TRAI finalised the Telecom Commercial Communications Customer Preference (Third Amendment) Regulations, 2026 this week, after detecting 2,300 crore spam calls in three months. The headlines are about Truecaller and robocalls; the practical effect lands on every small business that follows up leads by phone or SMS. "TRAI new rules for business calls" has been climbing search all week.
What changed
1. Three complaints can now trigger action
Previously five unique complaints in ten days were needed. Now three complaints in ten days, combined with a telecom operator's AI/ML flag on your number, start graded enforcement: KYC re-verification, physical verification, suspension of outgoing calls, and disconnection across all operators for repeat offenders. Operators share suspected-spammer data with each other.
2. Robocalls and AI voice calls are regulated
"Application-to-Person" (A2P) calls — autodialled, pre-recorded, AI-voice or any call not dialled by a human — must be pre-declared to your telecom operator along with the numbers used. Undeclared A2P calls are treated as spam. A termination charge of up to ₹0.05 per minute applies to A2P calls.
3. The seven-day enquiry window
If a customer enquires about your product or service in writing or digitally (a form, WhatsApp message, email), you may call or message them about it for seven days from the enquiry — without registered consent — provided you keep the enquiry in verifiable form. After seven days, you need explicit consent.
4. Consent must be digital and verifiable
Legacy consents (old sign-up sheets, "I agree" boxes from years ago) count only if obtained by verifiable means and registered on the operator's Digital Consent Acquisition platform. Pre-ticked boxes don't count.
5. Headers and templates get suspended fast
If a registered SMS header or content template is misused, the operator must suspend it within six hours. A telemarketer responsible loses telecom resources across all operators for a year.
6. Caller-ID apps must share spam reports
Truecaller-type apps must push user spam reports to the operators' blockchain (DLT) platform — so a customer marking you as spam now reaches the regulator. Conversely, apps may no longer blanket-block the 140xx (promotional) and 1600xx/1601xx (service/transactional) series.
7. Consumers can appeal
A consumer whose complaint was closed can appeal within 15 days — so a "resolved" complaint against you may be reopened.
What this means for a small business
| Practice | Status |
|---|---|
| Calling a lead who filled your form yesterday | Fine for 7 days from the enquiry; keep the form record |
| Calling old leads from a purchased list | Spam. Three complaints and your number is under review |
| WhatsApp promotional broadcast to customers who opted in via a checkbox | Fine if the opt-in is verifiable (Meta also requires it) |
| IVR reminder calls (appointment, EMI due) from a system | A2P — declare to your operator; use a 1600-series number |
| Bulk SMS offers from a 10-digit personal number | Already prohibited; enforcement now faster |
| Follow-up call to a customer who bought last month | Transactional/service follow-up is generally fine; a sales pitch needs consent |
A compliance checklist
- Register on DLT (your operator's platform) if you send any bulk SMS — header, templates, consent.
- Move promotional calling to a 140-series number and transactional calls to a 1600-series number. Customers' phones label them, they are protected from blanket blocking, and your personal number stays clean.
- Declare automated calls — reminders, IVR, AI voice bots — to your operator before using them.
- Capture consent properly: a checkbox that is unticked by default, wording that says what you'll send, timestamped, exportable. Register it on the DCA platform when your operator's process is live.
- Keep enquiry records — WhatsApp screenshots, form submissions with dates — to prove the seven-day window.
- Prefer inbound. A click-to-chat link or QR from the WhatsApp direct tool means the customer opens the conversation, which is consent by definition and free under WhatsApp's per-message pricing.
- Update your privacy notice to state how you use phone numbers and how to opt out — the privacy policy generator includes a marketing-consent clause aligned with DPDP.
- Train staff: no cold calls from personal mobiles, no calling numbers on the DND list, "STOP" means stop.
Penalties
Beyond number suspension, operators impose financial disincentives on senders (₹2 lakh to ₹10 lakh per violation under the graded framework), and repeat violators are blacklisted across all operators for up to two years.
FAQ
I run a small clinic and call patients about appointments. Is that spam?
Appointment reminders are service communications and are permitted. Use a 1600-series or declared number if automated; a human call from your clinic number is fine.
Can I message someone who scanned my QR at an exhibition?
If they submitted their number with an indication of interest, the seven-day window applies. Ask them to opt in to future updates during that week.
Does this apply to WhatsApp?
TRAI regulates telecom (calls/SMS). WhatsApp is governed by Meta's policies and DPDP — which are stricter on marketing consent, not looser.
What is DLT?
The Distributed Ledger Technology platform run by operators where senders, headers, templates and consents are registered. Bulk SMS without DLT registration is blocked.