Skip to content
Compliance 4 min read

WhatsApp opt-in: what counts, how to collect it, and why it decides everything

Opt-in is not a legal formality — it is what keeps your number's quality rating alive. What Meta requires, what counts as valid, and where to collect it.

Opt-in requirements are set by Meta's Business Messaging Policy and may sit alongside local data protection law. Accurate as of September 2026. Check Meta's current documentation.

Compliance

Meta requires that you obtain opt-in before sending someone a business-initiated message on WhatsApp. Most businesses treat this as a compliance checkbox, get a vague consent line onto a form, and move on.

That is the wrong frame. Opt-in is not primarily a legal exercise — it is the mechanism that keeps your number alive. Every message to someone who does not remember agreeing is a candidate block, and blocks are what drive your quality rating down and your messaging limit with it.

What Meta actually requires

The requirements are less prescriptive than people expect, and more demanding in one specific way. You must:

  • Obtain opt-in before sending business-initiated messages, through any channel — it does not have to be collected on WhatsApp itself.
  • Make clear that the person is opting in to receive messages from your business on WhatsApp. Both parts matter: your business by name, and WhatsApp by name.
  • Make clear what kind of messages they will get — order updates are not the same permission as weekly offers.
  • Keep a record of when and how it was given.

Meta does not mandate a particular form of words or a particular channel. It does expect that if a complaint arrives, you can show what the person agreed to.

What counts, and what does not

Counts:

  • A checkbox on your checkout or enquiry form, unticked by default, naming your business and WhatsApp.
  • Someone messaging you first and being told what they will now receive.
  • A missed-call or IVR opt-in flow where the terms are stated.
  • A written or verbal opt-in taken in person and recorded, at a counter or a desk.
  • A QR code or click-to-WhatsApp ad where the landing message states what they are signing up for.

Does not count:

  • A number in your CRM because they bought something once.
  • A list you bought, scraped, or inherited from an agency.
  • Consent for SMS or email, reused for WhatsApp. Different channel, different permission.
  • A pre-ticked box.
  • “They can always opt out” as a substitute for opting in.

The bought-list case deserves a sentence on its own: it is the fastest reliable way to destroy a WhatsApp number. The recipients did not ask for you, a large fraction will block on the first message, and a new number’s quality rating has no buffer to absorb that.

Where to actually collect it

The best opt-ins are collected at a moment when the person wants something from you:

  • At checkout — “Get delivery updates on WhatsApp” converts extremely well, because it is useful rather than promotional.
  • On the enquiry form — they are already expecting a reply.
  • In the chat itself — someone who messaged you first is your warmest possible consent, and the moment right after you have solved their problem is the moment to ask about updates.
  • At the counter — a QR code that opens a WhatsApp chat with a pre-filled message is itself an opt-in signal, provided the reply states what they are in for.
  • On a booking confirmation — reminders are a benefit; say so.

Note what these have in common: the opt-in is attached to a benefit the person gets, not to a marketing permission they grant. That is also why they do not block you three weeks later.

Separate the permissions

One consent for everything is the setup that generates “I didn’t sign up for this” feedback. Somebody who agreed to delivery updates and is now getting Diwali offers is, from their point of view, correct to be annoyed.

Keep them apart as separate fields or tags on the contact:

  • Transactional — orders, bookings, appointments, alerts.
  • Marketing — offers, launches, newsletters.

Then segment your sends against them. It costs one extra field and saves the number.

Opt-out is the other half

An opt-in you cannot reverse cleanly is worth very little:

  • Honour STOP, and the common local-language equivalents, immediately.
  • Make it permanent — never re-add someone to a marketing segment because they placed a new order.
  • Let it be partial where it makes sense — stopping offers should not stop the delivery notification for something they paid for.
  • Make it visible — an opt-out line in your marketing templates reduces blocks, because blocking is what people do when they cannot find the exit.

An opt-out costs you one contact. A block costs you a fraction of your quality rating, and enough of them cost you your tier.

How this lives in the product

In Watx, opt-in and opt-out are enforced by the product rather than trusted to a process: opt-outs are honoured at send time, suppression lists keep the wrong people out of a broadcast, forms and the chat widget can write the consent field at the moment it is given, and the contact record carries when and where it came from.

See how contacts and segments work · How broadcasts protect your number

Run all of this on one number.

Shared inbox, template tracking, opt-outs enforced at send time and AI agents — on the official Meta WhatsApp Business Cloud API.

Start free trial