Blog / Guide

WhatsApp opt-in: how to collect consent in a compliant way

On WhatsApp an unsolicited message doesn’t land in a folder no one opens: it arrives in the same place where the person hears from their kids and friends. That’s why the opt-in — explicit permission to write to them — isn’t a legal technicality but the foundation of the entire channel. Collecting it well means building a list that opens, reads, and replies; collecting it badly, or skipping it, means spam reports, blocks, and a number that loses quality. This guide explains where to collect it, how to write the consent text, and how to handle those who want out.

What a WhatsApp opt-in is

An opt-in is the action by which a person agrees to receive communications from you on WhatsApp: ticking a box, writing to a number first, scanning a QR, leaving their number in a form knowing what it’s for. It’s not a formality: it’s the line between an expected conversation and an intrusion. Meta requires it in its terms of use, and the GDPR mandates it as freely given, specific, informed, and unambiguous consent. In practice this means the person must understand who will write to them, why, and how often, and must be able to change their mind.

It’s useful to distinguish two levels. There’s the transactional opt-in, tied to a service the person requested — an order confirmation, an appointment reminder. And there’s the promotional opt-in, for offers, news, and campaigns. They’re different permissions: someone who gave you their number to get a shipping confirmation hasn’t authorized you to send them the sales. Keeping the two consents separate isn’t pedantry, it’s what protects you.

Why the opt-in matters more than it seems

A clean opt-in feeds a list that converts, because someone who asked to hear from you is already inclined to listen. But there’s also a direct technical effect: WhatsApp measures the quality of your number based on how recipients react. If many people block or report your messages, the number’s rating drops and Meta limits how many conversations you can start per day; in the worst cases the number is suspended. Contacts collected without consent are precisely the ones who block first. The opt-in, then, isn’t just an obligation toward the person: it’s the maintenance of your ability to write.

Where to collect it: the touchpoints you already have

You don’t need to invent a new funnel. The best moments to ask for the opt-in are the ones when the person is already in a relationship with you. Spread them out instead of betting everything on a single channel: each audience comes through a different door.

• Website: an opt-in field in the contact form or the newsletter, with a dedicated, un-pre-ticked WhatsApp box, and a visible wa.me link on product and contact pages.
• In-store QR code: at the checkout, in the window, on the receipt, or on the table. Whoever scans and writes first expresses a clear and unambiguous opt-in.
• Checkout and order forms: a box next to the phone number — “I want to receive updates and offers on WhatsApp” — separate from accepting the terms of sale.
• Social profiles and content: the “Send Message” button that leads into the chat, the link in bio, the click-to-WhatsApp campaigns that open a conversation directly.
• Email and signature: an invitation to switch to WhatsApp for those who prefer fast replies, with a direct link to the chat.

The rule common to all these points: consent to WhatsApp must be a standalone action, not a side effect of another tick. A single box that mixes “I accept the terms and I want WhatsApp messages” is not valid consent.

How to write the opt-in text

The wording makes the difference between solid consent and a contestable one. Three elements can’t be missing: who will send the messages (the company name), what the person will receive (offers, news, reminders), and roughly how often. Always add how to opt out and the link to the privacy policy. A lean example: “By subscribing you’ll receive from [Company] offers and news on WhatsApp, a few messages a month. You can cancel anytime by writing STOP. Privacy policy: [link].” Avoid vague text like “stay updated”: it doesn’t say what you’re authorizing and won’t hold up to scrutiny.

With SendApp you can start from the number you already use by connecting it via QR code, or move up to Meta’s official API when volumes grow — without changing platform and with no markups on the cost of messages. In both cases the opt-in remains the foundation: the platform imports contacts with their consent tags and handles opt-out automatically.

Recording consent: the proof that protects you

Collecting the opt-in isn’t enough: you must be able to prove you obtained it. For each contact, keep proof of consent — when it was given, from where (in-store QR, website form, checkout), and for what purpose. In a complaint or an audit, this traceability is the difference between a defensible position and a fine. A CRM built for WhatsApp tags every contact with the origin and date of consent, so you don’t have to reconstruct anything by hand.

Handling opt-out: leaving must be as easy as joining

Consent is revocable, always. Whoever writes STOP, or uses the cancel button, must stop receiving promotional messages right away and without friction. Making it hard to leave is counterproductive on two fronts: it violates the GDPR and pushes the person to block or report you, damaging the number’s quality. Correct handling is automatic: the opt-out updates the contact’s status and excludes them from future campaigns, keeping only service messages if the person still authorizes them. Always reply with a short confirmation: “Unsubscribed, you won’t receive offers anymore. We’re here for support.”

Best practices for an opt-in that lasts

• Ask for WhatsApp consent with a separate action, never buried in another tick or in the terms of sale.
• Keep promotional and transactional consent distinct: they’re different permissions and should be treated as such.
• Don’t buy and don’t import lists of cold numbers: they generate blocks and sink the quality of your number.
• Record the origin and date of every consent, so the proof is ready if asked for.
• Honor opt-out in real time and confirm the exit with a short, courteous message.
• Respect the frequency you stated: if you promised “a few messages a month,” don’t send one a day.