Chapter 1 · The scenario
Example: A Kochi jeweller's new-collection list
A Kochi jewellery chain wants to text Onam offers to walk-in customers who ask to hear about new collections. Instead of a paper register at the counter, the billing desk triggers a consent request for the customer's number. The customer receives a message from a 127-series short code naming the chain and stating the purpose, offers on new collections, and confirms before leaving the store. The consent is recorded on DLT, so when the offer goes out the operators' scrubbing finds it. Three weeks later one customer revokes through the option in her confirmation message, and the next campaign does not reach her, even though the chain's own list had not yet been updated.
Chapter 2 · What is digital consent acquisition (DCA)?
Digital Consent Acquisition (DCA) is the system India's telecom regulator, TRAI, directed mobile operators to build so that customer consent to commercial SMS and calls is captured and stored in one verifiable place. Instead of each bank, insurer or retailer keeping its own record of who agreed to hear from it, which operators had no way to check, consent is sought through an operator-run flow, confirmed by the customer and recorded on the DLT platform set up under TCCCPR 2018.
The direction, issued to all access providers on 2 June 2023, sets the rules of that flow. Consent-seeking messages use a common short code in the 127xxx series and must state the purpose, the scope of consent and the name of the principal entity or brand; only whitelisted URLs, APKs, OTT links and call-back numbers may appear in them. The confirmation the customer receives also explains how to revoke, and operators must offer an SMS, IVR or online facility where customers can refuse consent-seeking messages from every brand. In the first phase only customer-initiated consent acquisition was allowed.
Once recorded, consent data is shared on DLT for scrubbing by every operator, so a consent-based message from that brand can be checked whichever network the recipient uses. DCA consent is telecom consent: it governs commercial SMS and calls and works alongside the DLT Message Category rules. It is separate from Opt-in for WhatsApp, which Meta's policies require and the business records itself, and from consent under the DPDP Act, which covers processing personal data and can be managed through a DPDP Consent Manager.
Key takeaways
- Digital consent acquisition (DCA) is TRAI's operator-run system for recording customer consent to commercial SMS and calls on DLT.
- Consent-seeking messages come from the common short code 127xxx and must name the brand, the purpose and the scope of consent.
- Consent recorded through DCA is shared on DLT so every operator's scrubbing can check it; the confirmation explains how to revoke.
- TRAI directed operators to build DCA on 2 June 2023, and in the first phase only customer-initiated consent requests were allowed.
- DCA consent is telecom consent only: it is separate from WhatsApp opt-in and from consent under the DPDP Act.
Chapter 3 · How it unfolds
How does digital consent acquisition (DCA) work?
The customer starts it
The customer asks to hear from the brand, at a store counter, on a website or in an app. In the first phase TRAI allowed only these customer-initiated requests.
A consent-seeking SMS arrives from 127xxx
The operator's DCA facility sends a message from the common short code naming the brand, the purpose (for example, offers on new collections) and the scope of consent.
The customer confirms
Consent is recorded only when the customer actively confirms through the response option the message offers. Silence or a missed message is not consent.
Consent is written to DLT
The record is shared on the DLT platform so every operator's scrubbing can check it, and the customer receives a confirmation that explains how to revoke.
Messages are scrubbed against it
When the brand sends a consent-based message, scrubbing checks for a valid consent for that brand alongside the header, template and preference checks.
Revocation ends it
The customer revokes through the route given in the confirmation; once the DLT record changes, consent-based messages from that brand stop passing scrubbing.
Chapter 4 · The facts
Digital consent acquisition (DCA): key facts and limits
| Set up by | TRAI direction to all access providers, 2 June 2023 |
|---|---|
| Legal basis | TCCCPR 2018 |
| Short code | Common 127xxx series for consent-seeking messages |
| Message must state | Purpose, scope of consent, brand or principal entity |
| Links allowed | Only whitelisted URLs, APKs, OTT links and call-back numbers |
| First phase | Customer-initiated consent requests only |
| Where consent lives | On DLT, shared with every operator for scrubbing |
Chapter 5 · Why it matters
Why does digital consent acquisition (DCA) matter?
For marketers, consent decides who can be reached at all: consent-based SMS categories reach a customer only when scrubbing finds a valid consent for that brand. Paper registers and checkbox logs held by the brand could not be verified by operators, which is how consent claims became a loophole for spam. DCA moves the evidence into the operators' own ledger, so a brand that collects consent properly can prove it at the moment of sending, and a customer can withdraw it in one place.
Chapter 6 · Where it goes wrong
Common mistakes with digital consent acquisition (DCA)
Treating DCA as WhatsApp opt-in
DCA consent covers commercial SMS and calls on Indian networks. WhatsApp messaging needs its own opt-in under Meta's policies, collected and recorded by the business.
Assuming DCA satisfies the DPDP Act
Consent to receive messages is not consent to process personal data. Give a DPDP privacy notice and keep that consent record separately.
Vague purposes
A consent-seeking message must state purpose and scope. A catch-all such as updates from us invites refusals and complaints; a specific purpose such as offers on home loans is what the rules ask for.
Relying on old consent lists
TRAI indicated that once DCA is in place, consents gathered outside it would not count for these messages. Check the current position with your operator or aggregator before a campaign.
Ignoring revocations in your own systems
Scrubbing blocks messages after a revocation, but your CRM should stop targeting that customer too, or you keep paying to submit messages that will never be delivered.
Chapter 7 · DCA FAQs
DCA FAQs
What is the 127xxx short code?+
How do I revoke consent given through DCA?+
Is DCA consent the same as consent under the DPDP Act?+
Does DCA apply to WhatsApp messages?+
Chapter 8 · What good teams do
Best practices for digital consent acquisition (DCA)
- Trigger the consent request while the customer is present, so they can confirm at once.
- Use one clear purpose per product line rather than a single catch-all consent.
- Keep your own log of consent requests and outcomes and reconcile it with what DLT holds.
- Ask your aggregator how DCA consent flows for your principal entity, since rollout has been phased.