Outbound voice calls for elections and government in India: the TRAI and ECI rules

India's do-not-disturb mechanism is the Customer Preference Registration Facility every access provider has to run 24x7, reachable by SMS or a call to 1909, by IVRS, USSD, an approved app or an authenticated web portal. A customer can block by content category, by mode, by time band and by day type, and the access provider has to acknowledge the request within fifteen minutes with a reference number and give the preference effect within twenty-four hours.

The 2025 amendment rewrote what the strongest setting does. "Fully blocked" now means stoppage of all types of commercial communication requiring explicit consent, except communication sent under inferred consent and Government Messages or Government Voice Calls. A citizen on full block still receives a government call routed through DLT. They do not receive your campaign call, and no amount of consent paperwork changes that unless the consent is explicit, digital and on the Consent Register.

Scrubbing is not a one-time list purchase. Preferences change in near real time, so the only defensible practice is a scrub immediately before each wave, with the scrub result retained against that wave. If a complaint lands later, the question asked will be what the register said at the moment you dialled.

Revocation has a hard consequence the amendment added: where a customer revokes consent or opts out, the sender may re-acquire consent from that customer only after ninety days. Build the suppression so that it holds for ninety days by default rather than until somebody re-uploads the roll.

"Intimation regarding use of Auto Dialer or Robo-Calls.— Every Sender shall notify the Originating Access Provider, in advance, about the use of Auto Dialer or Robo-Calls as well as the intended objective of such calls in writing."

An AI voice agent placing outbound calls from a list is an auto dialler by the 2018 definition: a call initiated automatically by equipment according to stored or programmable instructions, to numbers already stored or auto-generated by software, which on answer either plays a recording or connects to a live person. The obligation sits on the sender, not the platform, and it is written rather than implied — advance, in writing, to the originating access provider, stating the objective.

This is the cheapest item on the whole checklist and the one most often missed, because it is administrative rather than technical. Get it filed before the pilot wave, not after a complaint.

Explicit consent under the TCCCPR is not a tick on a form you hold. It lives on the Consent Register — a distributed ledger maintained by a Consent Registrar — and it is acquired through the Digital Consent Acquisition flow, with consent-seeking messages sent from the 127xxx short code and the principal entity or brand named clearly in the request. A consent you can only evidence from your own CRM is not the consent the regulation is describing.

Two limits were tightened in 2025. Inferred consent does not extend beyond the duration or discharge of the contract between sender and recipient. And where a service call rests on explicit consent, that consent runs for seven days unless the Authority directs otherwise — which means a consent captured in January does not carry a service call in March.

The confirmation a customer receives on consent acquisition must itself carry information on how to revoke. Where a telecom resource is surrendered or closed, every consent registered against it is revoked on the ledger — so a recycled number does not inherit the previous holder's permission.

For an election or government programme, write down for every field you hold: which list it came from, what purpose it was collected for, what the retention window is, and who can delete it. That discipline is not yet a live statutory duty in India, for reasons set out in the DPDP section below, but it is the record that answers a complaint, and building it later costs more than building it now.

The Election Commission's requirement is about campaign content. In its statement of 9 October 2025, on the Bihar Assembly election, the Commission required that all political parties and their leaders, candidates and star campaigners take necessary measures for prominent labelling of AI-generated or synthetic content being shared for campaigning through their social media platforms or in the form of advertisements, using clear notations such as "AI-Generated", "Digitally Enhanced" or "Synthetic Content". On 19 April 2026 the Commission restated it more broadly: synthetically generated or AI-altered content used for campaigning must be clearly labelled with those same notations, along with disclosure of the originating entity, and misleading or unlawful AI-generated or manipulated content must be acted upon within three hours of being brought to the notice of social media platforms.

Read that carefully before you build to it. The October 2025 wording is scoped to social media and advertisements. The April 2026 wording says "used for campaigning" without naming a channel. Neither statement names outbound voice calls. An honest reading is that a synthetic-voice campaign call is within the spirit of the April 2026 wording and outside the letter of the October 2025 one, and that a campaign which discloses the AI in the opening line has nothing to argue about either way.

The IT Rules requirement is about platforms. The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, as amended by G.S.R. 120(E) dated 10 February 2026 and in force from 20 February 2026, insert a definition of "synthetically generated information" and a new rule 3(3). Where an intermediary offers a computer resource that enables the creation of such content, it must ensure that content not otherwise unlawful is prominently labelled — and, in the case of audio content, "through a prominently prefixed audio disclosure" — with permanent metadata or provenance markers embedded to the extent technically feasible, and it must not enable removal of that label.

The duty-holder there is the intermediary offering the generating tool, not the organisation placing the call. It is a live obligation, it is about audio, and it will shape what your voice vendor's output sounds like. It is not, on its text, a rule that tells a government department what to say in its opening line. Ask your vendor how they satisfy rule 3(3); do not let them tell you it is your obligation.

The third instrument is the older one and the widest: the 2021 Rules as amended clarify that any reference to information used to commit an unlawful act is to be construed as including synthetically generated information. Synthetic audio that falsely depicts a real person's voice, conduct or statements in a way likely to deceive is called out explicitly in rule 3(3)(a)(i)(IV). Cloning a candidate's or an official's voice is the thing that provision exists to stop, whatever the consent position between you and them.

Our position, stated as a recommendation rather than a citation: disclose the AI in the first sentence of every outbound call, in the language of the call, and never synthesise the voice of a real political figure. The first costs you nothing in answer rate that a clear purpose statement does not win back. The second has no legitimate version.

Under the TCCCPR the sender-facing consequence is loss of telephony, not a fine. Where complaints against a sender come from five or more unique recipients in the last ten days, the originating access provider suspends outgoing services on the resources used and opens an investigation, deciding within five business days of the sender's representation.

On a first finding of violation, outgoing services on all of the sender's telecom resources — including PRI and SIP trunks — are barred by all access providers for fifteen days, whether or not those particular resources were used to send the offending traffic. On a second or subsequent finding, all telecom resources across all access providers are disconnected for one year, the sender goes on the blacklist so no access provider will issue new resources during that period, and the devices used are blocked for a year. One telephone number may be retained with outgoing barred.

Restoration, where the Authority accepts that the sender took reasonable steps to prevent recurrence, costs five thousand rupees per telecom resource, capped at five lakh rupees — and each DID number on a PRI or SIP trunk counts as a separate resource.

Financial disincentives under the TCCCPR fall on access providers rather than on you: one thousand rupees per instance for certain registration failures, five thousand and ten thousand rupees per instance for others, two lakh rupees for non-reporting rising to five and ten lakh for consecutive misreporting, with the total capped at fifty lakh rupees per calendar month per licensed service area. Your exposure is the suspension, not that schedule.

Under the DPDP Act, once section 33 and the Schedule commence on 13 May 2027, the ceilings are up to two hundred and fifty crore rupees for failing to take reasonable security safeguards, up to two hundred crore for failing to notify a breach, and up to fifty crore for breach of any other provision.

Under section 126(2) of the Representation of the People Act, 1951, contravention of the silence-period prohibition is punishable with imprisonment up to two years, or a fine, or both.

Enforced in code: the calling-window gate. `isWithinCallingHoursIst()` in `lib/validation.ts` reads the hour in Asia/Kolkata and returns false outside 10:00–21:00, and `app/api/demo-call/route.ts` rejects the request with an explanatory message rather than queuing it. The gate previously opened at 09:00, which is an hour inside a band that Schedule-II Note-1 leaves off by default; it was tightened to 10:00 rather than the claim being widened.

Enforced in the agent configuration: AI self-disclosure in the opening line. The first message is a fixed string in the agent definition rather than something the model composes — the UP Transport agent opens "मैं उत्तर प्रदेश परिवहन विभाग की AI यात्री सहायक हूँ", and the karyakarta agent's system prompt instructs it to say plainly that it is an AI assistant and not an office-bearer if asked. A hard-coded first message is the only version of this control that survives a model update.

Recommended, not claimed: DND scrubbing before each wave, DLT sender and header registration, the regulation 4 auto-dialler intimation, ninety-day suppression after opt-out, per-field retention windows, and political-advertiser registration. These are deployment-side operations that happen in the telephony and CRM layer, and this codebase does not perform them. Any vendor — including us — should be asked to show the artefact rather than the assertion: the scrub file, the DLT registration, the written intimation, the retention schedule.

The general rule we would apply to any quote you receive, ours included: a compliance claim that cannot name the document, the provision and the artefact is a posture. Ask for all three.