Opt-in is the foundation
Every business message you send on WhatsApp must be backed by a valid opt-in from the recipient. Without it, your account is at risk regardless of how good your content is. Meta puts opt-in compliance ahead of almost every other policy because it is the single biggest driver of user trust on the platform.
What counts as a valid opt-in
The customer must clearly understand that they are signing up to receive WhatsApp messages from your specific business. The opt-in must mention WhatsApp by name, identify your brand, and be given through an action that demonstrates intent. A pre-ticked checkbox does not count. A buried line in your terms and conditions does not count.
Acceptable channels for collecting opt-in
You can collect opt-ins through your website with an explicit checkbox or button, in person with a clear sign-up form, by SMS or email when the customer replies with a positive consent keyword, or via a verbal confirmation captured during a phone call. The medium does not matter; the clarity of consent does.
Documenting consent
Keep a record of when and how each customer opted in. The minimum is a timestamp, the source channel, and the wording the customer agreed to. If Meta or a regulator queries your practices, this evidence is your defence. Without it, you have no answer when a complaint lands.
Refreshing old opt-ins
If you collected an opt-in two or three years ago for a different purpose, it may not cover WhatsApp. Run a re-opt-in campaign on a channel the customer still uses, such as email, before adding them to your WhatsApp list. Better to lose 20 percent of stale contacts than to message everyone and earn complaints.
Implied opt-in does not exist
A customer who buys from your shop has not opted in to WhatsApp. A customer who saved your phone number has not opted in. A customer who follows you on Instagram has not opted in. WhatsApp opt-in is its own affirmative action and cannot be inferred from other relationships.
Children and vulnerable users
Do not collect opt-ins from users under the age of 16, or whatever age your local privacy law specifies as the threshold. WhatsApp itself sets a minimum age of 13, but business marketing should set a higher bar.
Combining with privacy law
WhatsApp opt-in is layered on top of laws like GDPR in Europe and POPIA in South Africa. Compliance with one does not automatically satisfy the other. Build your opt-in flow to satisfy the strictest applicable rule and you will be safe across jurisdictions.