WhatsApp Opt-In and Consent: What You Need Before You Send

On email, an unsubscribe link at the bottom of every message is treated as consent enough. On WhatsApp, that logic runs backwards: you need permission before the first message, not an opt-out after the tenth. Businesses that treat a phone number list the way they treat an email list find this out the hard way — usually via a banned number, not a warning. Our in-depth guide to WhatsApp marketing campaigns covers the six things to get right before you send, and consent is the one everything else depends on.

Why opt-in is not optional here

WhatsApp is a permission-based channel by design. Meta requires that a business obtain clear, affirmative consent before sending any commercial message, and it enforces this through the recipient, not through a legal footer. Every time someone blocks your number or reports a message as spam, it counts against your account's quality rating — the score that determines how many people you are allowed to message per day. Enough reports and Meta restricts your sending, then your number, before you ever see a formal warning.

This is the opposite of how email punishes bad behavior. An email list with stale consent quietly loses deliverability over months. A WhatsApp number with no consent can be throttled within days, because the block button sits one tap away from every message you send.

What counts as valid consent

Valid opt-in has one property: the customer took a clear, specific action indicating they want messages from your business on WhatsApp. That can take several forms.

• A checkbox at signup or checkout, unticked by default, explicitly naming WhatsApp as the channel — not bundled into a general marketing consent for email and SMS.
• A QR code or click-to-chat link that opens a WhatsApp conversation the customer initiates themselves, which counts as consent for the topic they messaged about.
• Explicit consent collected inside an existing chat — you ask directly, they reply yes, and you keep that reply on record.
• An in-store or phone request where a staff member logs the customer's number and the specific permission given, with a timestamp.

What does not count: a list of numbers bought or scraped from anywhere, contacts imported from a CRM built for a different purpose, or numbers collected for support that get repurposed for promotions without asking again. If you cannot point to the moment someone said yes to WhatsApp marketing specifically, you do not have consent — you have a phone number.

Document it, do not just collect it

Consent that cannot be shown does not protect you. Keep a record for every contact: the date, the method (checkbox, QR code, chat reply), and ideally the exact wording they agreed to. A spreadsheet is enough at small volume; a CRM field is better once you are running templates and automations at scale. This record matters twice — once when Meta reviews your account after a spike in reports, and once whenever a customer asks what they signed up for. Getting the record right also makes the next step easier: once consent is logged, you can build the pre-approved messages that reach people outside an active conversation. Our guide to WhatsApp message templates: rules, categories, and approval covers exactly that.

The European angle: GDPR on top of Meta's rules

For businesses messaging customers in the EU, GDPR sits on top of Meta's own opt-in requirement, not instead of it. A phone number is personal data, and processing it for marketing needs a lawful basis — in practice, consent that is freely given, specific, informed, and unambiguous. That means no pre-ticked boxes, no consent buried in generic terms and conditions, and a clear explanation of what the customer is agreeing to receive. Customers also need an easy way to withdraw consent, and you need to honor that promptly and remove them from future sends — even though WhatsApp itself has no unsubscribe link.

In practice this changes little about how you collect consent, but it changes what you keep: GDPR expects you to be able to show, on request, when and how a specific customer agreed to be messaged, and to delete their data on request too. The documentation habit above satisfies both Meta and GDPR at once — build it once and both boxes are checked.

“

On WhatsApp, consent is not a compliance checkbox. It is the difference between a number that sends and one that does not.

— be digital ai team

What happens if you skip it

The cost of skipping consent is not a warning email — it is a number that stops working. Every recipient who blocks or reports an unsolicited message pulls down your quality rating, and a rating drop can cap your daily sending limit or suspend your ability to start new conversations entirely. Rebuilding a banned number means starting from zero: a new number, no history, and a much more cautious rollout with Meta watching closely. Our guide to avoiding WhatsApp bans: quality rating and best practices walks through how that rating works and how to protect it once your list is properly opted in.

The upside is just as real: a list built on genuine consent opens, replies, and buys, because every recipient asked to be there. That is the list worth building a campaign calendar around.