WhatsApp Opt-In: Collect Consent You Can Prove

The first time a client asked me "can you show me where this person agreed to receive our messages?", the honest answer was no. The numbers were in the CRM, the messages were going out, and nobody could point to the moment consent was given. That is the normal state of most WhatsApp setups, and it is the thing that breaks the day someone complains.

Opt-in is not paperwork. On WhatsApp it decides whether your templates get approved, whether your sends stay legal, and whether you can grow a list without it turning into a liability.

What opt-in actually means on WhatsApp

You can only message someone on the WhatsApp Business Platform if they gave you their number and agreed to hear from you. Meta requires that agreement before the first business-initiated message, and it asks you to be able to produce evidence of it if challenged.

For marketing templates the bar is higher than for service messages. A customer who gave you a number to get a delivery update has not agreed to receive offers, and Meta's guidance treats those as separate permissions. If your opt-in only says "we may contact you", it does not cover a promotional broadcast.

Two things WhatsApp does not do for you: it does not store your consent records, and it does not run a global suppression list that stops messages to people who said stop. Both are yours to build. The opt-out half is covered further down, and the volume side is in how WhatsApp messaging limits actually work.

Where to ask, ranked by how well it holds up

Not all opt-in is equal. Ranked by how defensible it is when someone asks:

The inbound case is worth dwelling on. If someone messages your business number asking about a price, the number is verified by WhatsApp itself and the intent is in the message. Asking "shall I send you updates here?" in that same thread produces the cleanest opt-in you will ever get, and it costs one line of text. Most businesses skip it because they are busy answering the question, then spend months wondering where their list came from.

The four fields that make consent stand up

A consent record that cannot answer "when, where, and to what" is not a record. Whatever system you use, a spreadsheet is fine to start, store these four:

• Number, in full international format, the exact one consented.
• Timestamp, to the minute, not the month.
• Source, the specific surface: the checkout page, the counter, the inbound chat.
• Wording, the exact sentence the person agreed to, copied verbatim.

The wording field is the one everyone drops, and it is the one that settles arguments. "They ticked a box" means nothing if you cannot show what the box said. Copy the sentence into the row when you build the form, and update the row when the sentence changes.

Pre-ticked boxes and buried consent

Two patterns account for most of the trouble I see.

The pre-ticked box. A checkbox that is already on, next to a link to the terms, is not consent in any jurisdiction I know of. It is also a conversion trick that works once and then produces a list full of people who never meant to join. Leave the box empty, keep the label short and specific, and accept the slightly lower tick rate.

Consent buried in the terms. "By creating an account you agree to receive communications" is not opt-in for marketing on WhatsApp. If you want to send offers, ask for offers, separately, in a place someone can actually see.

There is a third, quieter failure: the opt-in exists but it lands in a different system than the one that sends. The form writes to a sheet, the sender reads the CRM, and nobody notices the two never spoke until the first complaint. Decide early which system owns consent and make it the only one.

The opt-out is the other half of the job

Opt-out is where consent systems usually fail, because it is invisible until it is expensive. If a customer replies STOP and your automation keeps sending, you have broken the agreement and taught the customer that the stop word does not work.

The fix is placement, not effort. Check suppression before the template is sent, before the automation fires, before the campaign is queued. One check at the last possible moment covers every path into your sender, including the ones you will add next quarter. Building it into each flow separately guarantees the next flow forgets.

I go through the mechanics, including what to reply when someone says STOP, in the guide on what actually happens when a customer replies STOP.

One thing not to do: do not delete the contact or the chat as a way of "handling" an opt-out. Deleting the history removes the evidence that they asked, which is the opposite of what you want if the request is ever questioned. Mark them suppressed and keep the record.

A minimum setup for a small team

You do not need a compliance department. You need four things in one place:

1. One consent field per channel, never pre-ticked, with the wording saved alongside it.
2. One log with the four fields above, written at the moment of consent.
3. One suppression list checked at send time, updated by STOP and by any manual request.
4. One weekly look at who opted out and which flow they came from, because a spike tells you something in the copy or the frequency is wrong.

That is maybe a day of setup. It is also the difference between a list you can grow confidently and one you are slightly afraid of.

Where this sits inside a tool

If you would rather not maintain that in a spreadsheet, the consent record belongs inside the same system that sends the messages, so the send can see the permission. That is how we built BNex: contacts, templates, inbox and automation on one WhatsApp Business Platform account, so the opt-in and the send are never in two different places.

Whether you use a tool or a sheet, the order is the same. Collect consent where the person actually is, store what they agreed to, check it before you send. Everything else is detail.

If you want a second opinion on how your current opt-in would read to someone auditing it, send me the exact wording on WhatsApp and I will tell you what is missing: message me here.

Related Reading