WhatsApp opt-in rules: what Meta requires, and what the law does

An opt-in is a record that a person agreed to receive messages from your business. Meta requires one before you send template messages, and Meta's own bar is lower than most merchants assume — but Meta's rules are the floor, not the ceiling, and in several markets the law sits well above them.

This page separates the two, because conflating them is how stores end up either over-engineering consent or breaking the law.

What Meta actually requires

Meta's opt-in documentation asks for three things:

1. Clearly state that the person is opting in to receive communication from the business.
2. Clearly state the business's name.
3. Comply with all applicable law.

Two things follow that surprise people. First, the opt-in does not have to be WhatsApp-specific — Meta explicitly allows a general opt-in, as long as local law is satisfied. Second, Meta does not require double opt-in. A confirmation step is a good idea; it is not a platform requirement.

Opt-out instructions are similar: Meta frames them as recommended best practice rather than a hard requirement. That said, offering an easy opt-out is the single cheapest way to protect the quality rating your messaging tier depends on — a customer who cannot unsubscribe blocks you instead, and blocks are what damage quality.

Where the law is stricter

The pattern: Meta's "a general opt-in is fine" allowance does not discharge GDPR, PECR, DPDP or the UAE rules. If you sell into those markets, build to the legal standard and Meta's requirement is satisfied automatically.

How to collect opt-in without annoying anyone

1. At checkout. An unticked checkbox saying "Send my order updates on WhatsApp" next to the phone field. Unticked matters — a pre-ticked box is not consent under GDPR, DPDP or NDPA.
2. Separate the two purposes. One checkbox for order updates, a second for offers. This is genuinely useful rather than bureaucratic: in most markets order updates are utility messages that reach people anyway, and separating them means a customer who declines marketing still gets their tracking link.
3. When they message you first. Someone who writes to your shop has opened a conversation. Confirm the marketing part explicitly rather than assuming it.
4. On the thank-you page. A WhatsApp button after purchase both collects consent and opens the conversation window.

What to record

Consent you cannot evidence is consent you do not have. Store, for each contact:

• The timestamp.
• Where it happened — checkout, a form, a chat.
• What exactly they agreed to — order updates, marketing, or both.
• The wording they saw.

That last one is the one everyone forgets, and it is the one a regulator asks for.

Handling opt-outs

Every list decays, and the customers leaving it are the ones most likely to damage your quality rating on the way out. Automatic STOP and START keyword handling, an opt-out list, and a per-contact marketing frequency cap are covered in managing opt-outs, frequency and template quality.

One nuance worth designing around: a customer replying STOP is replying, which opens the conversation window. If your STOP handling is a template, it is being sent unnecessarily — a free-text confirmation works and costs nothing.

The commercial argument for doing this properly

Consent is not only a legal matter. Meta's per-user marketing limits tighten for recipients who appear unreceptive, and that assessment is shared across all businesses. Sending to people who did not meaningfully agree produces blocks and reports, which degrade quality, which caps your messaging tier, which limits how many people you can reach at all.

A smaller list of people who genuinely opted in outperforms a large list you bought or assumed — not because it is more ethical, though it is, but because the platform is built to punish the alternative.