Most Indian D2C stores on Shopify run WhatsApp recovery messages through a business solution provider, usually alongside order updates and shipping alerts. The flow feels seamless from the merchant side: one phone number, one integration, several kinds of messages going out through it. From a DPDP Act perspective, it is not one thing. It is at least two separate purposes wearing the same phone number.
Two purposes, one number
When a shopper gives you their phone number at checkout, the obvious reason is so you can ship the order and tell them when it has shipped. That is a transactional purpose tied directly to the sale they just made. Almost nobody disputes that this is a reasonable use of the number.
Abandoned-cart recovery is a different purpose. It fires when a shopper has not completed a purchase, and its goal is to bring them back and convert them, which is a marketing function, not an order-fulfilment one. The data flows through the same BSP integration and lands on the same phone, but the reason you are messaging them is not "we need to tell you about your order", because there is no order yet. It is "we would like you to finish this purchase."
The DPDP Act's approach to processing personal data is purpose-based: the basis you had for collecting data does not automatically cover every later use of it. A notified purpose that covers "communicating about orders you've placed" does not, on its own, also cover "messaging you about a cart you abandoned." These are different processing activities, and the Act's expectation is that each one is disclosed on its own terms, not folded silently into the other.
Why this gets missed
It gets missed because the engineering reality and the legal reality point in different directions. Technically, there is one BSP connection, one template library, one phone number field in your customer record. Under the Act, there are multiple purposes running through that single pipe, and each purpose is what needs to be named to the shopper, not the pipe itself.
This is not unique to WhatsApp. The same gap shows up with email: an ESP like Klaviyo that sends both order confirmations and marketing campaigns off the same contact record is running two purposes through one tool. WhatsApp recovery messages are simply the most common place Indian D2C stores encounter it first, because cart recovery is one of the highest-converting flows most stores run.
What this means in practice
It does not mean abandoned-cart messaging is prohibited, and it does not mean you need a separate opt-in flow for every template you send. It means your privacy notice needs to actually say that cart-recovery messages are something your BSP sends, as a distinct purpose from order updates, so a shopper reading it understands the full picture of what their number is used for, not just the part that is obviously necessary to receive their order.
The practical fix starts with an honest list: which processor sends what, for which purpose, built from your actual Shopify app stack rather than from memory. A hypothetical example: a store running Klaviyo for email and a BSP for WhatsApp typically has at least four live purposes behind two tools, order confirmations, shipping updates, cart recovery, and marketing campaigns, and a notice that only mentions "we use your contact details to process your order" is missing three of them.
Consent Jet's processor scan is built to surface exactly this kind of gap: it finds the tools your store actually sends shopper data to, including a BSP used for cart recovery, and builds your privacy notice around the purposes it finds rather than the one purpose everyone remembers to write down.