WhatsApp opt-in rules: what Meta requires, and what the law does

An opt-in is a record that a person agreed to receive messages from your business. Meta requires one before you send template messages, and Meta's own bar is lower than most merchants assume — but Meta's rules are the floor, not the ceiling, and in several markets the law sits well above them.

This page separates the two, because conflating them is how stores end up either over-engineering consent or breaking the law.

What Meta actually requires

Meta's opt-in documentation asks for three things:

1. Clearly state that the person is opting in to receive communication from the business.
2. Clearly state the business's name.
3. Comply with all applicable law.

Two things follow that surprise people. First, the opt-in does not have to be WhatsApp-specific — Meta explicitly allows a general opt-in, as long as local law is satisfied. Second, Meta does not require double opt-in. A confirmation step is a good idea; it is not a platform requirement.

Opt-out instructions are similar: Meta frames them as recommended best practice rather than a hard requirement. That said, offering an easy opt-out is the single cheapest way to protect the quality rating your messaging tier depends on — a customer who cannot unsubscribe blocks you instead, and blocks are what damage quality.

Where the law is stricter

Market	Standard	Practical effect
UK	PECR, plus the Data (Use and Access) Act 2025	Explicit consent, or the narrow "soft opt-in" for existing customers buying similar products. Maximum fines raised to £17.5m or 4% of global turnover.
EEA	GDPR Article 7 plus ePrivacy	Freely given, specific, informed, unambiguous. No pre-ticked boxes, no bundling with terms acceptance.
UAE	Cabinet Decision 56/2024	Requires consent before sending electronic marketing via messages on social platforms — explicitly covering WhatsApp.
India	DPDP Act 2023	Consent must be free, specific, informed and unambiguous by clear affirmative action, and withdrawal must be as easy as giving it.
Nigeria	NDPA 2023	Pre-checked boxes, silence and inactivity are explicitly not consent.
Brazil	LGPD	Marketing may rest on consent or legitimate interest, assessed case by case — materially more permissive, though Meta still requires an opt-in.

The pattern: Meta's "a general opt-in is fine" allowance does not discharge GDPR, PECR, DPDP or the UAE rules. If you sell into those markets, build to the legal standard and Meta's requirement is satisfied automatically.

How to collect opt-in without annoying anyone

1. At checkout. An unticked checkbox saying "Send my order updates on WhatsApp" next to the phone field. Unticked matters — a pre-ticked box is not consent under GDPR, DPDP or NDPA.
2. Separate the two purposes. One checkbox for order updates, a second for offers. This is genuinely useful rather than bureaucratic: in most markets order updates are utility messages that reach people anyway, and separating them means a customer who declines marketing still gets their tracking link.
3. When they message you first. Someone who writes to your shop has opened a conversation. Confirm the marketing part explicitly rather than assuming it.
4. On the thank-you page. A WhatsApp button after purchase both collects consent and opens the conversation window.

What to record

Consent you cannot evidence is consent you do not have. Store, for each contact:

• The timestamp.
• Where it happened — checkout, a form, a chat.
• What exactly they agreed to — order updates, marketing, or both.
• The wording they saw.

That last one is the one everyone forgets, and it is the one a regulator asks for.

Handling opt-outs

Every list decays, and the customers leaving it are the ones most likely to damage your quality rating on the way out. Automatic STOP and START keyword handling, an opt-out list, and a per-contact marketing frequency cap are covered in managing opt-outs, frequency and template quality.

One nuance worth designing around: a customer replying STOP is replying, which opens the conversation window. If your STOP handling is a template, it is being sent unnecessarily — a free-text confirmation works and costs nothing.

The commercial argument for doing this properly

Consent is not only a legal matter. Meta's per-user marketing limits tighten for recipients who appear unreceptive, and that assessment is shared across all businesses. Sending to people who did not meaningfully agree produces blocks and reports, which degrade quality, which caps your messaging tier, which limits how many people you can reach at all.

A smaller list of people who genuinely opted in outperforms a large list you bought or assumed — not because it is more ethical, though it is, but because the platform is built to punish the alternative.

Wording you can actually use

Meta's three requirements are easy to satisfy in one sentence, and the usual failure is vagueness rather than omission. Two versions, split by purpose:

• Order updates: "Send my order updates on WhatsApp from [Business Name]." Names the business, states what they get, unambiguous.
• Marketing: "Send me offers and new product news on WhatsApp from [Business Name]. Reply STOP any time." Separate box, unticked.

What fails: consent buried inside "I agree to the terms"; a pre-ticked box; one box covering both purposes; or wording that never names the business.

Two boxes, not one

Separating the purposes is the most useful structural decision here, and it helps you commercially as well as legally.

	One combined box	Two separate boxes
Customer who wants tracking but not offers	Ticks it, then blocks you when offers arrive	Gets exactly what they asked for
Effect on quality rating	Blocks accumulate	Blocks stay rare
GDPR / DPDP position	Bundled consent — weak	Specific consent — defensible
Marketing list size	Larger	Smaller, far more engaged

The smaller list is the point. Per-user marketing limits tighten for recipients who appear unreceptive, so a list of people who explicitly asked for offers outperforms a bigger one padded with people who only wanted a tracking link.

Where to collect it

1. At checkout, beside the phone field — the highest-volume moment, and the number is already being typed.
2. On the thank-you page, as a WhatsApp button. This does two jobs: records consent, and opens the 24-hour window so your next messages are free.
3. In the chat, when a customer messages first. They opened a conversation, which is not the same as agreeing to marketing — ask explicitly.
4. On a notify-me request. Someone asking to be told when an item returns has given unusually clear evidence of consent for that message.

Keep the evidence, not just the flag

A field reading "opted in: true" is not a consent record. If challenged you have to show what the person agreed to. Store four things:

• The timestamp.
• Where it happened — checkout, thank-you page, chat.
• Which purpose — order updates, marketing, or both.
• The exact wording they saw.

The last is the one everyone omits and the one a regulator asks for. Checkout wording changes over time, so storing the version in force at that moment is what makes the record mean anything.

Withdrawal must be as easy as consent

Several regimes state this outright — India's DPDP Act among them — and it is good practice everywhere. In practice: automatic STOP handling, an opt-out list that genuinely suppresses sends, and no requirement to email anyone or hunt for a settings page.

One design note worth acting on: a customer replying STOP has just messaged you, which opens the window. Your confirmation can be free text rather than a template — cheaper, and it avoids the odd experience of a formal template arriving in reply to a request to be left alone. Mechanics are under Broadcasts → Opt-outs.

What happens if you get it wrong

Two separate consequences, and merchants usually only think about one of them. The regulator is the slow risk; Meta is the fast one.

On the platform side, Meta's policy enforcement documentation lists spam and excessive negative user feedback among its triggers, and describes a graduated ladder: a warning, then 1 to 3 day blocks on a message type, then 5, 7 or 30-day blocks on all messaging, then an appealable indefinite lock, then permanent removal. Messaging people who did not meaningfully agree is the most reliable way onto that ladder, because it produces exactly the blocks and reports the system watches.

On the legal side the timescales are longer but the numbers are larger — the UK's maximum rose to £17.5m or 4% of global turnover under the Data (Use and Access) Act 2025, and India's DPDP Act carries penalties running to billions of rupees. Neither is aimed at small merchants in practice, but neither is a rule you want to be visibly ignoring at scale.

The practical reading: build to the stricter of Meta's policy and your local law, and the platform risk mostly takes care of itself.