A Guide To WhatsApp Business Policy Opt-In Requirements

Essentials to know

• Active permission only: You cannot message someone just because you have their number. Customers must actively agree to be contacted—usually by ticking an unchecked box or submitting a form.
• No implied consent: Previous purchases or email sign-ups do not count as permission for WhatsApp. Consent must be explicit, specific to WhatsApp, and clearly name your business.
• Multi-channel collection: You can gather opt-ins anywhere – on your website checkout, enquiry forms, or via SMS confirmation flows. It doesn’t have to happen inside the WhatsApp app.
• Define message types: Be transparent about what you are sending. Distinguish between service updates (booking confirmations/delivery info) and marketing (promos/offers) so customers know what to expect.
• Immediate opt-out: You must honour “stop” requests instantly. Making it easy for customers to leave prevents them from reporting or blocking your account, which protects your business from being banned.

If you regularly use WhatsApp Business to connect with customers, it’s important to understand the rules around opt-in requirements to make sure your overall strategy is compliant.

Before you can send most business-initiated messages on WhatsApp, you must first receive what’s known as a customer opt-in. In simple terms, this means the customer has actively agreed to receive messages from your business on WhatsApp before you contact them. This opt-in requirement sits within WhatsApp’s wider business messaging policies and applies whether you’re using the WhatsApp Business App or the WhatsApp Business API.

In this guide, we’ll explain how WhatsApp Business opt-in works, what counts as valid consent, and what small businesses should consider before messaging customers.

What are WhatsApp Business opt-in requirements?

WhatsApp Business opt-in requirements are rules set by WhatsApp that require businesses to obtain customers’ permission before sending proactive messages.

Unlike SMS or email (where regulations vary by country), WhatsApp applies its own global policy framework. These rules are designed to:

• Protect users from unsolicited business messaging
• Prevent spam and misuse of the platform
• Ensure customers remain in control of how businesses contact them

Put simply, a business cannot send a customer a message just because it has their phone number. The customer must first agree to receive WhatsApp communication from that specific business.

Why opt-in matters for businesses using WhatsApp Business

Opt-in is more than just a technical requirement – it’s a compliance issue that directly affects your ability to use WhatsApp as a communication channel. Without a valid opt-in:

• Messages may fail to deliver
• Customers may raise complaints
• WhatsApp may reduce a business’s messaging limits
• WhatsApp may pause or block message templates
• WhatsApp may restrict or suspend your WhatsApp Business account

From a purely operational perspective, failing to obtain opt-in can stop you from sending essential business messages, such as booking confirmations, delivery updates, or customer service replies.

What counts as a valid customer opt-in?

A valid WhatsApp Business opt-in must meet three key conditions:

• The customer has clearly agreed to receive messages from your business
• They understand they will be contacted via WhatsApp
• They know which business will be messaging them

Consent must be:

• Active – not assumed or pre-selected
• Specific – referring to WhatsApp as the communication method
• Transparent – naming the business that will send messages

General vs channel-specific opt-in explained

Some businesses collect general opt-in when customers share their phone number and agree to receive messages from the business. This may still be valid for WhatsApp messaging, provided customers were clearly informed at the time that they were agreeing to receive messages from your business via WhatsApp.

Others choose to collect channel-specific opt-in – for example, a checkbox that explicitly references WhatsApp as the communication method. This approach often provides greater clarity and can help maintain accurate contact preferences.

Explicit vs implied opt-in explained

Explicit opt-in occurs when a customer actively takes a step to agree to WhatsApp contact. This might include:

• Ticking an unchecked consent box
• Submitting a form with a WhatsApp consent statement
• Replying “YES” to a consent request

Implied opt-in, by contrast, is where a business assumes permission based on an existing relationship or prior interaction. For example:

• A previous purchase
• Signing up for an email newsletter
• Contacting customer support

On some channels, this type of relationship might be treated as consent for follow-up messaging. However, on WhatsApp, implied opt-in is not considered a valid permission for business-initiated messages.

If a customer messages your business first, you may respond within WhatsApp’s customer service window. But this only allows replies to that conversation – it does not grant ongoing permission to send proactive or promotional messages later.

If you want to message them again later – for example, with updates or offers – you’ll need to have explicit opt-in in place.

How customers can give opt-in consent

So, how can you gather opt-in permission from your contacts? There are plenty of options. Customers can provide opt-in through a variety of channels, including:

• Website enquiry forms
• Checkout pages
• Booking systems
• Customer support requests
• QR code sign-ups
• wa.me links
• Lead generation ads
• SMS confirmation flows
• Email sign-up forms
• In-person written consent

Crucially, opt-in does not need to be collected inside WhatsApp itself – consent gathered through another channel can still be valid for WhatsApp messaging, provided the customer was clearly informed they were agreeing to receive WhatsApp messages from your specific business at the time.

What businesses are allowed to message after opt-in

Once someone has opted in, you can send them business‑initiated messages that match what they agreed to receive – for example, updates about a service they’re using, account or delivery notifications, or other relevant information related to their interaction with your business.

Transactional messages vs marketing messages

When requesting opt-in permission from your customers, it’s important to distinguish between different types of outbound messaging. For example:

1. Transactional or service messages – such as booking confirmations, payment receipts, delivery tracking or support responses – relate directly to something the customer has requested.
2. Marketing messages – such as promotional offers, product recommendations or discount announcements – are more promotional in nature and tend to come from the business first, rather than the customer.

If you plan to send marketing content, this should be clearly explained during the opt-in process and, where appropriate, consented to as a separate category from service updates.

Opt-in requirements for WhatsApp Business API vs app

The WhatsApp Business app is typically used by smaller teams that manage conversations manually, whereas the WhatsApp Business API is designed for larger businesses or automated messaging workflows.

For business-initiated API conversations, pre-approved message templates must be used in the correct category. These may include marketing, utility, or authentication templates, depending on the message’s purpose.

Record-keeping and proof of opt-in

Keeping a record of customer consent helps you demonstrate compliance if questions arise later. Businesses should retain clear records showing:

• When opt-in was obtained
• How it was obtained
• What wording was presented
• Which number the customer agreed to be contacted on

In some cases, WhatsApp may review user feedback and messaging activity when investigating potential policy violations. This is often linked to a drop in your quality rating – for example, if multiple users block, report, or opt out of your messages.

The 24-hour customer care window explained

If a customer messages your business first, you may respond freely within WhatsApp’s customer service window. This applies to both the WhatsApp Business App and the WhatsApp Business API.

However, a customer who starts a conversation does not automatically opt in to future outbound messaging.

On the Business App, you may still be able to send a message manually after this window has closed, but doing so without explicit opt-in may increase the risk of blocks or reports. On the API, businesses are generally required to have opt-in in place and to use an approved message template when sending business-initiated messages outside the service window.

Some entry points – such as Click-to-WhatsApp ads – may affect how long businesses can continue messaging and which template types apply. It’s worth checking the latest Meta guidance for your account setup.

How and when customers can withdraw consent

Customers must be able to withdraw their consent for WhatsApp Business messages at any time. This can usually be done by:

• Replying with “STOP”
• Requesting removal during a conversation
• Blocking or reporting the business account
• Changing preferences in their account settings

Opt-out requests should be honoured regardless of whether they are received via WhatsApp or another support channel. Once consent is withdrawn, businesses should immediately stop sending proactive messages via WhatsApp and update their records accordingly.

Opt-in rules for existing customers

As we’ve already covered, having an existing relationship does not automatically grant permission to message customers on WhatsApp. However, prior consent collected elsewhere may still be valid if it clearly stated that the customer agreed to receive WhatsApp messages from your business.

Businesses should confirm they have a WhatsApp-specific opt-in on record before sending outbound business-initiated messages. If there’s any room for confusion, it’s worth asking the customer to reconfirm their consent before you go ahead and start messaging.

Using website forms, checkout pages and lead ads for opt-in

Wondering when you should ask for opt-in consent? Many businesses gather opt-ins during online checkout, when booking appointments, during contact form submissions, or through social media lead ads.

Consent wording needs to:

• Mention WhatsApp specifically
• Name the business
• Explain the type and typical frequency of messages that may be sent
• Explain how customers can opt out later if they change their mind

If you’re collecting opt-ins through your website or another external system, best practice is to:

• Include an active checkbox or similar visual consent element
• Allow customers to enter or edit the phone number used
• Clearly explain what information will be received via WhatsApp

Opt-in considerations for businesses in the United Kingdom

In the UK, WhatsApp opt-in processes should align with the UK’s General Data Protection Regulation (GDPR) requirements for consent. This means consent must be freely given, specific, informed and unambiguous – for example, customers should understand they are agreeing to receive WhatsApp messages from your business, what types of messages they may receive, and how often. Pre‑ticked boxes or bundled consent statements (where the user is asked to agree to be contacted across many platforms at once) may not meet these requirements – the goal is to ensure customers can make specific, free and informed choices. Businesses should also keep a record of when and how consent was obtained, particularly if marketing content is sent, as this may need to be demonstrated if a complaint is raised.

Common opt-in mistakes businesses make

Some of the most common opt-in mistakes stem from assumptions of what counts or unclear processes that lead to confusion. These include:

• Assuming consent from previous purchases – having an existing customer relationship does not automatically mean someone has agreed to be contacted on WhatsApp.
• Using unclear or overly broad wording – if customers don’t understand they’re opting in to WhatsApp messages, consent may not be valid.
• Failing to store proof of opt-in – without a record of when and how consent was obtained, it can be difficult to respond to complaints later on.
• Sending promotional content without marketing consent – service updates and marketing messages are treated differently, and promotions should only be sent where this has been explicitly agreed to.

Consequences of not following WhatsApp opt-in policies

If opt-in requirements aren’t consistently followed, it can affect how reliably your business can use WhatsApp for outbound messaging over time. For example:

• Message delivery restrictions
• Messaging limits being reduced
• Template quality ratings falling
• Message templates being paused
• Account quality rating reduction
• Suspension of your WhatsApp Business account

On the WhatsApp Business Platform (API), your account’s quality rating is used to determine your messaging tier, which affects how many new business‑initiated conversations you can start within a given period. A lower rating may reduce these limits or make it harder to reach customers proactively.

On the WhatsApp Business App, messaging tiers are not applied in the same way. However, repeated blocks, reports, or opt-outs may still affect account quality over time and could lead to delivery issues, restrictions, or an account review.

Best practices for staying compliant across multiple countries

If your business operates internationally, staying compliant can feel a little more complex. The exact requirements will vary depending on the countries you work in, so it’s important to understand what local laws require regarding consent and business messaging. Where possible, it’s also worth seeking professional guidance to ensure your opt-in processes align with the relevant regional requirements. However, here’s a set of best practice guidelines that offer a good place to start:

• Use easy-to-understand consent wording
• Keep accurate and clear records
• Store opt-in records securely
• Allow easy opt-out and take action on it immediately
• Align messaging practices with local regulations
• Monitor customer responses to your business-initiated messages
• Keep your business profile complete and up-to-date
• Consider verifying your WhatsApp Business account
• Make it easy for customers to speak to a real person if they want to, if you’re using automated replies

How to design a clear and compliant opt-in flow

In practice, a clear and compliant opt-in flow should make it obvious what customers are signing up for and give them a simple, active way to agree. At a minimum, it should:

• Clearly explain the nature of WhatsApp contact
• Request the customer’s active agreement (such as ticking a box)
• Specify the message types the customer should expect to receive
• Allow customers to enter or confirm their preferred number
• Provide clear, easy-to-action opt-out instructions

Frequently asked questions about WhatsApp Business opt-in

Do customers need to opt in for replies?

No – if a customer messages you first, you may respond within the customer service window.

Does opt-in expire?

Consent usually stays in place unless the customer chooses to opt out, but it’s still a good idea to check that your messages remain relevant over time. If a customer hasn’t contacted you in 6 to 12 months, you should re-verify their consent.

Can customers opt in verbally?

Yes – but it’s a good idea to keep a record where possible. Following up with a brief written confirmation can help make sure everyone is clear on what’s been agreed.

Using WhatsApp Business successfully with YourBusinessNumber

If your business relies on WhatsApp for customer communication, having an opt-in process that’s clear, compliant and easy to manage is a key part of keeping your messaging strategy reliable and successful as you grow.

With a dedicated virtual WhatsApp Business number or a business esIM from YourBusinessNumber, you can run WhatsApp Business alongside your personal line on one device – helping you keep customer conversations organised while staying in control of how and when you contact them.

Compliance disclaimer

This content is intended for general information only and should not be taken as legal advice. Rules on data processing and storage differ across countries, states, and territories, and they may change over time. Always consult a qualified legal professional and check local laws before deciding on policies and processes that suit your business.