Summary

  • Under the September rules, five high-probability flagged numbers linked to one sender within ten days trigger graduated checks. A successful first identity check still counts as a first instance of violation.
  • Senders can contest a flag, and consumers have a separate appeal route. These provisions have different commencement periods; announcing the package did not switch everything on at once.

Proving who made a call does not prove that the person receiving it wanted it. India's revised anti-spam rules make that distinction unusually consequential: a sender can pass an identity check and still have an instance of violation recorded.

The provision appears in the September amendment to India's commercial-communications rules. Once five or more numbers linked to the same sender have been identified as high-probability sources of unsolicited commercial communication within ten days, the originating provider must begin the graduated process. At the first instance, it rechecks the sender's identity documents. Even a successful check does not reset the count.

That is not a rule disconnecting someone after one machine-generated warning. But it is more consequential than describing every flag as a harmless lead. To understand the protection for both caller and recipient, follow what happens to the record.

A warning gets a timetable

The 27 February direction sought to move detection beyond alerts displayed to subscribers. The recipient's provider was to share a flagged calling number with the originating provider immediately, and within two hours at the latest, using the distributed-ledger platform known as DLT.

The originating provider then notifies the sender and uses its customer-identification records to connect the number to a person or organisation. Other providers look for resources assigned to the same sender. A warning about one number can therefore lead to scrutiny of a larger collection.

September's regulation 21A makes an important distinction: the numbers shared for this process are identified as high-probability suspected sources of unwanted commercial communication. An ordinary spam warning on a handset is not automatically the same regulatory input.

The identity work matters because numbers and senders are different things. An incorrect association can carry an alert into someone else's record; a correct association still leaves the separate question of whether the communications were permitted.

What a successful check does—and does not—settle

The first check is due within the next three business days after the five-number threshold is established. Failed verification brings action under the existing identity rules. Successful verification still leaves a first instance on the record.

A second instance brings physical identity verification within five business days. If the identity details do not match, or misuse is found, the September text provides for a fifteen-day bar on outgoing services across the sender's allotted telecom resources. Even matching identity details do not erase the second-instance count. Later instances require further checks for misuse and can lead to the repeat-violation measures.

These distinctions prevent an easy but misleading shortcut: “the documents checked out, so the case vanished.” Identity checking and permission to contact a recipient answer different questions. Equally, the regulation's history count should not be confused with an automatic final disconnection after a single prediction.

The caller has a route back

The same regulation expressly requires providers to let a flagged sender present a justification and to remove the flag where that justification is found to be in order. This is a published requirement, not merely a safeguard that someone might add later.

There are also challenges to enforcement action. Under regulations 25 and 29, the sender can make a representation to the originating provider and, if dissatisfied, to Telecom Regulatory Authority of India (TRAI). Where the evidence is inadequate, the authority may direct restoration of resources, subject to feasibility, and removal from the blacklist.

A right to challenge a flag is different from proof that every provider implements that right well. The published text does not tell a reader how often flags are removed, how long a correction takes across networks, or how often the same error reappears. Those are questions about performance, not evidence that the remedy is absent.

Three complaints are not the whole rule

The official announcement highlights an additional complaint route. For the unregistered-telemarketer procedure, three or more complaints from distinct recipients within ten days can meet the threshold when any number allotted to the sender has also been identified or maintained as high-probability during that period.

The separate five-complaint route remains. It does not require that additional AI condition. Nor does the three-complaint provision say that the flagged number must be the exact number involved in every complaint: the link is to the sender.

After the provider confirms that the complained-about communication occurred and the threshold is met, the text requires immediate suspension of the resources used for the unwanted communications while an investigation begins. The sender has an opportunity to respond. That interim interruption is distinct from the broader sanctions that follow an adverse finding.

For the recipient, this can mean action before the whole investigation ends. For the sender, it makes the accuracy of the initial association—and the ability to answer it—commercially important.

Several changes, several clocks

The package listed on the official amendments page has phased commencement. The general period is thirty days after publication in the Official Gazette. Certain provisions, including advance declaration of automated application-to-person calls and their termination charge, have sixty days. The consumer appeal provision and the main complaint-and-AI corroboration provision are among the ninety-day items.

The consumer appeal window is normally fifteen days after receiving the complaint resolution. The text also covers a complaint left without a resolution for fifteen days. That appeal is not the same procedure as a sender's request to remove a flag.

Other changes govern what callers may send. A written or digital customer inquiry can support follow-up within seven days, with a verifiable record. Existing consent must be verifiable and registered through the required process. Automated calls need advance declaration under the relevant provision; undeclared calls are treated as unsolicited commercial communication.

The charge of up to INR 0.05 per minute is between providers, subject to the tariff cap and specified exemptions. It is not a fee charged to someone for answering a call. Designated series such as 140xx, 1600xx and 1601xx are protected from blanket application-level spam treatment, while people retain control over blocking on their own devices.

The biggest number is not an accuracy score

TRAI's February release about 2025 enforcement records 3.109 million complaints, 731,120 notices and 184,482 disconnected telecom resources. It also reports one-month communication restrictions for 473,075 entities and six-month caps for 89,936 repeat offenders.

These are different measures, not consecutive stages of one population. And they describe 2025, not the results of September 2026's amendment. They cannot establish how accurately a model worked or how many unwanted calls the new rules prevented.

Lu Heng's Note 64 offers a useful comparison: a shared label and a record that another party can verify are not equivalent. Its subject is Internet coordination, not Indian law; the statutory obligations here are not voluntary.

Providers need not reveal proprietary model code under the February direction. They can still be asked what happened to a particular number, why it was linked to a sender and whether a successful challenge changed the record. A faster warning is valuable. So is an error that stops travelling.

Update on 20 October 2026

The earlier version did not adequately distinguish the February direction from the September operative text. This revision adds the express sender challenge and unflagging provisions, the retained instance count after successful identity checks, interim suspension and phased commencement. It does not claim that every September provision is already operational.