and channel with the lead, and have your messaging system stop inquiry-based sends after day 7 unless consent has been recorded. The amendment also recognises legacy consents that are verifiable and registered.

#How are spam senders detected and penalised?

By operator AI systems, customer complaints, and graded action against the sender. The new regulation 21A requires operators to detect sender numbers with a high probability of sending spam and share them with each other. When five or more of one sender's numbers are flagged within ten days, the operator investigates and applies graded action, from KYC re-verification to barring and disconnection.

For complaints, the trigger becomes three or more unique complaints within ten days, corroborated by an AI flag. Before, it was five complaints. Consumers get an appeal route within 15 days.

For telemarketers, misuse has real consequences. If a header or template is misused through a telemarketer's fault, its numbers are disconnected for a year and it is blacklisted.

How big is enforcement already? TRAI's published figures:

The two periods and metrics differ (a year against a quarter, disconnections against barring), so don't read the table as a trend. What it shows is scale. In one quarter of 2026, operator AI flagged 22.99 billion calls and 1.44 billion SMS, and 243,000 warnings were issued from 23 June 2026 (PR 111/2026).

#What should a spam-scoring system treat differently in India?

India now has a regulator-run spam signal inside the network, so an external score shouldn't contradict it:

• Respect the protected series. Treat 140xx as promotional and DND-governed, and 1600xx and 1601xx as verified service lines. Don't score them as spam by default. The amendment forbids blanket tagging by call management apps.
• Weight complaints through the official route. TRAI's framework counts complaints made through the operators and the DND app. Apps may not offer spam reporting unless the reports go to the operators' registry platform.
• Sender, not just number. Action is taken per sender across all its numbers ("five or more CLIs associated with a Sender"). A number that looks clean can belong to a flagged sender.
• Be honest about coverage. Our own spam reputation check is in limited access. It accepts Indian numbers, but our report data is densest for North American and European numbers, so a no_reports answer for an Indian number is weak evidence. We say that plainly rather than overstate it.

#What does this mean for senders based outside India?

In our reading, the rules reach you whenever your messages or calls end on Indian networks, because they are enforced through Indian operators. In practice, a foreign business reaches Indian phones through an Indian operator or an aggregator connected to one, and that partner applies the header, template and consent rules to your traffic.

Three things to settle with your messaging partner:

1. Who registers your headers and templates, and in which category. If your partner registers them for you, you still own the consequences of misuse.
2. How one-time codes are routed and categorised. Authentication traffic needs correctly categorised templates, and a wrong category is now a named violation. Our why SMS is not delivered guide covers other reasons codes fail.
3. Where consent records live. Inquiry-based messages now have a 7-day limit, so your CRM must be able to prove when and how each inquiry arrived.

If your volume to India is mainly one-time codes, compare the SMS route with messaging apps: WhatsApp's authentication rate for India is $0.0014 per delivered message on Meta's October 2026 rate card (our WhatsApp pricing guide). The TRAI regulations govern telecom networks, and messaging apps have their own rules, so the choice is operational as well as regulatory. Ask counsel.

#A compliance checklist for businesses sending SMS to India

Use this with your counsel and your Indian telecom partner:

For the US counterpart, see our TCPA compliance checklist for SMS. For choosing between SMS, WhatsApp and other channels by market, see choosing a messaging channel by country.

#What are the key takeaways?

• TRAI's Third Amendment to TCCCPR 2018 was announced on 18 September 2026 (PR 119/2026) and applies in waves 30, 60 and 90 days after Gazette publication.
• Operators must flag likely spam senders with AI and share the flags. Five flagged numbers of one sender in ten days, or three complaints plus an AI flag, triggers action.
• Automated calls must be pre-declared (and operators may charge each other up to Rs 0.05 per minute to terminate them), misused headers are suspended within 6 hours, and inquiry-based messages are limited to 7 days.
• The 140xx, 1600xx and 1601xx series are protected from blanket spam-tagging. Service callers should move to 1600 or 1601 as their sector is phased in.
• This is not legal advice. Confirm the details against the regulation and with Indian counsel.