Skip to main content
Waaru
WhatsApp Business API

WhatsApp opt-in rules: collect and record customer consent

Tanay PatelAI and full-stack engineerUpdated 14 September 2026
The short answer

Meta requires the recipient's phone number and permission for subsequent messages or calls. Explain what your business will send, preserve the choice, and honour requests to stop. Check applicable law separately; a platform-policy checklist does not establish legal compliance.

Before sending a campaign, check what each recipient agreed to receive and whether you can show the record. This guide covers opt-in methods, consent records, and handling opt-outs.

What does Meta's policy actually require?

Meta's current policy requires a phone number and opt-in permission for subsequent messages or calls. It also requires businesses to respect opt-out requests.

For your own form, name the business and describe the messages clearly. Explicitly mentioning WhatsApp helps customers understand where they will hear from you. Use separate choices when customers may want order updates but not promotional offers.

What should you check about India's DPDP rules?

Review the laws that apply to your business, customers, and intended use of their information. For India, check the current DPDP commencement notifications and rules before making a legal compliance claim.

Keep this review separate from Meta's platform requirements. Give the reviewer your proposed notice, permission wording, record fields, and withdrawal process. Do not assume one checkbox settles every legal obligation.

Which opt-in methods actually work?

  • Checkout checkbox, unticked by default: 'Send my order updates on WhatsApp to +91-XXXXX'. Offer a separate choice for promotional offers and record the selections.
  • Click-to-WhatsApp ads: explain any later messages you propose to send and ask the customer to choose whether to receive them.
  • Website widget or form with a dedicated WhatsApp consent line (never bundled into general T&Cs).
  • QR codes: show the business name and message purpose before asking the person to send 'START'. Preserve the notice and response; the keyword alone does not explain what was agreed.
  • IVR or SMS keyword for offline audiences; store the interaction log.
  • Inside WhatsApp: explain the updates offered, then provide a 'Yes, send me updates' choice and store the response.

What records should you keep?

Keep the agreed message purpose, source, timestamp, and available evidence, such as a form submission or message log. Record withdrawals with the same care.

In Waaru, preserve opt-in details with the contact. Explicit opt-out remains workspace-wide; do not use another campaign or connected number to bypass it. Check the contact's current restriction before sending again.

Why does unclear permission create sending risk?

People may block or report messages they did not expect. Review that feedback alongside template quality and sending limits. A purchased list does not tell you what each person agreed to receive.

Check the permission behind an audience before scheduling it, and investigate complaints before increasing volume. There is no fixed list size or number of days that predicts a restriction.

FAQ

Frequently asked questions.

Do I need opt-in to reply to a customer on WhatsApp?

You can send an eligible reply without a template within 24 hours of the customer's last message. Messaging policies still apply, and the conversation does not establish blanket permission for future promotions.

Is a pre-ticked checkbox valid WhatsApp opt-in?

Use an unticked choice with clear wording so the customer actively selects it. Keep it separate from general terms and review whether the wording meets the laws that apply to your use.

Can I message contacts from my existing customer database?

Only those whose consent covers WhatsApp messages from your business. A phone number collected for delivery is not consent for marketing. Run a re-permission campaign through a channel you do have consent for, and migrate only the yeses.

How do I handle opt-outs correctly?

Respect requests to stop, whether received on WhatsApp or elsewhere. Record the withdrawal and enforce it across campaigns. In Waaru, keep the explicit opt-out workspace-wide.

Does opt-in expire?

Review whether the recorded permission still covers the intended message and whether the person is likely to expect it. For an old or unclear record, confirm permission through an appropriate channel before adding the contact to a campaign.

Research notes

Evidence checked for this article.

  • Meta requires opt-in permission and respect for requests to stop messages; businesses remain responsible for applicable law.

    WhatsApp Business Messaging Policy · Accessed 14 September 2026

  • WhatsApp explains how people sign up to hear from a business and how to stop its messages.

    WhatsApp Help Center, opting in to business messages · Accessed 14 September 2026

  • Current marketing guidance distinguishes expected messages, permission, and quality; it notes that WhatsApp-specific opt-in is no longer required.

    WhatsApp Business, marketing message best practices · Accessed 14 September 2026

About the author

Tanay Patel

AI and full-stack engineer

Tanay builds production AI systems, agent workflows, and the full-stack software around them. His work focuses on reliable state, recovery, and human handoff.

Read Tanay's engineering notes

Put this into practice on your own number.

The platform is free. AI features are paid separately.