WhatsApp opt-in: the rules, the wording and the records

WhatsApp opt-in is a customer's permission for your business to message them on WhatsApp. Meta requires it before you send business-initiated messages, such as order updates, reminders or offers. The opt-in must make clear the person is agreeing to hear from you, name your business, and comply with the laws that apply to you.

WhatsApp's Business Messaging Policy puts it plainly: you may contact people only if they gave you their number and you received opt-in permission confirming they want to receive messages or calls from you. When a customer messages you first, replying inside the 24-hour customer service window is part of their conversation. Opt-in is about the conversations you start, which on the WhatsApp Business API means sending a template.

Meta's developer documentation lists three requirements. Your opt-in must:

1. Clearly state that the person is opting in to receive communication from your business.
2. Clearly state your business name. Use the name customers will see on WhatsApp.
3. Comply with applicable law in every market you message.

Since Meta's November 2024 policy update, the opt-in no longer has to mention WhatsApp by name: a general consent to be contacted can qualify if local law allows it. Mention WhatsApp anyway. People who are surprised by a message block it, and blocks drag down your quality rating. The policy also leaves the method to you and makes you solely responsible for collecting consent lawfully.

Meta's best practices go further: cover the kinds of messages you will send (order updates, offers, recommendations) or collect a separate opt-in for each, explain what people get out of it, give clear instructions for opting out, and watch your quality rating whenever you launch a new opt-in method. If you plan to call customers on WhatsApp, the policy recommends a separate opt-in for calls.

Meta's documentation names SMS, websites, phone calls with an IVR flow, and in-person or paper forms as examples, and leaves the method to you as long as the three requirements are met. The collection points that work best:

Click-to-WhatsApp ads deserve a note. When someone messages you from one and you reply within 24 hours, Meta opens a 72-hour window in which your messages are free. Use it to ask for opt-in, so you can stay in touch after the window closes.

Each example names the business, says what to expect and explains how to stop. Swap in your details, and keep the promise you make.

• Checkout checkbox: Send me order updates and occasional offers from Nomad Supply Co. on WhatsApp. Reply STOP anytime to unsubscribe.
• Website pop-up: Get restock alerts and members-only offers from Aura Botanicals on WhatsApp, up to 4 messages a month. Reply STOP to opt out.
• Back-in-stock button: Notify me on WhatsApp when this is back. Linen Lane will send one restock message. Reply STOP to opt out.
• Appointment form: Send my appointment confirmations and reminders from Bright Smile Dental to this number on WhatsApp.
• Real estate lead form: I agree that Harbor Homes may contact me on WhatsApp about properties that match my search. I can opt out anytime by replying STOP.
• SMS invite: Nomad Supply Co: we now send order updates and offers on WhatsApp. Reply YES to get them there. Reply STOP to end texts.
• Phone menu (IVR): Press 1 to get your booking confirmation and reminders from City Auto Service on WhatsApp at this number.
• Counter QR poster: Scan to join Luna Cafe on WhatsApp for weekly specials, about one message a week. Reply STOP anytime.

In-chat request, sent while the customer's conversation is open:

Confirmation, sent right after someone opts in:

Meta doesn't approve opt-in forms in advance. It reviews feedback after the fact and holds you responsible for how consent was collected, and privacy laws such as the GDPR require you to be able to show that someone consented. For every subscriber, keep:

• The phone number in international format
• The date and time of opt-in
• The source: checkout, pop-up, QR code, chat, ad, form or call
• The exact wording they saw, with a version number whenever you change it
• What they agreed to: order updates, marketing or both
• How they confirmed: ticked box, YES reply, signature or keypress
• Every opt-out, with its date and channel

Keep these records for as long as you message the person, plus any period your local law requires. They also make switching tools easier, because consent status travels with each contact instead of everyone being asked again.

• EU and EEA: under the GDPR, consent must be freely given, specific, informed and unambiguous. Silence and pre-ticked boxes don't count, you must be able to demonstrate consent, and withdrawing it must be as easy as giving it. National electronic-marketing rules can also apply.
• United Kingdom: the UK GDPR, plus the Privacy and Electronic Communications Regulations (PECR) for electronic marketing.
• United States: the TCPA and state laws govern marketing texts. How they apply to app-based messaging is less settled, so many businesses apply SMS-grade written consent. Meta also stopped delivering marketing templates to US numbers in April 2025, and its documentation still described that pause in September 2026; utility and service messages are unaffected.
• India and Brazil: India's Digital Personal Data Protection Act, 2023 and Brazil's LGPD both regulate how you collect and use personal data, including consent.

A practical rule: collect consent to the strictest standard you face, once, and use it everywhere. Use an unticked box, plain wording, and a separate choice for marketing, so people can keep order updates without getting offers.

WhatsApp's policy says you must respect every request, on or off WhatsApp, to block, stop or opt out of your messages, including removing the person from your contact list. People can also stop marketing messages from a business inside WhatsApp, or block and report it.

• Treat STOP, UNSUBSCRIBE and plain phrases such as 'stop sending me these' as opt-outs.
• Confirm once, briefly, and send nothing further of that type.
• Let people leave marketing without losing order updates, but if they ask to stop everything, stop everything.
• Add a quick-reply button such as 'Stop promotions' to marketing templates, plus a line like 'Reply STOP to opt out'.
• Sync opt-outs to your email, SMS and CRM tools the same day.
• Someone who opted out stays out until they opt in again.

Recoverly is built so a campaign can't reach someone who didn't opt in:

• Consent source per subscriber. Every signup is stored with where it came from: the storefront opt-in widget, the text-marketing checkbox at Shopify checkout, or a back-in-stock signup, whose default consent line promises exactly one restock message.
• Audiences intersected with opt-ins. Every campaign audience, including recent customers, repeat buyers and abandoned-checkout shoppers, is filtered against your opted-in list before anything is sent.
• STOP honored instantly and permanently. A STOP reply halts messages to that customer, and the AI chatbot never answers an opt-out with a sales pitch.
• Transactional stays transactional. Order and shipping updates follow Meta's utility rules and go only to the customer who placed the order.

The chat widget is on the free plan; opt-in capture, campaigns and the subscribers list come with Lite. See campaigns and pricing.