WhatsApp Opt-In: How to Collect Consent Properly
Why opt-in decides everything
Opt-in is where WhatsApp marketing succeeds or fails. People who expect your messages read them and reply. People who do not expect them block and report you, and Meta uses that feedback. Its Business Messaging Policy says users can block or report businesses and that Meta may limit how many messages you can send based on it. Meta's opt-in page adds that WhatsApp will rate limit businesses if quality stays low for a sustained period. A weak opt-in process is therefore a technical risk, because it lowers the quality signals that decide your messaging limits, as well as a legal one.
What counts as valid opt-in
Meta's developer documentation says a business may contact a person once it has their mobile number and has received permission confirming that they wish to receive subsequent messages from that business. The opt-in can be general and not specific to WhatsApp, as long as the business complies with all local laws. The method is up to you: if it meets the requirements, Meta says it will be policy compliant. Three elements are required.
- The business must clearly state that the person is opting in to receive communication from the business.
- The business must clearly state the business name the person is opting in to receive messages from.
- The business must comply with applicable law.
The third point deserves emphasis. Meta's rule is a floor. Data protection and anti-spam laws differ by country, and some require more than Meta does, for example specific consent wording or a way to prove when consent was given. Check the rules in the markets where your customers live.
Collection methods Meta lists
| Method | How it works | Watch out for |
|---|---|---|
| Website | A form or checkbox where the person enters a mobile number and agrees | Do not pre-tick the box; name the business next to it |
| SMS | A text asking the person to confirm they want WhatsApp messages | The first text must also state who you are and what they will receive |
| Phone (IVR flow) | The person agrees through an interactive voice menu | Keep a record of the call outcome |
| In person or on paper | The customer signs a physical document | Store the form and type the number in correctly |
The page we checked lists these four. It does not mention other channels such as QR codes or click-to-WhatsApp ads, so do not assume Meta has approved them as opt-in on that page. A person who starts a chat with you has opened the 24-hour customer service window, which lets you reply, but Meta's opt-in page treats permission to send later messages as a separate question. Ask for it clearly in the conversation if you want to send templates afterwards.
How to word the consent
Good consent wording is short and specific. It says who you are, what you will send, and how to stop. For example: "Yes, send me order updates and offers from Glow Studio on WhatsApp. Reply STOP any time." The value statement matters because Meta's best practices say to explain the benefit people get from the messages. Avoid vague text such as "I agree to the terms", which hides the WhatsApp opt-in inside a long document and makes consent hard to defend.
Opt-in by message category
Meta's best practices recommend a separate opt-in for each message category, and to cover the full range of message types you plan to send, such as order updates or product recommendations. This lines up with the template categories. A customer who agreed to delivery updates has not agreed to promotions. A practical way to handle this is two checkboxes: one for order and service messages, one for offers and news. Store each answer on the contact record and use it to filter every send.
Handling opt-outs
Meta's guidance is to provide clear instructions on how people can opt out of specific categories of messages, and to honour those requests. The Business Messaging Policy goes further and requires you to honour requests to stop communications, including removing the person from your contacts. Put the instruction in the first template ("Reply STOP to unsubscribe"), and make sure your team recognises stop requests in free-form chat as well, such as "please don't message me" or "unsubscribe". Treat the same day as the target for removal.
Keeping records
The Meta opt-in page does not cover record keeping, but your local law and your own risk management will. For each contact, keep the number, the date and time, the method, the exact wording shown, the business name shown, and the categories agreed. If a customer asks "how did you get my number?", you can answer in one minute. If Meta or a regulator asks, you have evidence.
When the customer messages you first
A person who sends you a message opens the 24-hour customer service window, and inside it you can answer freely, including with automation, as long as you offer a clear route to a human. That window is not the same thing as permission to send promotions later. When the conversation is going well, ask for the opt-in in plain words: "Would you like order updates and offers from us on WhatsApp? Reply YES." Store the answer with the date. This turns a one-off enquiry into a contact you can legitimately reach with approved templates after the window closes, and it keeps the record clean if the customer ever asks how you came to have their number.
Common mistakes
| Mistake | Why it is a problem |
|---|---|
| Buying or scraping a number list | No opt-in; high block rate; breaches the policy requirement to have permission |
| Using numbers collected for another purpose | Consent was for something else, so the opt-in does not cover marketing |
| Burying consent in terms and conditions | Meta requires the person be clearly told they are opting in, with the business name |
| One opt-in for everything | Meta recommends separate opt-in by category to reduce blocks |
| Ignoring stop requests | The policy requires honouring them; complaints lower quality and sending limits |
| Skipping local law | Meta's rule is a minimum, not a legal defence |
A short checklist
- The consent text says the person is opting in and names your business.
- The box is not pre-ticked and the number is entered by the person.
- Service messages and marketing are separate choices.
- Your first message says how to stop.
- Stop requests are removed the same day, in every channel.
- Each contact has a record of when, how and what they agreed to.
- You have checked local data protection and anti-spam rules.
Collect opt-in and send to the right people
ChatDaddy helps you keep contacts organised by what they agreed to receive, send approved templates to opted-in people only, and handle stop requests in one inbox. Talk to us about your sign-up flow.
Book a demoFrequently asked questions
Do I need opt-in to message people on WhatsApp?
Yes. Meta's documentation says businesses must obtain opt-in before messaging people on WhatsApp, confirming that they wish to receive subsequent messages from that business.
What must the opt-in say?
Meta requires the business to clearly state that the person is opting in to receive communication, and to clearly state the business name the person is opting in to receive messages from. It must also comply with applicable law.
Can the opt-in be collected outside WhatsApp?
Yes. Meta says the opt-in can be general and not specific to WhatsApp. The methods it lists include SMS, a website, a phone IVR flow, and a signed paper document.
Should I ask for separate consent for different message types?
Meta's best practices recommend a separate opt-in for each message category, which reduces the chance people block you. Cover the types you plan to send, such as order updates or product recommendations.
How do I handle people who want to stop?
Give clear instructions on how to opt out and honour requests. Meta's Business Messaging Policy requires honouring requests to stop communications, including removing the person from your contacts.
Sources
- Meta for Developers: Getting opt-in
- WhatsApp Business Messaging Policy
- Meta for Developers: WhatsApp template categories and guidelines
- Meta for Developers: WhatsApp messaging limits