WhatsApp opt-in: what counts, what does not, and why it protects you

Valid WhatsApp opt-in means the person agreed, on that number, to receive messages from your business by name — and you can show when and how they agreed. A tick box buried in terms and conditions is not opt-in. A phone number given for a delivery is not opt-in for marketing. And a list bought from anyone is not opt-in at all.

This matters less as a compliance question than as a survival one. Poor opt-in produces blocks, blocks lower your quality rating, and a restricted number cannot reach the customers you already have.

What actually counts as opt-in?

Four conditions, and all four have to hold.

• It was a deliberate action. Ticking a box, sending a message, replying with a keyword. Not a pre-ticked box, not consent inferred from a purchase.
• It named WhatsApp. Agreeing to “receive updates” is not agreeing to be messaged on WhatsApp specifically.
• It named your business. The recipient must know who will be messaging. Consent given to a marketplace does not transfer to a seller on it.
• It applies to that number. Consent for one number is not consent for another they also own.

And a fifth, practical requirement: you must be able to evidence it. When Meta assesses a complaint, “we believe they agreed” is not a position you can hold.

What does not count, however common it is?

Practice	Why it fails
Purchased or rented lists	No relationship exists. This is the fastest route to a restricted number.
Numbers collected for delivery or billing	Given for a transaction, not for marketing.
Consent buried in terms and conditions	Not a deliberate, specific action.
Pre-ticked boxes	The absence of a refusal is not agreement.
Business cards collected at an exhibition	An exchange of details, not consent to be messaged.
Numbers scraped from directories or groups	No relationship, and it will be reported as spam.
Consent given to a different company in your group	Consent does not transfer between entities.

The exhibition one surprises people, because collecting cards at a trade show feels like an invitation. It is an invitation to be contacted — usually by phone or email — not consent to be added to a broadcast list. If you want to message those contacts on WhatsApp, ask at the stand and record that you asked.

How should you collect it?

At the point of a transaction. A checkout or enquiry form with an unticked box: “Send me order updates and offers on WhatsApp.” Specific, deliberate, timestamped.

By having them message you first. The strongest form there is. A customer who messages your number has demonstrated intent unambiguously — which is why click-to-WhatsApp advertising and QR codes on packaging work well.

By keyword confirmation. Ask them to reply with a word to confirm. Slightly more friction, considerably stronger evidence.

In person, recorded. A dealer or showroom asking directly is fine — provided somebody records that it was asked, when, and by whom. Verbal consent nobody wrote down is consent you cannot prove.

What should you record?

Five fields, against every contact. If your system does not hold them, it is not ready to run WhatsApp at scale.

• The number that consented
• Date and time
• Method — checkout box, keyword reply, in person
• Exact wording they agreed to
• Scope — transactional only, or marketing as well

That last field prevents the most common failure: someone consents to order updates and receives a promotion. From their side that is spam, and they respond accordingly.

How do you handle opting out?

Make it easy, and act on it immediately.

Every marketing message should carry a way to stop. Honour it the same day — a single message sent after someone asked you to stop will be reported, and a report costs more than the entire campaign earned.

Keep a suppression list of numbers that have opted out and check every send against it. And watch for people who opt out of marketing but still want transactional messages; treating those as one setting means losing the ability to tell someone their order has shipped.

Where does responsibility sit?

With whoever collected the consent.

Where we operate WhatsApp messaging on behalf of a client, obtaining valid opt-in from their customers is the client’s responsibility, and we act on their instructions. That is not a technicality — the consequences of a bad list land on the account sending the messages, and the business that assembled the list is the one that knows how it was assembled.

If you are being offered a WhatsApp service by anyone who does not raise the question of where your list came from, that is worth noticing.

This article describes platform requirements and good practice. It is not legal advice — data protection obligations for your business depend on your jurisdiction and circumstances.

Common questions

Does opt-in expire?

Not formally, but practically it decays. Someone who consented three years ago and has heard nothing since will not remember and is likely to block. If a list has gone cold, re-permission it rather than resuming.

Can I message someone who messaged me first?

You can reply within the 24-hour window they opened. That is not the same as consent to receive marketing later, which needs to be asked for separately.

Our dealers collect numbers for us. Is that opt-in?

Only if the customer was told your business would message them on WhatsApp, and it was recorded. A dealer collecting numbers for their own use has not obtained consent on your behalf. This is a common gap in dealer networks and worth auditing before a first campaign.

What happens if we get this wrong?

Blocks and reports lower your quality rating, which reduces how many customers you may message daily. Persistent problems can restrict the number. The cost is not a fine — it is losing your access to customers who genuinely do want to hear from you.

Do we need separate consent for each type of message?

Best practice is to record scope rather than collect separately — one action, but a clear record of whether it covered transactional messages only or marketing too. That single field prevents most complaints.

More on this: what lowers your quality rating and Business App vs API. For how we build on the platform, see WhatsApp Business API.