Selling on Instagram and WhatsApp: legal requirements in India

Selling on Instagram or WhatsApp does not put you outside the law. GST, labelling, food licences and consumer law apply exactly as they do on a marketplace, and from 13 May 2027 the main duties under the Digital Personal Data Protection Act, 2023 will apply to the customer data in your chats and spreadsheets. The difference is that no platform checks you, so the discipline has to come from you.

GST: where Instagram sellers go wrong

The most common belief is that a cash-and-UPI Instagram business is invisible to GST. It is not. Three rules matter.

1. Your aggregate turnover for section 22 purposes includes every channel. If you also sell on a marketplace, add it all up. The basic limit for goods is ₹40 lakh in most states and ₹20 lakh for services, with lower limits in some states, so check your state.
2. Section 24(i) makes registration compulsory for inter-state supply of goods, whatever your turnover. One parcel to a buyer in another state is enough.
3. The enrolment-number exemption in Notification 34/2023-Central Tax applies to supplies made through a marketplace that collects tax at source. It is not a general route for direct Instagram sales, so a seller who ships across states needs a GSTIN.

A seller selling only inside her own state, below the threshold, and taking payments directly may not need registration yet. She must watch the limit and register within 30 days of becoming liable (section 25). Whether registered or not, send an invoice or a bill for every sale showing name, address, product, price and date. It is your proof of the contract if a dispute arises.

For income tax, the absence of a marketplace deduction does not reduce your liability. Your bank receipts and UPI records are income. A gap between what you report and what the Annual Information Statement shows from other sources invites a notice, so keep your own sales register.

Consumer law for a shop with no website

An Instagram shop looks informal, but the buyer is a consumer under the Consumer Protection Act, 2019, and you are a seller. Treat the following as minimum content on your profile and in your order confirmation:

• Your legal name (or business name) and address, a working phone and email, and your GSTIN if registered.
• Total price with delivery and other charges stated before the buyer pays. Hidden charges that appear at the last step are a dark pattern.
• Your return, refund, exchange and delivery terms, in plain words.
• The name and contact of the person who handles complaints, with acknowledgement in 48 hours and a resolution within one month as your own standard.

You may refuse change-of-mind returns if you say so before purchase. You cannot refuse a refund for a defective, wrong or spurious item. Section 2(47) of the Consumer Protection Act treats refusal to refund within the period stated in the bill, or within 30 days if none is stated, as an unfair trade practice. A buyer can file on e-Jagriti, and a screenshot of your “no returns” story will not protect you.

Advertising, influencers and reviews

Your posts, reels and WhatsApp broadcasts are advertisements. Rules to follow:

• Only claims you can prove. Keep lab reports or certificates for statements such as “organic”, “dermatologist tested” or “BIS certified”. Avoid cure claims for food, cosmetics and ayurvedic products.
• Label paid and gifted content. The CCPA Guidelines for Prevention of Misleading Advertisements and Endorsements for Misleading Advertisements, 2022 require clear disclosure of a material connection, and ASCI guidance expects a visible label such as “Ad”, “Collaboration” or “Sponsored” at the start of the post, not buried in hashtags.
• No fake testimonials. Reviews written by you, staff or friends posing as buyers are an unfair trade practice. Publishing only positive screenshots is risky if you edit or hide others.
• Avoid dark patterns. The CCPA Dark Patterns Guidelines, 2023 (notified 30 November 2023) name 13 practices, including false urgency (“only 2 left” on everything), drip pricing, disguised advertisements and confirm shaming. A DM-based sale can use them as easily as a website.

Packaging, food and product licences

If you pack goods in advance, your package needs the Legal Metrology declarations and, for food, the FSSAI number and food labelling details. A home baker or pickle maker needs FSSAI registration even if every sale is on Instagram. Display the FSSAI number on your profile and labels. Cosmetics, ayurvedic products and BIS-regulated goods need their own licences before you sell. A photo of the label in your post is good practice, since buyers cannot handle the product first.

DPDP Act: your chats and spreadsheets are personal data

The DPDP Rules, 2025 were notified on 13 November 2025. The main business duties apply from 13 May 2027, and there is no exemption based on the size of your business. For an Instagram or WhatsApp seller you are a Data Fiduciary, because you decide why and how customer data is used. Steps worth taking now:

• Use customer names, phones and addresses only to fulfil and support the order. That is a legitimate use.
• Ask for clear, affirmative consent before adding a buyer to a promotional broadcast list. Do not use delivery addresses to build a marketing list or share a customer list with another seller.
• Restrict who can see order data. A shared spreadsheet open to every part-time helper is a risk. Use two-factor login on Instagram, WhatsApp Business and courier accounts.
• Do not collect children’s data casually. Anyone under 18 is a child under the Act, and processing needs verifiable parental consent.
• Publish a short privacy notice with a contact email, and delete data once the purpose is over and no law requires you to keep it. Tax records must still be retained.

Penalties are imposed by the Data Protection Board after an inquiry, with maximums of ₹250 crore for failure of reasonable security safeguards. The privacy policy guide on this site shows how to write the notice.

Payment safety and impersonation

Take payment through a regulated gateway or UPI to your business account. Never ask a customer to share an OTP, card number or PIN in chat, and never accept a “payment screenshot” as proof without checking your bank. If a fake page copies your name and photos, report it to the platform, which must acknowledge a complaint within 24 hours and resolve it within 15 days under the IT Rules, 2021. Where money is lost to fraud, call 1930 and report on cybercrime.gov.in quickly.

Example. Nisha sells baby clothes on Instagram in Bhopal. She kept every buyer’s name, phone, address and child’s age in a spreadsheet shared with two helpers and added buyers to a broadcast list unasked. Before May 2027 she moves orders to an app with role-based access, sends a one-time message asking who wants offers, stops recording children’s ages and publishes a privacy notice.

Full course: Legal Compliance for Online Sellers, ₹399. It is a certificate of completion from Lexfolio, not a professional qualification.

Frequently asked questions

Do I need a business licence to sell on Instagram?

There is no single “Instagram licence”. What you need depends on the product and your location: GST where required, FSSAI for food, BIS or other approvals for regulated goods, and any local trade or shop registration your municipality or state requires. Check the last one with your local authority.

Can I refuse returns on Instagram orders?

You can refuse change-of-mind returns if you say so before purchase. You must refund defective, wrong or spurious goods.

Is a WhatsApp broadcast to old customers allowed?

Marketing messages need clear, affirmative consent once the DPDP duties apply from 13 May 2027. Ask buyers to opt in now, and remove those who do not.

Do I have to label an influencer’s post about my product?

Yes, if you paid, gifted a product or gave commission. Disclosure must be clear and prominent.

What if I sell only to friends and family?

Occasional private gifts are different from a business. Once you sell regularly to the public for profit, the business rules apply.

Quick quiz

Sources

• Central Goods and Services Tax Act, 2017: sections 22, 24 and 25
• Notification 34/2023-Central Tax
• Consumer Protection Act, 2019: section 2(47) and e-Jagriti procedure
• Guidelines for Prevention and Regulation of Dark Patterns, 2023 (CCPA, 30 November 2023)
• Guidelines for Prevention of Misleading Advertisements and Endorsements for Misleading Advertisements, 2022 (CCPA)
• Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025
• Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021
• Food Safety and Standards Act, 2006

This page is for education and general information, not legal advice for a specific case. Law as on 7 November 2026.