WhatsApp Business API Opt-In Policy: Rules and Wording

You have 40,000 customer phone numbers from years of orders, a new WhatsApp Business Platform account and a template approved this morning. The question every growth team asks next: are we allowed to message them? The WhatsApp Business API opt-in policy answers it, and the answer depends less on WhatsApp than on what you told those customers when you collected their numbers.

Meta's rules are shorter than most people expect, and looser in one way since late 2024. But they put all the responsibility on you: Meta decides whether you broke them, using signals like blocks and reports, and you need records to show you didn't.

This guide covers what the policy requires, examples of valid and invalid opt-in, wording you can adapt, what proof to keep and how to handle opt-outs properly.

What the policy actually requires

The WhatsApp Business Messaging Policy (last updated September 23, 2026) sets two conditions. You may only contact people on WhatsApp if:

1. they have given you their mobile phone number or username, and
2. you have received opt-in permission from them confirming they wish to receive subsequent messages or calls from you.

Meta's opt-in guide adds three requirements for how you collect it:

• Clearly state that the person is opting in to receive communication from the business.
• Clearly state the business's name.
• Comply with applicable law.

Since the November 2024 policy update, the opt-in can be general rather than WhatsApp-specific, as long as you comply with local laws. Meta lists SMS, websites, phone calls with an IVR flow and in-person or paper sign-ups as supported methods, and says the choice of method, and its legality, is solely your responsibility.

Note what is not in the policy: having someone's number is not permission. Condition one without condition two doesn't count.

What counts and what doesn't

Examples for a fictional homeware brand, Brightleaf Home:

Local law can be stricter than Meta. In the EU, for example, pre-ticked boxes don't count as consent. Our guide to WhatsApp API data privacy covers GDPR and India's DPDP Act at a high level.

Wording that works

Good opt-in copy answers four questions: who will message, about what, on which channel and how to stop. Separate categories where you can. Meta's own best practices suggest opt-in per message category, because people block businesses that send them things they didn't sign up for.

Adaptable examples, shown as plain text:

Checkout, first box (unticked by default): "Send me order and delivery updates from Brightleaf Home on WhatsApp."

Checkout, second box (unticked by default): "Also send me offers and new arrivals from Brightleaf Home on WhatsApp, at most once a week. I can stop anytime by replying STOP."

Lead form: "By submitting, you agree that Brightleaf Home can message you on WhatsApp about this enquiry. Reply STOP to opt out."

IVR script: "To get delivery updates from Brightleaf Home on WhatsApp, press 1. You can opt out anytime by replying STOP."

Paper form: a printed line with the business name, the update types and a signature box, plus how to opt out.

Avoid vague promises ("stay in touch"), hidden consent inside terms and conditions, and frequency you won't honour. If the copy would surprise a customer when they read it back later, rewrite it.

Storing proof

Meta says it may reactively evaluate a business's opt-in flows, including by reviewing user feedback, and an appeal after enforcement goes better with evidence. Keep one consent record per contact, per category:

{
  "contact": { "phone_e164": "+919811122233", "bsuid": "IN.4419082715530912" },
  "business_name_shown": "Brightleaf Home",
  "categories": ["utility", "marketing"],
  "source": "web_checkout",
  "source_url": "https://brightleaf.example/checkout",
  "wording_version": "checkout-v3",
  "wording_text": "Also send me offers and new arrivals from Brightleaf Home on WhatsApp...",
  "captured_at": "2026-10-12T09:41:07Z",
  "ip": "203.0.113.24",
  "user_agent": "Mozilla/5.0 ...",
  "status": "active",
  "opted_out_at": null,
  "opt_out_source": null
}

Three habits make this work. Version your wording and keep every version, so you can show exactly what someone agreed to in 2025. Store the BSUID alongside the phone number, since usernames mean the number may not always arrive in webhooks (see WhatsApp BSUIDs and usernames). And log opt-outs in the same record rather than deleting it, so you can prove you stopped. How long to keep these records is a legal question for your jurisdiction.

Handling opt-outs

The policy is strict here: you must respect all requests, on or off WhatsApp, to block, discontinue or otherwise opt out of communications, including removing the person from your contacts list. An email saying "stop messaging me" counts as much as a reply in the chat.

Build four mechanisms:

1. Keyword handling. Treat STOP, UNSUBSCRIBE and local-language equivalents as opt-outs, plus plain phrases like "don't message me again". Confirm once, then stop.
2. WhatsApp's own marketing control. Users can stop marketing messages from a business inside WhatsApp. Meta sends a user_preferences webhook with value set to stop (or resume), and marketing templates to that user fail with error 131050. Don't retry those.
3. Category-level choices. Someone who opts out of offers may still want delivery updates. Meta recommends clear instructions for opting out of specific categories, and honouring them.
4. A suppression check at send time. Check consent status in the send path itself, not only when building the list. Lists go stale; send-time checks don't.

def on_user_preferences(change: dict, db) -> None:
    for pref in change["value"].get("user_preferences", []):
        if pref.get("category") != "marketing_messages":
            continue
        contact = pref.get("user_id") or pref.get("wa_id")
        if pref["value"] == "stop":
            db.set_consent(contact, "marketing", status="opted_out", source="whatsapp_control")
        elif pref["value"] == "resume":
            db.set_consent(contact, "marketing", status="active", source="whatsapp_control")

def can_send(db, contact: str, category: str) -> bool:
    record = db.get_consent(contact, category)
    return record is not None and record.status == "active"

Opt-outs are also an early warning. A spike after one campaign tells you that audience or message was wrong, before the WhatsApp quality rating drops. Meta specifically advises watching quality when you roll out a new opt-in method.

Opt-in rules versus building a list

This page is about what Meta requires. Growing a list of people who want your messages (QR codes, click-to-chat links, incentives, checkout placement) is a separate job, covered in our guide to building a WhatsApp opt-in list. Once you have consent, the next steps are writing templates people welcome, covered in WhatsApp message templates, and the complete guide to the WhatsApp API for everything else.

Where Tenashi fits

Consent isn't only an API rule. On any WhatsApp number, messages people didn't ask for lead to blocks and reports, and WhatsApp bans numbers that collect too many. Tenashi runs on the number you already use, linked by QR scan rather than Meta's official API, so there are no templates to approve, but the courtesy rules are the same.

What Tenashi gives you is the place to keep it straight: a shared inbox where every chat has a CRM record with custom fields, so you can store where and when someone opted in next to the conversation itself. Broadcasts (on Growth and Scale) are paced and personalised, and the same exact text sent to 5 chats within 10 minutes is paused. Tenashi doesn't verify consent for you, and ban protection reduces risk, never guarantees against it. Plans start from $18/mo.

See every feature · Get started

FAQ

Does WhatsApp require opt-in before every message?

Meta requires opt-in before you contact people: they must have given you their number or username and agreed to receive messages from your business. When a customer messages you first, you can reply within the 24-hour window. For marketing later, get explicit permission that names your business and the kind of messages.

Does the opt-in have to mention WhatsApp?

Not since Meta's November 2024 policy update. Opt-in can be general rather than WhatsApp-specific, as long as it names your business, makes clear the person is agreeing to communication and complies with local law. Mentioning WhatsApp is still wise, because customers who expect the channel are less likely to block you.

Can I message customers who gave me their number at checkout?

Only if the checkout told them your business would message them and they agreed. A phone number collected just for delivery isn't permission for marketing. Add a clear, unticked checkbox naming your business and the message types, store the wording they saw, and treat older numbers without that consent as off limits.

How do I prove a customer opted in?

Keep a record per contact and category: the exact wording shown, its version, the business name, where it was collected, a timestamp and supporting evidence such as an IP address, call recording or signed form. Log opt-outs in the same record. Meta can review opt-in flows, and evidence helps any appeal.

What happens when a user stops marketing messages?

Meta sends a user_preferences webhook with the value stop, and marketing templates to that user fail with error 131050. Don't retry. Mark them opted out of marketing in your records, keep sending utility messages they still want, and handle the resume value if they later turn marketing back on.

---

Clear wording, a record of what people agreed to and opt-outs that work are most of the policy. If your team handles customer conversations from one shared number, see how Tenashi's inbox and CRM work.