WhatsApp Opt-In: How to Collect Consent for Outbound Messages

WhatsApp Opt-In: How to Collect Consent for Outbound Messages

To collect WhatsApp opt-in, ask for clear permission before the first outbound message, at a touchpoint you control (website, form, counter or conversation). The request should name your company and say the person will receive messages on WhatsApp. Then keep proof (who, when, where and which text was shown) and offer a simple way out, honoring every opt-out request.

Key takeaways

• An outbound message is one your company starts outside a conversation the customer opened, and Meta's policy asks for prior permission for it.
• You can collect opt-in through several channels, but the text must identify your company and make clear the contact agrees to receive messages on WhatsApp.
• Without a record, the permission does not hold up: keep the date, source, text shown and a contact identifier.
• Opting out must be easy and take effect immediately, on whichever channel the customer uses to ask.
• Meta's opt-in and the LGPD legal basis are different layers. Meeting one does not replace the other.

What is WhatsApp opt-in and why does Meta require it?

Opt-in is the permission a person gives to receive messages from your company on a specific channel. On WhatsApp Business, Meta's messaging policy treats it as a condition for contacting people on your company's initiative. In practical terms: if the customer did not write first, you need their permission before sending a message template.

It helps to separate three situations:

• Conversation started by the customer: they write, you reply within the customer service window. Their message is the context, so there is no outbound message.
• Outbound message inside the window: you are still within the time allowed since the customer's last message, but you should keep the topic consistent with what they asked about.
• Outbound message outside the window: this requires an approved template and a valid opt-in. It is the focus of this article.

Meta acts on quality signals and reports. When many recipients block or report a number, its quality rating drops and sending limits may be reduced. That makes opt-in an operational safeguard as well. To understand the risk on the number side, read how to avoid a ban when using an AI agent.

A note on sources: platform rules change. Treat this article as a method guide and check the current WhatsApp Business commerce policy before you finalize your flow. For the types of messages and templates, see our piece on WhatsApp outbound messages, templates and opt-in.

Where to ask for opt-in: website, form, counter or chat?

Meta's policy does not force a single collection channel. What matters is that the request is clear and that you can prove it later. Use this decision guide to choose your collection point.

• Website or landing page: works well when the person is already asking for something (a quote, a download, a booking). Use a dedicated WhatsApp checkbox, unchecked by default, next to the phone field.
• Signup or checkout form: suits order, delivery and after-sales notices. Keep the transactional notice separate from promotions, with distinct permissions.
• Counter or in-person service: works with a paper form, a tablet or a QR code that opens a form. Record who collected it and on which date.
• Phone call or voice service: possible, but the agent must read the standard text and log the answer in the system on the spot.
• Conversation on WhatsApp itself: when the customer writes first, you can ask whether they want future notices there. Their answer stays in the conversation and should be exported to your own record.
• Email or SMS: acceptable to invite someone to activate WhatsApp, as long as the invitation text follows the same rules and the confirmation is recorded.

Selection rule: favor the channel where the person is already interacting with intent, and where you can capture the exact text shown and the time. Avoid buying or receiving lists from third parties: you cannot prove the permission, and the risk of reports is high.

How to write the permission request

The wording of the request is where most companies fail. A good text is short, specific and honest about what will come. Content checklist:

• The company name, written in full.
• An explicit sentence saying the person agrees to receive messages on WhatsApp.
• The type of message: order updates, appointment reminders, news, offers.
• Approximate frequency, when it makes sense, without promising what you will not deliver.
• How to leave: for example, replying with an agreed word or using a button.
• A link to the privacy policy, stating what the phone number is used for.

Example text for a form:

I want to receive updates about my order and news from Company X on WhatsApp. I can leave at any time by replying STOP.

What to avoid: a pre-checked box, permission buried in long terms of use, generic wording such as "I agree to receive communications" that never mentions WhatsApp, and a single box that bundles support, marketing and sharing with partners.

On LGPD: when a company relies on consent as its legal basis, the law defines it as a free, informed and unambiguous statement for a specific purpose, and says it can be revoked at any time. Some messages, such as a delivery notice for an order already placed, may rest on another legal basis, such as performance of a contract. That decision is a legal one and should be validated by whoever is accountable for data protection in your company. The ANPD, Brazil's data protection authority, publishes the official guidance on the subject. Even in those cases, Meta's policy still asks for permission to send outbound messages on the channel.

How to record proof of opt-in

Permission without a record is just an opinion. If there is a report, an internal audit or a request from the data subject, you need to show what happened. Keep at least:

• Contact identifier and phone number in international format.
• Date and time of the permission, with time zone.
• Channel and collection point (for example, the quote page form, the store counter, the conversation).
• The exact text shown at that moment, or its version (keep a version history of the text).
• Scope: which types of message were authorized.
• Technical evidence: the form submission log, a capture of the conversation or a scanned signed sheet.
• Who collected it, when it was done in person.
• Current status: active, revoked, pending confirmation.

Store the proof in the system that is already the source of truth for the customer, such as your CRM or support database, not in loose spreadsheets. If you use automations to send messages, make the sending rule check that status before every dispatch. In a flow built with n8n and the official WhatsApp API, this is a verification step before the send node, and any block should log the reason.

Think about retention too: keep the proof for as long as you need to defend the sending, and delete what you no longer need, in line with your company's privacy policy.

How to handle an opt-out

Meta's policy expects people to be able to stop receiving messages easily, and LGPD provides for revoking consent through a free and simple procedure. In practice, treat opt-out as a first-class event.

Good practices:

• Accept several ways to ask: words such as STOP, QUIT or CANCEL, a button in the template, and a free-text request phrased some other way.
• Update the status immediately and halt pending campaigns and queues for that contact.
• Confirm with one short message, inside the customer service window, saying the person will no longer receive outbound messages and how to come back.
• Propagate the opt-out to every system: CRM, sending tool, AI agent and team spreadsheets.
• Treat blocks and reports as a strong signal that the person no longer wants contact, even without a formal request. Review the list and the content that caused the friction.
• Separate full opt-out from partial opt-out: a customer may want to leave the offers and keep order notices. The scope record exists for this.

If an AI agent handles the channel, include in its instructions how to recognize exit requests and the right action, with a handoff to a person when the message is ambiguous. The logic for those instructions is covered in how to write instructions for an AI support agent.

Step-by-step plan to roll out opt-in

The method we use in automation projects follows four moves: map, limit, pilot and hand over. Applied to opt-in, it looks like this.

• Map: list every point where your company already receives a customer's phone number and every outbound message it sends or wants to send. Mark which ones already have some form of permission and which do not.
• Limit: choose the message categories that make sense and drop the rest. Start with notices tied to something the customer asked for. Also define who can trigger sends and at what volume.
• Pilot: deploy the opt-in request at a single collection point, with the final text and the full record. Send to a small group and track replies, blocks and opt-out requests. Agree beforehand on what signal shows the pilot worked, for example no complaints and a complete record for every contact.
• Hand over: document the flow, give the team the standard text and the opt-out rule, and decide whether to expand to other points, adjust or stop.

Illustrative scenario: an aesthetics clinic receives appointment requests through its website and serves people at the front desk. On the website form, it adds an unchecked box: "I want to receive appointment reminders from Example Clinic on WhatsApp." At the desk, reception reads the same sentence and logs the answer in the system with the date and the name of whoever collected it. Return-visit offers sit behind a second, separate box. The reminder only goes out if the first box is active, and the offer only goes out if the second is. When a patient replies "STOP", the system blocks both types and confirms the exit. This is an invented example to show the logic, not a client result.

If your number is still being set up, also confirm the Meta Business verification step, because it affects sending limits and sender credibility.

Common mistakes when collecting opt-in

• Treating a phone number filled in on a quote request as permission for any future communication.
• Using an old list without knowing where it came from or what was promised at the time.
• Hiding the opt-out option or requiring the person to call to cancel.
• Mixing support, billing and promotion in a single consent.
• Not saving the version of the text shown, which makes it impossible to prove what the customer accepted.
• Sending the template before the record is saved, because of an asynchronous integration.
• Letting the AI agent or the sales team send outside the central rule.

A simple test before any campaign: pick ten contacts at random and ask the team to prove, within a few minutes, when and how each one gave permission. If they cannot, the process is not ready. For a broader view of deploying the channel, see how to integrate AI into your company's WhatsApp.

Frequently asked questions

Do I need opt-in to reply to a customer who wrote to me first?

Generally not, when you reply within the customer service window opened by their message, since they started the conversation. Opt-in becomes necessary when your company wants to start contact outside that window with a template. If you want to keep in touch afterward, use the conversation to ask for permission explicitly.

Can I use the phone numbers I already have in my customer database?

Only if you can show that the person agreed to receive WhatsApp messages from your company, with clear text at the time of collection. A phone number registered to issue an invoice or arrange a delivery does not prove that permission. When in doubt, ask for confirmation through a channel you control before sending the first outbound message.

Is a checkbox on my website enough as proof?

It is a good starting point if it is unchecked by default, has specific text, and comes with a record of date, time, text version and source. The checkbox alone, without a stored record, does not help when you need to show what happened. Pair it with a log in your CRM or support database.

What should I do when a customer revokes permission but is still my customer?

Stop outbound messages according to the scope they declined, record the date of the opt-out and confirm the exit. The commercial relationship continues, and they can still use the channel to write to you and get replies. If they ask to come back, treat it as a new opt-in, with a new record.

Sources

• WhatsApp Business: política de mensagens comerciais
• WhatsApp Business Platform: documentação para desenvolvedores
• ANPD: Autoridade Nacional de Proteção de Dados