WhatsApp opt-in rules, and what actually counts

Opt-in decides whether your WhatsApp number survives its first year, and it is the rule most often treated as paperwork.

It is not. WhatsApp scores every business number on how people react to its messages, and blocks and reports drive that score down. A low quality rating cuts your sending limit; a number that keeps falling gets restricted. There is no appeal worth planning around.

What Meta requires

Meta’s requirements are about substance rather than a specific form. Before a marketing message, the opt-in must have been:

• Collected somewhere the person could see what they were agreeing to — your website, a form, a checkout, in your shop, over WhatsApp itself.
• Named your business, by the name they would recognise.
• Said they would receive messages on WhatsApp, rather than just “updates” or “offers”.

You keep the record. Meta does not hold it and will not adjudicate it, but when complaints arrive it is the thing that matters.

What does not count

A purchase. A transaction, not a subscription. A solid basis for a utility message about that order, and not for a promotion next month.

A support conversation. They wrote to you with a problem. Answering is fine; broadcasting to them later is not.

Chat history from a coexistence backfill. These people messaged the business before your software existed. Reply to them, yes. Market to them, no — more on this here.

A phone list you bought. Aside from being illegal in most places under data protection law, this is the fastest way to destroy a WhatsApp number. One purchased list can take down a number that took a year to build.

A tick box that was already ticked. Pre-ticked consent is not consent under India’s DPDP Act, nor in the EU, nor in Meta’s rules.

Opting out

Every marketing template must give people a way to stop, usually a quick-reply button at the bottom.

When somebody taps it, the tap arrives as an ordinary inbound message — a button reply rather than text. Software that only reads the text of incoming messages misses it entirely, and the customer who opted out gets next week’s broadcast anyway.

Three rules follow, and each is a real failure that happens:

Honour it in code, not in your terms of service. A policy nobody enforces is not a control. The check runs before every send, on every recipient, automatically.

Match the whole message, never a substring. “Please don’t stop sending me these” contains the word. Substring matching unsubscribes the one person who wrote in to say they liked it.

Never build a bulk opt-in. Bulk opt-out is a fine feature. A button that marks 40,000 imported contacts as having consented is consent laundering, and the ban lands on your WhatsApp Business Account, not on the software vendor’s.

Honouring an old stop request

If you connect a number with six months of history and somebody asked to stop in March, honour it now. It can only mean sending fewer messages.

What you must not do is reply to those old messages. An automation answering a six-month backfill sends confirmations to everyone at once on the day the number is connected, which looks exactly like the number has been compromised.

Deleting a contact

Deleting somebody who opted out is a mistake, even when they ask.

The opt-out lives on the contact record. Delete the record and the next import of the same spreadsheet brings that person back with consent reset to unknown — and they receive the broadcast they specifically asked not to receive. Keep the row, keep the opt-out, stop sending. Any tool with a hard delete button on a contact has this bug waiting in it.