WhatsApp opt-in requirements and how to stay unblocked

Meta's Business Messaging Policy covers opt-outs, quality and enforcement, and requires an AI agent to offer a way to reach a person. WhatsApp can also review your opt-in flow directly, and a consent record kept in a spreadsheet won't excuse an unexpected message.

What counts as an opt-in

At Meta's minimum, a WhatsApp opt-in means the person gave your business their number and agreed to receive messages from it. Since November 2024 the permission need not name WhatsApp, if local law allows. A clear, specific opt-in still protects you best:

• Name your business as customers know it.
• Name WhatsApp. Local law may require it, and agreeing to email is not agreeing to WhatsApp.
• Say what they'll receive. Order updates and weekly offers are different things.

Consent has a purpose

A customer asking where their order is has opened a service chat, not agreed to promotions. Someone who chose delivery updates did not ask for a sale campaign.

Meta recommends explaining which kinds of messages an opt-in covers, or asking for each separately. Store the purpose, not one yes/no flag.

What to record

• The exact wording shown
• Where it was collected: page, form or point in a chat
• When, with a time zone
• The purpose and channel it covers
• Every change since, including opt-outs

Consent is a history. Someone who opted out and back in differs from someone who never left, and only the full record shows it.

Ways to collect it

• An unticked checkbox at checkout that names your business and WhatsApp
• A "message us on WhatsApp" link, then a clear permission request before any marketing. The free WhatsApp link and QR generator makes the link; the chat alone is not marketing permission.
• A click-to-WhatsApp ad whose wording makes future messages clear
• An in-store or phone agreement, recorded with the words used
• Double opt-in: a second confirmation inside WhatsApp before marketing

Double opt-in confirms the right person signed up, at the cost of one more step.

What is not an opt-in

• A bought or rented list, whatever it promises
• Numbers collected for delivery or verification, reused for marketing
• An old chat about something unrelated
• Numbers scraped from a directory, marketplace or group
• Consent given to a different brand you own
• Email-only permission reused for WhatsApp

If you can't say how each number agreed, there is no opt-in.

Honor opt-outs at once

• Before the next send. Check suppression at send time, since people opt out after an audience is built.
• At the scope asked. A marketing opt-out stops all your marketing. "Stop contacting me" stops everything.
• In any words. Handle stop keywords in each language, and treat "please don't message me again" the same way.

Meta's error 131050 means the person stopped your marketing; suppress them automatically. Error 131049 is different: a per-user marketing limit, not an opt-out. Meta suggests waiting at least 24 hours, and marketing sent inside a window the person opened doesn't count toward the limit.

What gets numbers restricted

• Frequency. More than people expected when they opted in.
• Relevance. One message to the whole list, including people it doesn't fit.
• Timing. Marketing at an odd local hour.
• Language. Writing in a language they never used with you.
• No way out. No obvious way to stop turns an annoyed customer into a report.

Local law comes on top

Meta's rules are the minimum. Local law is often stricter on consent, records, timing and deletion, and depends on where your customers are; check with a qualified adviser. Our UAE and Saudi guides summarize the rules there.

A platform should give you consent per purpose and channel, suppression at send time, opt-outs honored across campaigns, and a record you can produce on request.