Before sending any business-initiated WhatsApp message, Meta's policy requires opt-in: the person must have agreed to receive messages from your business on WhatsApp specifically, with clear notice of what they will receive. India's DPDP Act adds statutory weight — consent must be free, specific, informed, and withdrawable, and you must be able to prove it. Practically: collect opt-in at real touchpoints (checkout, forms, ads that click to WhatsApp, QR codes), record what was agreed and when, and honour STOP instantly.
Opt-in is where WhatsApp programs quietly go wrong. Get it right and deliverability, quality rating, and legal posture all take care of themselves; get it lazy and you are one campaign away from a rate-limited number and a DPDP complaint. Here are the actual rules and the mechanics that satisfy them.
What does Meta's policy actually require?
Meta's Business Messaging Policy requires that businesses obtain opt-in before sending proactive (business-initiated) messages. The consent must cover receiving messages from your business, over WhatsApp, and you must name the business clearly at the point of consent. Replying to a customer inside the 24-hour service window they opened is not restricted by this — opt-in governs messages you initiate.
Two details people miss: opt-in is per-business (a group company cannot inherit it), and Meta expects you to honour opt-outs immediately and maintain the ability to demonstrate consent if audited or reported.
How does India's DPDP Act raise the bar?
The Digital Personal Data Protection Act 2023 makes consent a statutory matter, not just platform policy. For WhatsApp messaging, the practical requirements: consent must be free, specific, informed, unconditional, and unambiguous — a pre-ticked box or bundled 'I agree to everything' fails all five. You must state the purpose (what kinds of messages), make withdrawal as easy as giving consent, and keep records. Fines for violations run to hundreds of crores, and marketing messaging is the most visible, most reported category of processing there is.
The good news: one well-designed opt-in flow satisfies both Meta and DPDP simultaneously.
Which opt-in methods actually work?
Checkout checkbox (unticked by default): 'Send my order updates and offers on WhatsApp to +91-XXXXX' — specific, informed, recorded against the order.
Click-to-WhatsApp ads: the person initiates the conversation — capture explicit opt-in for future proactive messages inside the first exchange.
Website widget or form with a dedicated WhatsApp consent line (never bundled into general T&Cs).
QR codes in-store or on packaging that open a pre-filled 'START' message — the reply is your timestamped opt-in.
IVR or SMS keyword for offline audiences; store the interaction log.
Inside WhatsApp itself: for existing conversations, a one-tap 'Yes, send me updates' button message — the cleanest consent record there is.
What records should you keep?
For every contact: what they consented to (message categories), where (source touchpoint), when (timestamp), and the evidence (form submission, message log, order record). Store the opt-out equally carefully — 'STOP' must suppress proactive messages immediately and permanently until re-consent.
On Waaru, opt-in source and timestamp are contact attributes, opt-out keywords suppress automatically, and the records export cleanly — which is exactly what you want to be holding if a DPDP question ever arrives.
How does sloppy opt-in actually hurt you?
Mechanically, through the quality rating. Recipients who never really agreed tap 'Block' and 'Report'; Meta's quality signals drop; your messaging limits shrink; eventually templates get paused or the number restricted. The feedback loop is fast — one badly-sourced broadcast to 10,000 'leads' can throttle a number within days.
This is why bought databases are not a shortcut but a self-destruct button: every downstream metric — deliverability, quality, legal exposure — is a function of consent quality. Slow list, fast growth.
FAQ
Questions worth answering.
No. When a customer messages you, a 24-hour service window opens and you can reply freely — that is customer-initiated. Opt-in governs business-initiated messages: broadcasts, reminders, and any template sent outside an open window.
Research notes
Evidence checked for this article.
Meta's Business Messaging Policy requires opt-in for business-initiated messages, clear identification of the business, and prompt honouring of opt-outs.
Meta — WhatsApp Business Messaging Policy · Accessed 4 July 2026
The Digital Personal Data Protection Act 2023 requires consent that is free, specific, informed, unconditional and unambiguous, with easy withdrawal, for processing personal data in India.
