India's spam crisis is a design flaw, not an enforcement issue

India's anti-spam framework has improved traceability, but consent remains flawed. Giving telecom operators a stronger role in real-time verification could restore trust

India’s spam crisis reflects a breakdown in the trust architecture of digital communications. Over the past few years, regulations have been tightened, telecom operators have invested heavily in Distributed Ledger Technology (DLT) infrastructure, and enterprises have been brought under more structured compliance frameworks. These measures have improved traceability across the commercial messaging ecosystem. However, spam complaints continue to rise as the system is consistently failing in part because of where they have been focused.

 There is a structural flaw in how consent itself is designed, captured, and verified. 

India’s commercial messaging system divides responsibility between two entities. Originating Access Providers (OAPs) onboard commercial enterprises, register message templates, and push commercial traffic into the network. Terminating Access Providers (TAPs) deliver messages to end-users, maintain customer relationships, manage complaints, and bear direct regulatory accountability. 

The fundamental issue stems from where consent authority currently resides. Consent creation and verification are currently placed at the origination layer by OAPs, whose main business goal is facilitating traffic. OAPs earn more revenue as message volumes increase. This creates a direct conflict of interest, as the entities that benefit from higher traffic are also responsible for determining whether messages are supported by valid consent. As a result, strict verification and enforcement work against their commercial incentives. 

The division of responsibility also separates consent validation from consumer accountability. The OAP that validates consent does not manage the subscriber who ultimately receives the message. Consent is recorded and approved at the origination stage by OAPs, while its consequences are experienced at the delivery stage by the subscriber and the TAP. As a result, subscribers routinely receive spam messages that strictly comply with pre-registered templates and satisfy consent requirements on paper, but originate from brands the user does not recognise or ever recalls consenting to.  

The Telecom Commercial Communications Customer Preference Regulations (TCCCPR) and DLT-based systems have brought structure and traceability to a previously fragmented ecosystem. The next stage of reform should recognise consent as a trust function rather than only as a message-routing requirement.  

Trust is tested when a message reaches the subscriber. The delivery stage is therefore the most appropriate point for confirming whether the communication reflects the subscriber’s current preference. 

The path forward: A next-generation trust architecture 

This realisation is central to the next phase of regulatory evolution, and should strengthen the role of real-time consent verification. A durable framework must rest on three principles:

 (1) Consent could be treated as a current and verifiable status rather than a record created once and stored indefinitely. Subscriber preferences should remain capable of being updated, withdrawn, and enforced at every stage of message delivery.

TAPs may be given a larger role in this process. They manage the subscriber relationship, maintain ‘Do Not Disturb’ preferences, receive complaints, and remain directly accountable to the regulator. They are therefore well placed to verify consent immediately before a message is delivered. The framework could allow TAPs to pause or block a message where current preferences, consent withdrawals, or complaint records raise concerns. This authority may apply even when the message template has already been approved. 

(2) Accountability could also be linked across the messaging chain. Where a consent-related complaint is established, the framework should identify the enterprise, telemarketer, and originating provider involved. This would encourage each participant to maintain accurate consent records before a message enters the network. 

(3) Consent records could also include a defined validity period and reflect changes in subscriber preferences, withdrawals, and complaint history. India has already established a strong technical framework for commercial communications. The next phase must connect this system more closely with the subscriber relationship. Giving TAPs a stronger role in consent verification would improve accountability, reduce unwanted messages, and strengthen trust in digital communications.

 

The writer is founder and president, Centre for Digital Economy Policy Research, New Delhi