On this page
Too long? Read this
- Meta requires prior opt-in before any business-initiated template; marketing needs explicit consent that names WhatsApp and the type of messages
- A customer messaging you first is consent for service replies about that conversation, not for offers
- Valid methods: website forms, in-chat YES replies, QR codes with a consent step, checkout checkboxes, ads with a consent question, IVR and paper with a record
- Record source and date per contact; STOP and Meta's app-level opt-out must be honoured immediately
Opt-in is where WhatsApp policy, Indian law and practical deliverability meet: Meta requires it, the DPDP Act requires it, and lists built without it get numbers banned. Yet the rules are widely misunderstood, from "any customer is fair game" to "I need a signed form for every reminder". This guide sets out what counts as consent in 2026, what does not, how to collect it in ways that hold up, and how to record and honour it.
What Meta requires
Meta's Business Messaging Policy requires that a business obtain opt-in before sending a business-initiated message (a template) to a person, that the opt-in make clear the person is agreeing to receive messages from the business on WhatsApp, and that the business honour opt-out requests. Meta also expects the type of messages to be clear: someone who agreed to delivery updates has not agreed to offers. Enforcement is indirect but effective: people who did not consent block and report, and blocks drive the quality rating, pauses and restrictions.
What counts as consent
| Situation | Service and utility messages | Marketing messages |
|---|---|---|
| Customer messages you first | Yes, for that conversation and related transactions | No |
| Customer places an order or booking and gives their number | Yes, for that transaction | Only with a separate marketing consent |
| Website form with an unticked WhatsApp checkbox naming offers | Yes | Yes |
| In-chat "Reply YES to receive our offers on WhatsApp" and a YES | Yes | Yes |
| QR code scan and first message | Yes, for service | No, until a consent step |
| Click-to-WhatsApp ad conversation | Yes, and a free 72-hour window | Marketing needs a consent step in the chat |
| Lead Ad form with a WhatsApp consent question | Yes | Yes, if the question was ticked |
| Paper form at a counter with a WhatsApp line | Yes, if recorded | Yes, if the line names offers and is recorded |
| Purchased or scraped list | No | No |
| Group members, community members | No | No |
How India's DPDP Act and GDPR fit
The Digital Personal Data Protection Act 2023 requires consent that is free, specific, informed and unambiguous for the purpose stated in a notice, and the right to withdraw as easily as it was given. GDPR says the same for EU residents. Both map onto Meta's requirement almost exactly: a clear statement of what the person will receive on WhatsApp, a positive action, a record, and an easy STOP. Businesses that collect WhatsApp consent properly are most of the way to compliance on messaging under both laws; the additional obligations (notice, data subject rights, processor agreements) are covered in the data processing guide.
Collection methods that hold up
- Website and landing page forms. An unticked checkbox: "Send me offers and updates on WhatsApp at this number." Store the submission with time, page and IP.
- In-chat consent. After a service conversation: "Would you like our weekend offers on WhatsApp? Reply YES." The YES is logged on the contact with the date. Flows can ask this automatically after a purchase or booking.
- QR codes and links with a prefilled message that names what the person is signing up for; the first message is service consent, and a follow-up YES step captures marketing consent.
- Checkout and booking forms with the same checkbox; pass the value to the CRM with the order.
- Ads. Facebook Lead Ads with a consent question, or a click-to-WhatsApp ad flow that asks in the first exchange.
- Offline. Paper forms and IVR are valid if you record the consent with date and source; a photo of the form attached to the contact is enough.
Wording that works
Consent language should say three things: the channel, the kind of messages, and how to stop. "Yes, send me appointment reminders and occasional offers on WhatsApp at this number. Reply STOP any time." is enough on a form; in chat, "Would you like our weekly offers on WhatsApp? Reply YES to subscribe, STOP to opt out later" does the same. Avoid bundling WhatsApp into a general marketing checkbox that also covers email and SMS, because a regulator or Meta reviewer reading the record cannot tell what was agreed, and avoid pre-ticked boxes, which the DPDP Act and GDPR both treat as no consent.
Recording consent
Keep, per contact: whether service and marketing consent exist, the source (form, chat reply, checkout, import with the original source), the date, and the wording shown. VGraple CRM stores these on the contact and sets them automatically from inbound messages, keyword replies, forms, widgets, ads and imports; broadcast eligibility checks marketing consent separately from service consent, and the record is exportable when a regulator or Meta asks.
Honouring opt-out
STOP, UNSUBSCRIBE and their language variants must stop marketing immediately; Meta's newer app-level opt-out (a user telling WhatsApp to stop marketing from your business without messaging you) arrives as a webhook and must be honoured the same way. Utility messages about the person's own transactions may continue. Every marketing template should carry an opt-out instruction or a STOP quick reply; templates without one draw more blocks. VGraple CRM applies both opt-out paths automatically, cancels active sequences, and records the source.
A consent checklist for launch day
Before the first marketing broadcast: every recipient has marketing consent recorded with source and date; the template carries an opt-out line or STOP button; quiet hours are set; the list excludes anyone who opted out on any channel; and the first send goes to the most engaged segment so the quality rating starts green.
Old lists and imports
A list collected before you used WhatsApp, or on another platform, is only as good as its consent record. Import it with the source and date, send a utility-style confirmation ("You asked to hear from us on WhatsApp; reply STOP any time") to contacts whose consent is documented, and run a consent campaign (a single message asking for YES) for contacts whose consent is not. Never import a purchased list; it fails every test and burns the number.
Consent and cost
Consent is also economics: consenting contacts read and reply more, which raises engagement, lowers blocks, keeps the quality rating green and reduces how often you hit Meta's per-user cap. The cheapest WhatsApp marketing is to people who asked for it. The bulk messaging guide and the opt-in help article cover the mechanics in VGraple CRM.