WhatsApp opt-in, and how not to get blocked

Meta requires businesses to obtain opt-in before messaging someone on WhatsApp. That sentence is where most guidance stops, and it leaves the two questions that matter unanswered: what counts as an opt-in, and what actually happens to a number that ignores this.

The second question has the more useful answer, so it is worth starting there. Nothing about opt-in is enforced by a policy team reviewing your list. It is enforced by recipients. People who did not expect your message block you or report it, those signals feed your number's quality rating, a falling rating cuts your messaging limit, and a number that keeps falling gets restricted. The enforcement mechanism is the customer.

What counts as an opt-in

An opt-in is a recorded agreement from a person to receive messages from a specific business, on WhatsApp, for a specific purpose. Meta is deliberately flexible about how you collect it and firm about what has to be true when you do.

Three properties have to hold.

The person has to know it is you. Your business name, as they would recognise it, at the point of agreement. Consent given to a brand they have never heard of is consent to nothing.

They have to know the channel. "We will message you on WhatsApp" is different from a general marketing checkbox. A person who agreed to email did not agree to WhatsApp.

They have to know roughly what they are agreeing to receive. Order updates and weekly promotions are different products. Which brings us to the part most lists get wrong.

Consent is scoped by purpose

Someone who messaged you asking where their order is has not agreed to receive promotions. Someone who ticked a box for delivery notifications has not agreed to a Black Friday campaign.

Treating those as the same consent is the single most common cause of a damaged sender reputation, and it is easy to do accidentally, because most systems store consent as one flag on a contact record. If your platform can only answer "is this person opted in", it cannot answer the question that matters, which is "opted in to what".

Keeping utility and marketing consent separate costs a column and saves a number.

What a usable record contains

When something goes wrong, someone will ask which segment caused it. A consent record earns its place if it can answer that months later.

• The exact wording shown to the person, not a summary of it
• Where it was collected: which page, which form, which point in a flow
• When, to the second
• The purpose it covers
• The channel it covers
• What changed it since, including opt-outs, and when

That last line is the one usually missing. Consent is a history, not a state. A contact who opted in, opted out, and opted back in is a different situation from one who never opted out, and the two look identical if you only store the current value. Recording changes in an audit trail that can be added to and not edited is what makes the record worth having.

Ways businesses actually collect it

These all work, in roughly increasing order of quality.

• A clearly labelled, unticked checkbox at checkout or on a form, naming your business and WhatsApp
• A "message us on WhatsApp" entry point the customer taps themselves, which starts a conversation and makes the intent unambiguous
• A click-to-WhatsApp ad, where the person chose to open a chat with you
• An in-store or on-call agreement, recorded at the time with the wording used
• Double opt-in: the person confirms once more inside WhatsApp before any marketing goes out

Double opt-in gives you a smaller list and better numbers on everything that follows: engagement, complaint rate, and the quality rating your outbound capacity depends on. On a channel where a complaint costs more than it does in email, that trade is usually worth it.

What is not an opt-in

• A purchased or rented list, in any form, with any assurance attached
• Numbers collected for delivery, verification, or account recovery, then reused for marketing
• A conversation the person started two years ago about something unrelated
• Numbers scraped from a marketplace, a directory, or a group chat
• An opt-in given to a different brand you also own, unless that was stated at the time
• Consent inherited from another channel without the channel being named

If a list arrived without a story about how each number agreed, there is no opt-in, and sending to it is the fastest way to damage a number.

Opt-out has to be immediate and global

An opt-out is an instruction, not feedback. Three requirements make it real.

Immediate. Effective before the next send, not at the next list rebuild. A suppression list checked at send time is the mechanism; one applied when the audience was assembled is not, because someone can opt out between the two.

Global by default. A person who opted out of one campaign has opted out of marketing, unless they explicitly scoped it narrower. A suppression that only covers the campaign that prompted it is a complaint scheduled for next month.

Machine-readable as well as human. People type stop, STOP, unsubscribe, "remove me", and things less polite. Keyword handling should be deterministic rather than left to language understanding, because this is one of the few cases where the same input must produce the same output every time.

Meta also signals opt-outs through send failures. A message that fails with a code meaning the recipient opted out of marketing from your business, or that they cannot be reached, is Meta telling you to stop. Those failures should suppress the contact automatically. Software that files them in a report and moves on is quietly re-sending to people who already said no.

One code is different and it is worth separating: a per-user marketing throttle means this person has received enough for now, not that they refused. That one is a delay, and treating it as an opt-out shrinks your list for no reason.

The behaviour that actually gets numbers restricted

Beyond consent, the pattern behind most flagged numbers is the same shape.

• Frequency. More than people expected. There is no universal right number, but the honest test is whether you would be comfortable telling them the frequency at opt-in.
• Relevance. The same message to the whole list, including the people it does not apply to. Every irrelevant send is a small invitation to block.
• Timing. Marketing at 2am in the recipient's timezone gets reported at a rate nothing else matches. Quiet hours are cheap to implement and expensive to skip.
• Language. Messaging someone in a language they did not use with you reads as automated outreach, because it usually is.
• No visible way out. A marketing message that does not make opting out obvious converts an annoyed person into a reporting one.

Meta's rules are the floor, not the ceiling

Everything above is about staying inside Meta's requirements and keeping a number healthy. Local law sits on top of it and is stricter in many markets, with its own rules about consent, record keeping, timing, and the right to be forgotten. Which rules apply to you depends on where your customers are, and that is a question for someone qualified to answer it rather than for a vendor's blog.

What a platform can reasonably be expected to give you is the machinery: consent recorded per purpose and per channel, suppression enforced at send time, opt-outs honoured across campaigns, and a record you can produce when someone asks.

The short version

Collect consent that names you, names WhatsApp, and names what you will send. Store every grant and every withdrawal. Check suppression at send time, honour every stop instruction everywhere, and treat Meta's failure codes as instructions.

Do that and the limits stop being something you manage. They stop being something you notice.