Article
WhatsApp Opt-In Compliance Requirements: Meta's Rules ...
blueticks.co
Quoted on this wiki
Every place a page here uses this source, in the order the words come in it.
Is the "Flagged" status still a thing? Meta removed the "Flagged" status in late 2025, and a quality-rating drop no longer auto-downgrades your sending limit. But a low (red) quality rating still blocks you from scaling to higher messaging tiers, and sustained low quality will get your sending throttled. “The fix is upstream: clean opt-in, honest frequency, and sending only to people who actually expect to hear from you.” How long should I keep opt-in records? For as long as the contact is active, plus a retention buffer for late complaints. Set the exact period with your legal counsel based on your jurisdiction; many businesses retain consent logs for several years.
In Compliance
What drives my quality rating down? Mainly recipient blocks and "report spam" actions. The fix is upstream: clean opt-in, honest frequency, and sending only to people who actually expect to hear from you. “For as long as the contact is active, plus a retention buffer for late complaints.” Collecting and managing opted-in subscribers in Blueticks
What drives my quality rating down? Mainly recipient blocks and "report spam" actions. The fix is upstream: clean opt-in, honest frequency, and sending only to people who actually expect to hear from you. “Set the exact period with your legal counsel based on your jurisdiction; many businesses retain consent logs for several years.” Collecting and managing opted-in subscribers in Blueticks
Hi! This is Acme Footwear. You asked to get updates from us here. Reply YES to confirm, or ignore this message and we won't message you again. You can reply STOP anytime to unsubscribe. “Notice what each version does: names the business, sets expectations on content and frequency, and states the opt-out.” Collecting per channel: the right mechanic for each, and where each goes wrong
Can I collect WhatsApp opt-in on my website instead of inside WhatsApp? Yes. Opt-in can be collected on any third-party channel — website, app, checkout, in-store, SMS, QR code. It no longer has to happen inside WhatsApp. The requirements (active action, business name, clear statement they'll receive WhatsApp messages from you) stay the same wherever you collect it. “To send promotional broadcasts later you must obtain a separate, explicit marketing opt-in.” Is the "Flagged" status still a thing? Meta removed the "Flagged" status in late 2025, and a quality-rating drop no longer auto-downgrades your sending limit. But a low (red) quality rating still blocks you from scaling to higher messaging tiers, and sustained low quality will get your sending throttled.
Consent buried in a Terms of Service acceptance with no mention of WhatsApp. “A phone number scraped, purchased, or imported from another platform.” Two more requirements sit on top of "active." The opt-in must clearly state the name of the business the person is opting in to hear from, and it must make clear the person is opting in to receive communication from that business. Generic language like "subscribe for updates" without naming you fails this.
To stay healthy: “The policy requires you to respect every request to opt out, block, or discontinue, including removing the person from your contact list.” Keep frequency disciplined. The fastest way to earn blocks is over-messaging. Match the cadence you promised at opt-in.
Meta's opt-in rules are not vague. They're written down, they're specific, and they put the entire burden of proof on you, the sender. This is the compliance and policy angle: not how to build an opt-in form (we cover that in our opt-in collection guide) or which widget to use (see the opt-in widget walkthrough), but what actually makes consent valid in Meta's eyes and what gets numbers flagged. “You may only contact people on WhatsApp if two things are true: they have given you their mobile phone number, and you have received opt-in permission confirming they wish to receive subsequent messages or calls from you.” Read that twice. Meta is not going to validate your consent for you. If a complaint lands, the question is whether you can show the person actively agreed.
“That's rarely the real cause.” Meta's opt-in rules are not vague. They're written down, they're specific, and they put the entire burden of proof on you, the sender. This is the compliance and policy angle: not how to build an opt-in form (we cover that in our opt-in collection guide) or which widget to use (see the opt-in widget walkthrough), but what actually makes consent valid in Meta's eyes and what gets numbers flagged.
“The real cause is sending to people who never gave you clean, provable consent in the first place, then getting blocked and reported by enough of them that Meta's systems throttle you.” Meta's opt-in rules are not vague. They're written down, they're specific, and they put the entire burden of proof on you, the sender. This is the compliance and policy angle: not how to build an opt-in form (we cover that in our opt-in collection guide) or which widget to use (see the opt-in widget walkthrough), but what actually makes consent valid in Meta's eyes and what gets numbers flagged.
Two more requirements sit on top of "active." The opt-in must clearly state the name of the business the person is opting in to hear from, and it must make clear the person is opting in to receive communication from that business. Generic language like "subscribe for updates" without naming you fails this. “What can't change is the substance: active action, your business name, clear statement that they'll get WhatsApp messages from you.” Single vs. double opt-in: what each is, and when double is worth it
Two more requirements sit on top of "active." The opt-in must clearly state the name of the business the person is opting in to hear from, and it must make clear the person is opting in to receive communication from that business. Generic language like "subscribe for updates" without naming you fails this. “You can collect it on any third-party channel — your website, your app, a checkout page, an in-store tablet, an SMS reply, a QR code.” Single vs. double opt-in: what each is, and when double is worth it
If your WhatsApp number gets blocked or your quality rating drops to red, the usual diagnosis is "you sent too many messages." That's rarely the real cause. The real cause is sending to people who never gave you clean, provable consent in the first place, then getting blocked and reported by enough of them that Meta's systems throttle you. “Meta's opt-in rules are not vague. They're written down, they're specific, and they put the entire burden of proof on you, the sender.” The WhatsApp Business Messaging Policy is blunt about the baseline. You may only contact people on WhatsApp if two things are true: they have given you their mobile phone number, and you have received opt-in permission confirming they wish to receive subsequent messages or calls from you. Meta makes you "solely responsible for determining the method of opt-in" and for obtaining it in a way that complies with the laws that apply to your communications.
The WhatsApp Business Messaging Policy is blunt about the baseline. You may only contact people on WhatsApp if two things are true: they have given you their mobile phone number, and you have received opt-in permission confirming they wish to receive subsequent messages or calls from you. Meta makes you "solely responsible for determining the method of opt-in" and for obtaining it in a way that complies with the laws that apply to your communications. “If a complaint lands, the question is whether you can show the person actively agreed.” That word "active" matters. An opt-in has to be an affirmative action the person takes. The following do not count as valid consent:
Single opt-in is one affirmative action. The person ticks a box, taps a button, or sends a keyword, and they're on your list. “Double opt-in adds a confirmation step.” Here's the part to get right, because it's a common myth. Double opt-in is a best practice, not a Meta requirement. Meta's policy requires valid opt-in. It does not mandate a second confirmation step. Double opt-in is also widely treated as the gold standard for GDPR, but even GDPR doesn't strictly require it — it's the cleanest way to prove consent, not a legal mandate.
Single opt-in is one affirmative action. The person ticks a box, taps a button, or sends a keyword, and they're on your list. “After the first action, you send a message asking them to confirm (reply YES, tap a button), and only confirmed contacts get added.” Here's the part to get right, because it's a common myth. Double opt-in is a best practice, not a Meta requirement. Meta's policy requires valid opt-in. It does not mandate a second confirmation step. Double opt-in is also widely treated as the gold standard for GDPR, but even GDPR doesn't strictly require it — it's the cleanest way to prove consent, not a legal mandate.
Double opt-in adds a confirmation step. After the first action, you send a message asking them to confirm (reply YES, tap a button), and only confirmed contacts get added. The classic example: they tick the box on your form, then receive a WhatsApp message saying "Reply YES to confirm you want updates from [Business]." “Double opt-in is a best practice, not a Meta requirement.” So when is double opt-in actually worth the friction it adds?
A pre-checked checkbox the user has to uncheck to decline. “"We already have your number from your order, so we'll message you."” Consent buried in a Terms of Service acceptance with no mention of WhatsApp.
Consent buried in a Terms of Service acceptance with no mention of WhatsApp. “A phone number scraped, purchased, or imported from another platform.” Two more requirements sit on top of "active." The opt-in must clearly state the name of the business the person is opting in to hear from, and it must make clear the person is opting in to receive communication from that business. Generic language like "subscribe for updates" without naming you fails this.
That word "active" matters. An opt-in has to be an affirmative action the person takes. The following do not count as valid consent: “A pre-checked checkbox the user has to uncheck to decline.” "We already have your number from your order, so we'll message you."
"We already have your number from your order, so we'll message you." “Consent buried in a Terms of Service acceptance with no mention of WhatsApp.” A phone number scraped, purchased, or imported from another platform.
A phone number scraped, purchased, or imported from another platform. “Generic language like "subscribe for updates" without naming you fails this.” One point that trips people up: the opt-in does not have to happen inside WhatsApp. You can collect it on any third-party channel — your website, your app, a checkout page, an in-store tablet, an SMS reply, a QR code. Meta dropped the old requirement that opt-in flow through a specific platform. What can't change is the substance: active action, your business name, clear statement that they'll get WhatsApp messages from you.
Quotes are verbatim and belong to their publishers. Where a quote has been translated, the original wording is kept below it.