India's spam rules lack promised consent system
A system intended to combat spam by India's telecom regulator (TRAI) has failed to implement a crucial consent mechanism, rendering it ineffective. Discussions revealed that the regulatory DLT platform, while built, lacks the user consent layer essential for its operation.
India's Telecom Regulatory Authority (TRAI) established rules in 2018 to curb spam messages, but a core component of the system – a consent mechanism – has never been operationalized. The Telecom Commercial Communications Customer Preference Regulations (TCCCPR) mandated a Distributed Ledger Technology (DLT) platform, based on blockchain, to register commercial senders and trace messages. However, critics argue that the crucial consent layer at the system's heart remains missing, significantly impairing its effectiveness.
Industry experts emphasize that without explicit user consent, the system cannot reliably identify spam. "There is no definition of spam. Spam is in the eye of the beholder," stated a speaker at a MediaNama roundtable. A message only becomes spam when it reaches an unwanted recipient, making the recording of individual preferences the only accurate method for detection.
The current framework offers no transparency to consumers regarding their explicit agreements. Users lack any record or interface to review their granted consents. This deficiency also opens avenues for overly broad or potentially fabricated consent. "Consent has been taken universally, even if a 1600 or 140 number is used," one speaker noted, implying a single registration can be interpreted as blanket permission. There have also been instances where networks have recorded consent for transactions that never occurred.
While an earlier attempt at a consent system, the Digital Consent Acquisition (DCA) mechanism, failed to gain traction, new initiatives are underway. A recent pilot has successfully demonstrated a working model where consumers can easily revoke their consents. Such a system would empower individuals to view all entities they've agreed to hear from and opt-out as needed. Furthermore, the newly introduced consent managers under the Digital Personal Data Protection (DPDP) Act could potentially be integrated into the telecom framework to enhance compliance and user control.