WhatsApp Opt-In Rules, Explained

Opt-in is the least glamorous topic on this platform and the one that quietly determines whether anything else you build works. Every restriction, every collapsed quality rating, every number that mysteriously stops reaching people traces back to it.

It is also the area where businesses most confidently believe they are fine. The gap is usually not between compliant and non-compliant. It is between legally defensible and actually remembered by the recipient — and only the second one protects your number.

What Meta requires

Meta’s requirement is short: get explicit opt-in before messaging, make it clear the person is agreeing to WhatsApp messages, and make it clear which business is sending them. You may collect it anywhere — a website form, a checkout flow, in person, over another channel — because Meta cares about the clarity of the agreement rather than the medium.

Record three things at the moment of collection: when, where, and what exactly the person agreed to. Not because Meta will ask — it almost certainly will not — but because the day you need it is the day you are trying to work out which list poisoned your number, and without those fields the answer is unknowable.

Enforcement is indirect, which fools people

There is no consent audit. Nobody reviews your database. This is why weak opt-in persists for so long in so many businesses: nothing bad happens for months.

Then it does, all at once. The people who did not remember agreeing start blocking. Blocks move the quality rating. The rating gates the messaging limit. Your reach shrinks, and the cause is six weeks upstream of the symptom.

The useful reframe: opt-in is not a compliance checkbox on this platform. It is the input to a reputation system that decides how many people you are allowed to talk to.

Opt-out is the half that gets neglected

Collecting consent gets attention. Handling withdrawal usually does not, and it is where the expensive failures live.

Three properties matter. It must be automatic — recognising STOP and its variants in code, not relying on someone reading the inbox. It must be global — applying across every list, campaign and event you run, not just the one that prompted it. And it must fail closed — if the suppression lookup errors, the correct behaviour is to skip the send, not to send anyway and log a warning.

That last one is a genuine engineering decision with a tempting wrong answer. An opt-out check that silently degrades to “send it” during an outage will, on exactly the worst day, message every person who ever asked you to stop.

India: the DPDP Act sits on top

For anyone messaging Indian recipients, Meta’s policy is the floor, not the ceiling. The Digital Personal Data Protection Act adds a separate legal obligation, enforced by a different body, with consequences that are not measured in quality ratings.

The requirement most likely to catch an existing system out is the symmetry rule: withdrawing consent must be as easy as giving it. If someone can opt in with one tap on a form but has to email a support address to get out, that asymmetry is the problem, and it is extremely common.

A practical standard

If you want one test that keeps you clear of both Meta and the regulator, it is this: could the recipient reconstruct, unprompted, why they are hearing from you?

Not whether a lawyer could defend it. Whether the person holding the phone recognises the sender and remembers the moment they said yes. Every list that fails that test will eventually cost you a number, and no amount of template polish will save it.