Meta's WhatsApp Commerce Policy and Business Messaging Policy prohibit selling or promoting a fixed list of products and services over WhatsApp, and breaking that list is the fastest way to get your catalog rejected or your number restricted. For Indian SMBs the highest-risk categories are alcohol, tobacco, drugs and prescription pharma, weapons and ammunition, real-money gaming and betting, adult products, loan and investment scams, MLM schemes, and counterfeit goods.
The frustrating part is that most restrictions do not come with a clear explanation. A catalog item silently disappears, a template gets rejected, or a phone number drops to a lower messaging tier with a red "Restricted" flag in Meta Business Manager. This guide breaks down exactly what the policies ban, the India-specific regulatory context that makes some categories worse than others, why numbers get flagged, and the concrete steps a compliant Indian business takes to stay live.
Two policies, one rulebook
WhatsApp enforces business behaviour through two documents that work together. The Commerce Policy governs anything you list in a catalog or sell through the platform — it is the product-level filter. The Business Messaging Policy governs how you message people — consent, opt-in, content, and frequency. A jewellery shop can have a perfectly clean catalog and still get restricted for blasting unsolicited marketing; a fintech can have flawless opt-ins and still get its catalog rejected for listing a prohibited loan product. You have to pass both.
Meta layers its own India obligations on top: the Digital Personal Data Protection Act 2023 (DPDP) sets the consent bar for handling customer data, and sector regulators like RBI, IRDAI, and state gaming laws decide whether your underlying business is even allowed to advertise the way you want to. WhatsApp does not replace those laws — it enforces them as a private gatekeeper, often more strictly than the regulator itself.
Prohibited product categories (the hard bans)
These categories are prohibited outright. Listing them in a catalog, or using WhatsApp to facilitate their sale, risks immediate catalog rejection and can escalate to a permanent account ban. The India column notes why the category is especially sensitive locally.
| Prohibited category | Why Meta bans it | India-specific note |
|---|---|---|
| Alcohol | Age-restricted and regulated globally | State-by-state excise rules; several states are dry — online promotion is legally grey |
| Tobacco & vaping | Health-harm products, banned from digital ads | E-cigarettes banned under the PECA Act 2019; even mentions draw scrutiny |
| Drugs & prescription pharma | Requires licensed dispensing, high abuse risk | Schedule-H / H1 drugs need a valid prescription; online sale is tightly controlled |
| Weapons, ammunition, explosives | Safety and legal liability | Arms Act licensing; no consumer sale channel is permitted on WhatsApp |
| Real-money gaming & betting | Gambling is restricted in most regions | Games of chance banned in many states; the line between skill and chance is litigated |
| Adult products & services | Sexual content and services prohibited | Obscenity provisions under the IT Act; near-zero tolerance in review |
| Counterfeit & replica goods | Intellectual-property infringement | "First copy" / replica listings are a common rejection trigger for Indian sellers |
| Live animals & endangered species | Welfare and trafficking risk | Wildlife Protection Act; pet-trade listings are frequently pulled |
Restricted categories — allowed only with conditions
Some businesses are not banned but sit in a "restricted" zone where a single sloppy message tips you into violation. These are the categories where Indian SMBs most often get flagged without realising they crossed a line.
- Financial services, loans and investments. You may offer a legitimate, licensed product, but you cannot promise guaranteed returns, run "instant loan, no documents" hooks, or imitate an RBI-regulated entity you are not. Fake loan and investment schemes are one of the most-reported abuse patterns on WhatsApp in India, so genuine fintechs get extra scrutiny by association.
- Insurance. IRDAI governs how insurance is marketed. Misleading claims, fake policy urgency, or unlicensed selling will get templates rejected and numbers flagged.
- Healthcare and supplements. Over-the-counter wellness is generally fine; disease-cure claims, prescription drugs, and unverified "miracle" supplements are not.
- Multi-level marketing (MLM) and "earn from home". Recruitment-driven income schemes are treated as high-risk and are a frequent ban trigger, especially when messages are sent in bulk to non-opted-in numbers.
- Digital subscriptions, tokens and in-game currency. Allowed, but adjacency to gambling or crypto speculation invites review.
Why catalogs get rejected
Catalog rejection is usually not about the product alone — it is about how the listing is written. Meta's automated review reads titles, descriptions, images, and prices. Common Indian rejection triggers include: a prohibited keyword buried in a description ("replica", "first copy", "casino", "loan without CIBIL"), images that show a banned product even if the title is clean, prices of ₹0 or clearly fake amounts used as a workaround, and links that redirect to a non-compliant checkout. If your catalog keeps bouncing, audit the exact wording before you appeal — the same principles apply to message templates, which we cover in our guide on WhatsApp template rejection reasons and fixes.
Why numbers get restricted or flagged
Product policy is only half the story. Most Indian SMB pain comes from messaging behaviour that damages the number's standing. WhatsApp scores every business number on a quality rating driven largely by how recipients react. Too many blocks and "report" taps, and the number is throttled or restricted regardless of what you sell.
Get the DPDP WhatsApp checklist
A founder-led WhatsApp reply with the DPDP consent + audit-log checklist for WhatsApp Business messaging. India-hosted. No spam.
| Restriction type | Common trigger | Remedy |
|---|---|---|
| Low quality rating (yellow/red) | High block & report rate from recipients | Pause marketing, message only opted-in users, let the rating recover over days |
| Messaging limit tier drop | Poor quality + low engagement | Rebuild sender reputation; tiers rise again with clean sending |
| Template rejection / pause | Promotional content, policy keywords, formatting issues | Rewrite to policy, resubmit; fix root cause not just wording |
| Number restricted / disabled | Repeat violations, prohibited products, spam reports | Appeal in Business Manager with corrective evidence |
| Business account flagged | Impersonation, scam pattern, unverified identity | Complete Business Verification; remove violating assets |
The single biggest self-inflicted wound is sending unsolicited bulk messages to people who never opted in. Under DPDP 2023, processing personal data — including a phone number for marketing — needs a clear, informed, freely given consent. WhatsApp's own opt-in rules are stricter still. Buying a contact list and blasting it is both a legal risk and a fast route to blocks and reports. It also collides with India's telecom rules; we cover how those interact in how TRAI DND rules apply to WhatsApp.
Quality rating fallout — the slow-motion ban
Restrictions rarely arrive as a single dramatic event. What usually happens is a slow decline: a business starts strong, gets greedy with marketing frequency, block rates creep up, the quality rating turns yellow, then red, the daily messaging limit drops, deliverability suffers, and eventually the number is restricted. By the time the owner notices, weeks of reputation damage have accumulated. The fix is prevention: treat every send as something the recipient genuinely wants, keep marketing frequency sane, and always give a clear opt-out. A recovered rating is possible, but it costs days of restraint you would rather not spend.
Consent the DPDP way — the opt-in that actually protects you
India's Digital Personal Data Protection Act 2023 reframed consent from a nice-to-have into a legal duty, and WhatsApp marketing sits squarely inside it. A phone number is personal data, and using it to send promotional messages is "processing" that data. DPDP requires that consent be free, specific, informed, unconditional, and unambiguous — a pre-ticked box or a number scraped from a directory does not qualify. Practically, that means the moment of opt-in must be one the customer would recognise: they typed their number into your form, ticked a box that said what they were agreeing to, or messaged you first. Keep a timestamped record of it. If a recipient complains and Meta reviews the account, being able to show a clean consent trail is often the difference between a warning and a restriction.
There is a second reason opt-in matters beyond the law: people who asked to hear from you almost never block or report you. Consent is not just a compliance checkbox — it is the single strongest lever you have over your quality rating. Every message to a stranger is a small bet against your own sender reputation.
Appealing a restriction without making it worse
If a number or catalog is restricted, resist the urge to spin up a fresh number and carry on — Meta links business assets, and evading a restriction can escalate it to a permanent ban across your whole business account. Instead, work the appeal. In Meta Business Manager, review the specific violation cited, remove or rewrite the offending catalog items or templates, and submit the appeal with a short, factual explanation of what you corrected. Do not re-submit the same content hoping for a different reviewer. If the restriction was quality-driven rather than a policy violation, there may be nothing to appeal — the remedy is time and clean sending, letting the rating climb back on its own. Document what triggered the restriction so the same mistake does not repeat, because a second offence is treated far more harshly than a first.
How a compliant Indian SMB stays live
Staying compliant is mostly a set of habits, not a one-time setup. No provider — including us — can promise your account will never be restricted, because the final decision is always Meta's. What a clean setup does is materially reduce the risk and give you a fast path to recover if something slips. The checklist:
- Sell only what the policy allows. If your core product is on the prohibited list, WhatsApp is not a viable channel — no workaround survives review for long.
- Get real opt-in. Collect consent at the point of contact — a website form, a checkout checkbox, an in-store QR — and keep a record of when and how each person opted in. This is both a WhatsApp rule and a DPDP obligation.
- Separate utility from marketing. Order updates, OTPs, and support replies are welcomed and rarely trigger blocks. Reserve promotional blasts for people who explicitly asked for them, and keep frequency low.
- Write templates to the policy. Avoid banned keywords, exaggerated claims, and fake urgency. Get the wording right before submission.
- Honour opt-outs instantly. One "STOP" should end all marketing to that number, permanently.
- Complete Business Verification. A verified, transparent business identity is treated far more leniently in review than an anonymous number.
- Watch your quality rating. Check it regularly and pull back the moment it dips — do not wait for red.
Where RichAutomate fits
RichAutomate is a WhatsApp Business API platform built for Indian SMBs, and compliance guardrails are baked into how it works rather than bolted on. Opt-in tracking, template management aligned to Meta's review rules, per-message consent handling, and quality-rating visibility all live in one dashboard, so you are less likely to trip a violation by accident. See the full toolset on our features page. Pricing is usage-only — ₹0 setup, ₹0 monthly, and you pay per message: ₹0.10 on Client-Pay, or ₹1.20 marketing / ₹0.30 utility on SaaS-Pay. Full breakdown on the pricing page.
To be clear about what a platform can and cannot do: RichAutomate helps you build a compliant, well-structured setup that reduces the risk of restriction and speeds up recovery — it does not and cannot guarantee that Meta will never restrict an account, because that authority rests entirely with Meta. Sell allowed products, message people who opted in, keep your quality rating healthy, and you give your number the best possible chance of staying live for the long run.
Ready to run WhatsApp the compliant way? Create your free RichAutomate account and set up opt-in tracking, policy-safe templates, and quality monitoring from day one.