What it means
An opt-in is the moment a person says yes. On WhatsApp it is the precondition for every business-initiated message, which in practice means every message template you ever send. Replying inside an open 24-hour customer service window does not need one, because the customer started that conversation. Reaching out does.
Meta's policy has three substantive requirements, and they are short enough to memorise:
- The person must take an action. Not a pre-ticked box, not silence, not an inference from a purchase.
- They must be told they will receive messages on WhatsApp specifically. Consent to email or SMS is not consent to this channel.
- They must be told which business will send them. A parent company's name on a form does not authorise a subsidiary brand nobody has heard of.
What is deliberately open is where you collect it. Meta once prescribed particular channels and formats and has since relaxed that, so a web form, a checkout step, an in-store tablet, an IVR prompt, a QR code and a conversation on another platform are all acceptable places. The substance carried the requirement; the venue never did.
Nobody validates it, and that is the trap
There is no API to submit opt-ins to. There is no field on a contact that Meta inspects. You can import a list of fifty thousand numbers you have never spoken to and the first template send will succeed.
Enforcement happens on the other side. The people you message block you and report you. Those actions drive quality rating down. A sustained red rating costs a messaging tier, and a pattern of reports invites a policy review of the whole WABA. The report reason that does the most damage is the one that says the recipient never signed up, because it is simultaneously a quality signal and a policy allegation.
So the honest framing is this: consent is not a compliance form standing between you and sending. It is the variable that determines whether your channel still exists in three months.
Scope: the distinction that saves your rating
The single highest-leverage improvement most teams can make is to stop treating consent as a boolean. A person who agreed to delivery notifications has consented to utility messages. They have not consented to weekly promotions, and sending those anyway is the most common cause of an avoidable block.
Store scope alongside the consent, at minimum splitting transactional from marketing, and build campaign audiences from scope rather than from the existence of a phone number. It costs an afternoon of schema work and it removes the exact behaviour that produces the worst report reason on the platform.
Recency deserves the same treatment. Consent given three years ago by someone who has not interacted since is technically on file and practically forgotten. Most privacy regimes take a dim view of it, and so does the recipient's thumb.
Opt-out is part of opt-in
Every consent system needs a withdrawal path, and on WhatsApp the withdrawal path is a commercial instrument rather than a legal formality.
The mechanics are simple. Put a stop instruction in the footer of marketing templates, since footers are static text and cannot carry variables anyway, or attach a quick-reply button that comes back to your webhook as a clean payload. Process it automatically. Confirm it once. Never require a human to action it, and never make the person ask twice.
The reason to invest here is arithmetic. An annoyed recipient will either unsubscribe or block. An unsubscribe costs you one contact. A block damages the rating that governs your reach to everyone else. Making the exit easy converts the expensive outcome into the cheap one, every single time.
One implementation note that catches teams out: an opt-out is almost never just one word. Handle the obvious keyword, handle the local-language equivalents for every market you operate in, handle the button payload, and treat an unambiguous sentence such as "please stop messaging me" as a withdrawal even though it matches no keyword. An automation that answers that sentence with a product FAQ is how a block gets earned.
Platform policy is not the law
Meta's rules decide whether your account survives. Privacy law decides whether you get fined, and the two overlap without being identical.
- Europe. GDPR and the ePrivacy rules require a lawful basis, freely given and specific consent for direct marketing, evidence you can produce, and a withdrawal that is as easy as the original agreement.
- Turkey. KVKK governs the personal data, and commercial electronic messages additionally sit under a national registry regime with its own consent and opt-out obligations. Satisfying Meta does not satisfy either.
- Elsewhere. Most markets now have a comparable regime. The practical strategy is to build the record that satisfies the strictest jurisdiction you operate in and use it everywhere.
None of this is legal advice, and a lawyer in your market is worth an hour of their fee here. But the engineering conclusion is stable across regimes: store what was shown, when, by whom, for what purpose, and every withdrawal after it.
Real-world examples
- The checkout tick that works. An unticked box at checkout reading "Send my order updates on WhatsApp from Acme Ltd" with a separate box for offers. Two consents, two scopes, both stored with the exact wording and the timestamp.
- The event list that does not. A conference hands over its attendee list. The attendees consented to the conference, not to the sponsor, and the sponsor's number turns red the same afternoon.
- The QR code on the table. A restaurant's code opens WhatsApp with a pre-filled message. The customer sends it, which is both an opt-in and an open service window, and the whole first conversation is free-form.
- The migration that lost the opt-outs. A CRM switch imported contacts and dropped the suppression list. Three hundred people who had unsubscribed were messaged again, and the block rate was catastrophic because they had already said no once.
Common mistakes
- Treating consent as a boolean. Utility and marketing are different permissions.
- Storing a flag instead of evidence. A true value in a column proves nothing. Store the wording, the source and the time.
- Assuming email consent covers WhatsApp. It does not, in policy or in law.
- Buying or borrowing lists. The single fastest route to a red rating and a lost tier.
- Hiding the opt-out. Converts unsubscribes into blocks, which is the expensive direction.
- Keyword-only opt-out handling. Real people write sentences, and they write them in their own language.
- Letting suppression lists die in a migration. The withdrawal record is the half you cannot rebuild.
Related concepts
- Quality rating: the score that consent quality directly drives.
- Message template: where the opt-out line and button live.
- Messaging limit: the reach you lose when consent was thin.
- Cold outreach: the practice that has to be rethought entirely on this channel.
- Lead magnet: the honest way to earn a WhatsApp opt-in in the first place.
- Drip campaign: should be built from consent scope, not from a contact list.
How Pinlyx handles it
Pinlyx stores consent as a record rather than a flag: the wording shown, the source, the timestamp, the scope and every later change, all on the contact timeline. Campaign audiences are built from scope, so a marketing send cannot silently include people who only agreed to delivery updates. Opt-out replies are matched across keywords, local-language variants and quick-reply payloads, suppression is applied instantly and survives imports and merges, and the same suppression list covers WhatsApp, Telegram, email and SMS so a person who says stop once is not reached on a second channel. See WhatsApp CRM.