WhatsApp Opt-In: What Counts as Consent and How to Log Proof of It

What does Meta require for WhatsApp opt-in?

Rule. Meta's opt-in page sets four conditions. The opt-in must clearly state that the person is opting in to receive communication from your business. It must clearly name the business they are agreeing to hear from. You must have the person's mobile number. And you must comply with applicable law, including any notices or permissions the law requires. The page says the opt-in can be general and does not have to mention WhatsApp.

Rule. It lists examples of where an opt-in can be collected: SMS, a website, a phone call through an interactive voice response flow, and in person or on paper, such as a signed document. The WhatsApp Business Messaging Policy (last updated 23 September 2026 on the page) puts the same duty in one line: you may contact people only if you have received opt-in permission from the recipient. It adds that you are solely responsible for your opt-in method and for complying with applicable law.

Three things the opt-in page does not say. It does not use the word "explicit". It does not describe any record you must keep. And it does not mention the 24-hour window. Anyone who tells you Meta requires a specific log format, or "double opt-in", is describing their own practice.

Does a customer messaging you first count as opt-in?

Rule. The policy says that inside the 24-hour customer service window you may reply without a template, and that outside it only approved templates may be sent. A person writing to you therefore opens a window for replies.

Practice. We treat that as permission to answer their enquiry, not permission to send them promotions later. The opt-in page asks for an opt-in that clearly states the person is agreeing to receive communication from your business, and a first message from a customer does not say that. If you want to message someone after the window closes, ask for the opt-in in the conversation while it is open, and log the answer. Our post on the 24-hour window explains why the window matters.

Can you add numbers from a bought list?

On Meta's wording, no, and this follows from the rule rather than being a separate one. A list seller's consent cannot name your business, and the opt-in has to name the business the person agrees to hear from. For the law on bought lists, see our post on whether buying an email list is legal, which covers the same logic for email.

How does UAE PDPL consent sit on top of Meta's rule?

Meta's rule is a platform condition. The law is separate. The UAE government's data protection page says the Personal Data Protection Law (Federal Decree-Law 45 of 2021) prohibits processing personal data without the data owner's consent, subject to exceptions, and that it came into force on 2 January 2022. A mobile number tied to a named lead is personal data in an ordinary reading, so your log is also your record that you had consent to process it. The UAE portal page does not describe the consent standard, so for what the law requires of the wording, read our post on PDPL consent, and ask counsel.

We have not read TDRA's policy on unsolicited electronic communications for this page, so we do not say whether it covers WhatsApp messages. Our UAE telemarketing rules reference covers the calling rules we have read.

The UK is the same shape. PECR regulation 22 requires prior consent for unsolicited direct marketing by electronic mail, with a narrow soft opt-in for existing customers, and regulation 2 defines electronic mail as any text, voice, sound or image message sent over a public electronic communications network. That is broad, but the ICO's guidance, which would say whether WhatsApp falls inside it, blocked our scripted fetch, so we do not claim it does.

What should a WhatsApp opt-in log contain?

Practice. Meta gives no log format. This is the row we would want if a regulator, a platform review or the person themselves asked how you got their number.

What should the opt-in wording say?

Below is wording written to meet the four conditions above. It is our drafting, not text approved by Meta, and you should adapt it to your business and have it reviewed.

[ ] Yes, [Business name] can send me WhatsApp messages about my enquiry, such as replies and appointment reminders.
[ ] Yes, [Business name] can also send me offers on WhatsApp. I can reply STOP at any time.

Two separate boxes follow the policy's best practice of separate opt-ins for each message category. Leave both unticked by default. Treat a ticked-for-you box as no opt-in at all, because nothing shows the person chose. That last point is our practice.

Is double opt-in needed for WhatsApp?

Not on the pages we read. Practice: double opt-in, where the person confirms a second time, costs one extra step and gives you stronger proof, so it is worth it for marketing consent captured on a web form, where anyone can type someone else's number. For a person who tells your rep in person that they want WhatsApp updates, a logged single opt-in is usually enough. In both cases the confirming message itself must be allowed by the opt-in you already hold.

How do you handle a WhatsApp opt-out?

Rule. The policy says you must respect requests to block, stop or opt out, including removing the person from your contacts, and recommends clear opt-out instructions. Practice: store the withdrawal against the same number the day it arrives, and check the opt-in log before every campaign send rather than trusting an exported list. Our broadcast limits post shows what happens to quality and limits when people report you instead.

How does MAJ Leads use WhatsApp, and what does it log?

Once a company's own WhatsApp Business number is connected, MAJ Leads sends an opt-in acknowledgement to a lead who arrives after hours, and it records where each lead came from and when it arrived. We do not claim that every opt-in field in the table above is stored automatically. Check what your own forms capture, and see how it works for how leads and follow-up are recorded today.