WhatsApp Opt-In Best Practices: Build a Trustworthy Consent Process

Make the choice specific and understandable

WhatsApp’s Business Messaging Policy says businesses may contact people on WhatsApp only when they have the person’s mobile number or username and opt-in permission confirming they want subsequent messages or calls. The policy also places responsibility on the business to comply with applicable laws and respect requests to stop communications.

At the point of collection, state the business name and the message purpose in plain language. Do not hide WhatsApp messaging in broad terms or imply that a person must agree to marketing to receive a product or service unless that is genuinely required and lawful.

Keep a useful consent record

Record the phone number, date and time, source, wording or form version, and the scope of the permission. Store only what the team needs to demonstrate and honor the choice. Restrict access and set retention practices consistent with applicable privacy requirements.

A number in a spreadsheet, a past purchase or a customer support conversation is not automatically proof of permission for unrelated future promotions. Keep the context tied to the actual opt-in.

• Use an unchecked opt-in control where appropriate; let the person actively choose.
• Name the business and channel at the point of permission.
• Describe the kind of updates or promotions expected.
• Retain the source and timestamp, not just a yes/no flag.
• Provide a straightforward opt-out route and apply it across campaign lists.

Treat opt-out as a workflow event

Make STOP or other clear opt-out requests easy to record, suppress and audit. If a request arrives in a support conversation, do not make the customer repeat it to another department. Synchronize suppression lists before scheduling a campaign and check them again at send time.

If a person opts out of one message type but wants another, record the preference accurately. Do not assume the customer’s silence is renewed permission.

Review rules for your location and use case

Meta’s policy is not a substitute for local privacy, marketing and consumer-protection law. The business is responsible for required notices and permissions. Ask qualified counsel to review requirements that apply to your business, especially when messages involve sensitive information, regulated products or customers in multiple countries.

Use Meta’s current policy and developer resources as the operational baseline, and recheck them when launching a new campaign type.

Common questions