WhatsApp opt-in rules: consent that keeps your broadcasts landing

Every WhatsApp broadcast that performs well sits on something less visible than the message: a list of people who agreed to be on it. Meta's rule is short — a business may start a conversation only with customers who opted in — but what counts as opt-in, how to collect it without grinding your funnel, and what happens when you cut corners are where campaigns are actually won and lost.

This is the working guide we wish every new WhatsApp Business API sender had on day one.

The rule, and the enforcement behind it

Before your business sends a customer a template message — a campaign, an update, anything you initiate — that customer must have agreed to receive messages from you on WhatsApp. The agreement has to be a real action a person took, attributable to that phone number.

What makes this rule different from a policy document is that recipients enforce it themselves. Every WhatsApp message arrives with block and report a thumb-tap away, and Meta watches those signals per business. Send to people who didn't ask, and enough of them will report you to drag down your quality rating — which in turn lowers how many business-initiated conversations you're allowed to open. Keep doing it and templates get paused or the account restricted.

So opt-in isn't compliance theatre. It is, mechanically, the thing that decides whether your broadcasts keep going out.

What counts as a real opt-in

The standard is simple to state: the customer took a clear action, knew they were agreeing to hear from you on WhatsApp, and you can say when and where it happened. The formats Indian businesses use most:

• A checkbox at checkout or signup — "Send my order updates and offers on WhatsApp" — left for the customer to tick, not pre-ticked on their behalf.
• A keyword or QR code — "WhatsApp HI to join" on packaging, posters, or a bill; scanning or sending the word is the consent act, recorded automatically with the number attached.
• A missed call — the customer gives a missed call to a published number and the confirmation arrives on WhatsApp. It costs the customer nothing and works on any phone, which is why missed call campaigns remain one of the best list-builders in the Indian market.
• An IVR keypress — "press 2 to get updates on WhatsApp" during a support or service call.
• A paper or in-store form — valid as long as the WhatsApp choice is explicit and the record survives.
• Inside a conversation — when a customer messages you first, asking "shall we send your updates here?" and getting a yes is the cleanest consent there is.

The common thread: the customer acted, the channel was named, and a record exists.

What doesn't count

The failure patterns are just as consistent:

• Purchased or scraped lists. The people on them never agreed to hear from you, and they will report you at rates that damage the account fast. There is no campaign result worth that trade.
• "They're our customer, so it's implied." A transaction is not consent to marketing. The customer who bought from you once did not thereby invite a festival campaign every month.
• Consent for one channel stretched to another. An SMS opt-in from years ago is not a WhatsApp opt-in. Name the channel when you ask.
• Pre-ticked boxes and buried clauses. Consent a customer didn't notice giving produces the same blocks and reports as no consent at all — because from the customer's side, it is the same.

A useful test for any collection method: would the customer be surprised to get your message? Surprise is what block buttons are for.

Keep records like you'll need them

For every number on your list, store how the opt-in happened, where, and when — checkout checkbox on this date, keyword join from this campaign, missed call to this number. You'll want it if a complaint is ever escalated, and you'll use it long before that: consent source is one of the most predictive segments you have. People who joined via a keyword campaign behave differently from people who ticked a box at checkout, and sending accordingly lifts results on both.

Opt-out is half the system

Every list needs a working exit. Honour "STOP" and its plain-language cousins immediately and across all campaigns, make the unsubscribe path visible rather than buried, and treat rising opt-outs as feedback about frequency or relevance rather than churn to be replaced. A customer who opts out quietly is a far better outcome than one who blocks — the first trims your list; the second teaches Meta to trust you less.

Frequency expectations belong at the moment of opt-in: "order updates plus two or three offers a month" recruits a list that doesn't flinch when you use it.

The quality flywheel

Put the pieces together and you get the dynamic that makes consent commercially interesting rather than merely required. A genuinely opted-in list blocks and reports less. Low complaint rates keep your quality rating high. A high rating sustains and raises your conversation limits. Higher limits mean your WhatsApp broadcasts reach the full list, reliably, during the weeks that matter most.

The flywheel spins the other way too, and faster: one large send to a cold list can spike reports, cut your rating, and shrink the sends you're allowed next week — usually the week before a sale. List quality, not list size, is the asset.

Building the list without buying it

The list grows wherever customers already touch you, if each touchpoint asks:

• The order-confirmation page and the checkout flow.
• Packaging, invoices, and delivery notes carrying the QR or keyword.
• The support call's closing question, or the IVR menu.
• The shop counter, with a missed-call number on the board.
• Ad campaigns that land on a join action rather than a form.

Give a concrete reason — order tracking, appointment reminders, early access — and the join rate takes care of itself. Then make the first message after opt-in count, because it sets the tone for everything that follows. (Your welcome and update messages are templates reviewed in advance; the template guide covers the formats.)

Auditing the list you already have

Most businesses don't start from zero — they start from a spreadsheet of numbers collected over years, with consent quality ranging from explicit to imaginary. Before that list meets the API, triage it honestly: numbers with a recorded, channel-specific opt-in can be messaged; recent customers without one should be asked first, through a channel you do have consent for; and the old, cold remainder is better re-recruited through a join campaign than messaged on hope. Sending a re-permission broadcast to the whole legacy list defeats the purpose — that send is itself the unsolicited message the rules exist to prevent. The slower path costs a few weeks and produces a list that performs; the shortcut costs the account's standing and produces a list that's burnt.

The short version

WhatsApp lets you message people who asked to hear from you, and it measures whether they meant it. Real opt-in is an explicit, recorded, channel-specific action — checkbox, keyword, missed call, keypress — and everything weaker eventually shows up as blocks, a falling quality rating, and shrinking reach. Collect consent at every customer touchpoint, name the channel and the frequency, keep the records, honour the exits, and the reward is the thing every sender actually wants: a list that opens, reads, and buys, campaign after campaign.