AI Disclosure & Labelling for WhatsApp Bots India 2026

If you run an AI bot, GenAI-drafted replies, or synthetic voice/image creatives on WhatsApp in India, the short answer is: be transparent. Tell people when they are talking to an AI rather than a human, label AI-generated media, and only process customer messages through AI on a lawful, consent-backed basis. India's AI-governance landscape is still evolving in 2026 — a mix of MeitY advisories and proposed frameworks, the IT Rules' intermediary and synthetic-media obligations, the DPDP Act 2023, ASCI guidance on AI in advertising, and consumer-protection law against misleading practices. None of these is a single tidy "AI disclosure law", and the specifics are moving — so treat this as a practical, transparency-first operating posture, verify every rule citation as of 2026, and remember this is general information, not legal advice.

Why AI disclosure is suddenly a thing in India

Two forces collided. First, GenAI made it trivially cheap to generate human-sounding replies, cloned voices, and photoreal images — so the old assumption that "if it sounds human, it is human" broke. Second, India's regulators started reacting. MeitY has issued AI-governance advisories and floated a broader framework (status evolving, verify as of 2026); the IT Rules already impose due-diligence and synthetic-media obligations on intermediaries; the DPDP Act 2023 governs how you collect and process personal data — which includes the customer messages your AI reads; ASCI has weighed in on AI use in advertising creatives; and consumer-protection law has long prohibited misleading and deceptive practices. The throughline across all of them is not a numbered "AI label" rule — it is a principle: do not deceive people about what they are interacting with. On WhatsApp, where one-to-one chat feels inherently personal, that principle bites harder than on a website. Pretending a bot is a named human, or passing AI-generated media off as a real photo or a real person's voice, is exactly the kind of conduct these overlapping regimes are designed to discourage. The safe, durable response is transparency by default — and it happens to convert better too.

When you must say "this is AI"

There is no single statutory trigger you can point to in 2026; instead, disclosure obligation rises with the risk of deception. Use a simple test: would a reasonable customer assume they are talking to, or looking at the work of, a real human — and would that assumption matter to their decision? If yes, disclose. The clearest cases: an always-on chatbot answering as if it were a person, AI-drafted replies sent under a human agent's name, automated outbound that mimics personal one-to-one messaging, and any synthetic voice or image presented as genuine. Lower-risk cases — a clearly-labelled "RichAutomate Assistant", an obvious automated order-status update, a templated notification — carry little deception risk because no one mistakes them for a human confidant. The table below maps common WhatsApp scenarios to whether disclosure is advisable and how to do it. These are illustrative judgement calls under an evolving framework, not legal determinations — verify against current rules and your own counsel.

Synthetic media: labelling AI voice, image and video

Marketing creatives are where the biggest exposure sits, because the IT Rules' synthetic-media provisions and ASCI's advertising guidance both push toward clear labelling of artificially generated or altered content — and consumer-protection law sits underneath against anything misleading (all evolving, verify as of 2026). The rule of thumb for WhatsApp creatives: if a reasonable viewer could mistake AI-generated media for a real photograph, a real recording of a real person, or an unaltered depiction of reality, label it. That means a visible "AI-generated" tag or watermark on synthetic images and video, and a spoken or written notice that a voice note uses an AI-generated voice. Be especially careful with anything that depicts a person — a synthetic spokesperson, a cloned founder voice, or an AI face — because that drifts toward the deepfake-endorsement territory regulators are most alert to. The table below maps content types to a sensible labelling approach.

Consent for AI processing — the DPDP intersection

Disclosure is about deception; the DPDP Act 2023 is about data. When your AI reads a customer's WhatsApp message to classify intent, draft a reply, or feed a retrieval system, you are processing personal data, and DPDP's core duties apply: a lawful basis (usually consent), purpose limitation (use the data only for the purpose you stated), data minimisation, and not silently repurposing chat content to train models without a proper basis. Two practical consequences. First, your opt-in and notice should make clear that conversations may be handled by automated systems and for what purpose — bolt this onto the consent you already collect for WhatsApp messaging. Second, if you send customer messages to a third-party LLM provider, that provider is your processor: confirm where data is processed, retention, deletion, and whether inputs are used for training, and get a DPDP-aware processor agreement. Transparency about the bot and lawful consent for the data are two separate obligations that happen to reinforce each other. For the messaging-consent foundation, see our DPDP Act 2023 WhatsApp compliance checklist (general information; verify current DPDP rules as of 2026).

The disclosure-pattern library (copy you can adapt)

Disclosure does not have to be clunky. A single warm line at the right moment does the job. Adapt these to your brand voice — they are starting points, not legal text:

Bot intro (first reply): "Hi! You're chatting with the RichAutomate Assistant, our automated helper. I can answer most questions instantly — and I'll bring in a human teammate whenever you need one."

Automated-reply notice (auto-send, no human review): "This is an automated reply. If you'd like to speak with a person, just type 'agent' and I'll connect you."

AI-voice notice (before/within a voice note): "Quick note — this voice message uses an AI-generated voice."

AI-image label (caption or on-image watermark): "AI-generated image — for illustration."

Human-handoff signal: "Connecting you to a member of our team now — a human will reply shortly. Thanks for your patience!"

The pattern: disclose once, early, and plainly, then make the handoff to a human obvious and easy. The table below contrasts compliant copy with risky copy so the line is clear.

High-risk pitfalls that attract trouble

Most enforcement risk clusters around a few avoidable mistakes. Human impersonation: giving a bot a fake human name and persona so customers think they are messaging a real agent — this is the single most common trap, and the easiest to fix with one intro line. Fake social proof: AI-generated testimonials, invented review counts, or synthetic "customer" photos, which run straight into consumer-protection rules on misleading practices and ASCI guidance. Deepfake endorsements: synthesising a celebrity, influencer, or even your own founder's face or voice to imply an endorsement that did not happen — high-risk under the IT Rules' synthetic-media lens and potentially defamatory or a personality-rights violation. Silent data repurposing: quietly feeding customer chats into model training or unrelated analytics without consent or purpose limitation, which breaches DPDP. Buried handoff: trapping frustrated users in a bot loop with no way to reach a person — not strictly illegal everywhere, but it manufactures exactly the complaints regulators notice. Each of these is avoidable with disclosure and honest design. (All framed against evolving rules — verify as of 2026.)

An AI-disclosure self-audit checklist

Run this against your live WhatsApp setup. Answer "yes" to all, or fix the gaps:

(1) Does your bot disclose it is automated on the first reply, with a non-human name? (2) When AI auto-sends without human review, is that signalled? (3) Is every AI-generated image, video and voice note clearly labelled? (4) Have you avoided any human-impersonation persona? (5) Are all testimonials and reviews real, consented, and unaltered? (6) Is there an obvious, working path to a human at any point? (7) Does your opt-in/notice cover automated handling of conversations? (8) Do you have a lawful, purpose-limited DPDP basis for AI-processing messages? (9) Is your LLM provider a contracted, DPDP-aware processor with known retention and training terms? (10) Do you have an internal owner who re-checks this as the rules evolve? Anything below 10/10 is a backlog item, not a debate.

A 30-day AI-disclosure compliance runbook

Days 1–7 — inventory. List every place AI touches a customer: bots, auto-replies, GenAI drafting, synthetic voice/image/video creatives, and any tool sending chats to an LLM. Note which are auto-sent vs human-reviewed. Days 8–14 — disclose. Add the bot intro line, the automated-reply notice, and the human-handoff signal from the pattern library; make the handoff genuinely work. Days 15–21 — label media. Apply visible "AI-generated" labels/watermarks to all synthetic creatives; remove or fix anything that impersonates a human or fabricates social proof. Days 22–27 — fix consent. Update your opt-in/notice to cover automated handling; confirm your LLM provider's processor terms, retention, and training stance; align with DPDP purpose limitation. Days 28–30 — review & assign. Run the self-audit checklist, fix gaps, and assign a named owner to re-check quarterly as MeitY/IT-Rules/ASCI/DPDP guidance evolves. Numbers and timelines here are illustrative — adapt to your scale. To get the AI layer itself right before you disclose it, see our WhatsApp GenAI agent build guide and the AI agent evaluation methodology.

This article is general information, not legal advice. India's AI-governance landscape — MeitY advisories and any proposed AI framework, the IT Rules' synthetic-media and intermediary obligations, the DPDP Act 2023, ASCI advertising guidance, and consumer-protection law — is evolving, and rule numbers, dates, scope and penalties change. Verify every specific against the current official sources as of 2026 and consult qualified counsel before relying on any point here.