Article
WhatsApp Opt-In Compliance Requirements: Meta's Rules ...
blueticks.co
Quoted on this wiki
Every place a page here uses this source, in the order the words come in it.
Hi! This is Acme Footwear. You asked to get updates from us here. Reply YES to confirm, or ignore this message and we won't message you again. You can reply STOP anytime to unsubscribe. “Notice what each version does: names the business, sets expectations on content and frequency, and states the opt-out.” Collecting per channel: the right mechanic for each, and where each goes wrong
What drives my quality rating down? Mainly recipient blocks and "report spam" actions. The fix is upstream: clean opt-in, honest frequency, and sending only to people who actually expect to hear from you. “For as long as the contact is active, plus a retention buffer for late complaints.” Collecting and managing opted-in subscribers in Blueticks
What drives my quality rating down? Mainly recipient blocks and "report spam" actions. The fix is upstream: clean opt-in, honest frequency, and sending only to people who actually expect to hear from you. “Set the exact period with your legal counsel based on your jurisdiction; many businesses retain consent logs for several years.” Collecting and managing opted-in subscribers in Blueticks
“That's rarely the real cause.” Meta's opt-in rules are not vague. They're written down, they're specific, and they put the entire burden of proof on you, the sender. This is the compliance and policy angle: not how to build an opt-in form (we cover that in our opt-in collection guide) or which widget to use (see the opt-in widget walkthrough), but what actually makes consent valid in Meta's eyes and what gets numbers flagged.
“The real cause is sending to people who never gave you clean, provable consent in the first place, then getting blocked and reported by enough of them that Meta's systems throttle you.” Meta's opt-in rules are not vague. They're written down, they're specific, and they put the entire burden of proof on you, the sender. This is the compliance and policy angle: not how to build an opt-in form (we cover that in our opt-in collection guide) or which widget to use (see the opt-in widget walkthrough), but what actually makes consent valid in Meta's eyes and what gets numbers flagged.
Read that twice. Meta is not going to validate your consent for you. If a complaint lands, the question is whether you can show the person actively agreed. “An opt-in has to be an affirmative action the person takes.” A pre-checked checkbox the user has to uncheck to decline.
Meta's opt-in rules are not vague. They're written down, they're specific, and they put the entire burden of proof on you, the sender. This is the compliance and policy angle: not how to build an opt-in form (we cover that in our opt-in collection guide) or which widget to use (see the opt-in widget walkthrough), but what actually makes consent valid in Meta's eyes and what gets numbers flagged. “You may only contact people on WhatsApp if two things are true: they have given you their mobile phone number, and you have received opt-in permission confirming they wish to receive subsequent messages or calls from you.” Read that twice. Meta is not going to validate your consent for you. If a complaint lands, the question is whether you can show the person actively agreed.
The WhatsApp Business Messaging Policy is blunt about the baseline. You may only contact people on WhatsApp if two things are true: they have given you their mobile phone number, and you have received opt-in permission confirming they wish to receive subsequent messages or calls from you. Meta makes you "solely responsible for determining the method of opt-in" and for obtaining it in a way that complies with the laws that apply to your communications. “If a complaint lands, the question is whether you can show the person actively agreed.” That word "active" matters. An opt-in has to be an affirmative action the person takes. The following do not count as valid consent:
Meta's opt-in rules are not vague. They're written down, they're specific, and they put the entire burden of proof on you, the sender. This is the compliance and policy angle: not how to build an opt-in form (we cover that in our opt-in collection guide) or which widget to use (see the opt-in widget walkthrough), but what actually makes consent valid in Meta's eyes and what gets numbers flagged. “Meta makes you "solely responsible for determining the method of opt-in" and for obtaining it in a way that complies with the laws that apply to your communications.” Read that twice. Meta is not going to validate your consent for you. If a complaint lands, the question is whether you can show the person actively agreed.
The WhatsApp Business Messaging Policy is blunt about the baseline. You may only contact people on WhatsApp if two things are true: they have given you their mobile phone number, and you have received opt-in permission confirming they wish to receive subsequent messages or calls from you. Meta makes you "solely responsible for determining the method of opt-in" and for obtaining it in a way that complies with the laws that apply to your communications. “Meta is not going to validate your consent for you.” That word "active" matters. An opt-in has to be an affirmative action the person takes. The following do not count as valid consent:
Two more requirements sit on top of "active." The opt-in must clearly state the name of the business the person is opting in to hear from, and it must make clear the person is opting in to receive communication from that business. Generic language like "subscribe for updates" without naming you fails this. “You can collect it on any third-party channel — your website, your app, a checkout page, an in-store tablet, an SMS reply, a QR code.” Single vs. double opt-in: what each is, and when double is worth it
Two more requirements sit on top of "active." The opt-in must clearly state the name of the business the person is opting in to hear from, and it must make clear the person is opting in to receive communication from that business. Generic language like "subscribe for updates" without naming you fails this. “What can't change is the substance: active action, your business name, clear statement that they'll get WhatsApp messages from you.” Single vs. double opt-in: what each is, and when double is worth it
Single vs. double opt-in: what each is, and when double is worth it “Single opt-in is one affirmative action. The person ticks a box, taps a button, or sends a keyword, and they're on your list.” Double opt-in adds a confirmation step. After the first action, you send a message asking them to confirm (reply YES, tap a button), and only confirmed contacts get added. The classic example: they tick the box on your form, then receive a WhatsApp message saying "Reply YES to confirm you want updates from [Business]."
Single opt-in is one affirmative action. The person ticks a box, taps a button, or sends a keyword, and they're on your list. “Double opt-in adds a confirmation step.” Here's the part to get right, because it's a common myth. Double opt-in is a best practice, not a Meta requirement. Meta's policy requires valid opt-in. It does not mandate a second confirmation step. Double opt-in is also widely treated as the gold standard for GDPR, but even GDPR doesn't strictly require it — it's the cleanest way to prove consent, not a legal mandate.
Single opt-in is one affirmative action. The person ticks a box, taps a button, or sends a keyword, and they're on your list. “After the first action, you send a message asking them to confirm (reply YES, tap a button), and only confirmed contacts get added.” Here's the part to get right, because it's a common myth. Double opt-in is a best practice, not a Meta requirement. Meta's policy requires valid opt-in. It does not mandate a second confirmation step. Double opt-in is also widely treated as the gold standard for GDPR, but even GDPR doesn't strictly require it — it's the cleanest way to prove consent, not a legal mandate.
Double opt-in adds a confirmation step. After the first action, you send a message asking them to confirm (reply YES, tap a button), and only confirmed contacts get added. The classic example: they tick the box on your form, then receive a WhatsApp message saying "Reply YES to confirm you want updates from [Business]." “Double opt-in is a best practice, not a Meta requirement.” So when is double opt-in actually worth the friction it adds?
That word "active" matters. An opt-in has to be an affirmative action the person takes. The following do not count as valid consent: “A pre-checked checkbox the user has to uncheck to decline.” "We already have your number from your order, so we'll message you."
A pre-checked checkbox the user has to uncheck to decline. “"We already have your number from your order, so we'll message you."” Consent buried in a Terms of Service acceptance with no mention of WhatsApp.
"We already have your number from your order, so we'll message you." “Consent buried in a Terms of Service acceptance with no mention of WhatsApp.” A phone number scraped, purchased, or imported from another platform.
Consent buried in a Terms of Service acceptance with no mention of WhatsApp. “A phone number scraped, purchased, or imported from another platform.” Two more requirements sit on top of "active." The opt-in must clearly state the name of the business the person is opting in to hear from, and it must make clear the person is opting in to receive communication from that business. Generic language like "subscribe for updates" without naming you fails this.
A phone number scraped, purchased, or imported from another platform. “Generic language like "subscribe for updates" without naming you fails this.” One point that trips people up: the opt-in does not have to happen inside WhatsApp. You can collect it on any third-party channel — your website, your app, a checkout page, an in-store tablet, an SMS reply, a QR code. Meta dropped the old requirement that opt-in flow through a specific platform. What can't change is the substance: active action, your business name, clear statement that they'll get WhatsApp messages from you.