Why this matters commercially
Most compliance articles are about avoiding fines. This one is about something more immediate.
If you get this wrong, you lose the channel.
Not through a legal process. Through Meta’s quality system, which measures how people react to your messages and restricts your number when enough of them react badly.
Losing WhatsApp access costs more than any campaign gains. That is the practical reason to take consent seriously, quite apart from the legal one.
What counts as opt-in
Opt-in must be clear and specific. The person agreed to receive WhatsApp messages from you, and they knew what kind.
Valid:
- A checkbox at checkout saying they want order updates on WhatsApp
- Sending you a message asking to be kept informed
- A signed form specifying WhatsApp messaging
Not valid:
- Having your phone number
- Buying something once
- Handing you a business card
- Consent buried in terms and conditions nobody reads
- A pre-ticked box
The test: could you show somebody exactly when and how this person agreed? If not, you do not have consent.
FIGURE 2: WHAT IS AND IS NOT CONSENT
Consent
- A checkbox specifying WhatsApp updates
- They messaged you first
- A form they signed knowing what it meant
- Recorded — when, how, what for
Not consent
- You have their number
- They bought something once
- A pre-ticked box
- Buried in terms nobody read
Recording it
Keep, for every contact:
- When they opted in
- How — which form, which page, which conversation
- What for — order updates, or marketing too, or both
Two reasons this matters:
If you are ever asked, you need to show it.
And more practically: it prevents a different system from messaging somebody who only agreed to order updates. That is how most accidental violations happen — not deliberately, but because two systems had different views of what somebody agreed to.
Opt-out
Every messaging programme needs a route out that works.
Accept plain language. People will write “stop”, “unsubscribe”, “no more”, “remove me”, or just “please stop messaging me”. Do not require an exact keyword.
Act immediately. Not at the next sync. If a message goes out after somebody asked you to stop, that is worse than the original problem.
Record it centrally, so every system knows.
Confirm it. One short message saying they have been removed. Then nothing.
Make it easy to find. Hiding the opt-out costs more than the unsubscribes save, because people block instead — and blocks damage your quality rating far more than unsubscribes do.
Quality rating
Meta’s measure of how people react to your messages.
What lowers it:
- Blocks
- Reports
- Messages going unread
- High volume to people who did not want it
What happens as it falls:
Your messaging limits reduce. Fall further and the number can be restricted or disabled.
It is a warning system. It declines before you lose access, which means somebody watching it can act in time.
Check it regularly. Weekly is reasonable. If it drops, stop sending and find out why before continuing.
FIGURE 3: WHAT PROTECTS YOUR ACCESS
Real, recorded opt-in
- You could show when and how each person agreed.
Mostly utility messaging
- Order updates get read. Promotions get reported.
Immediate, easy opt-out
- People who cannot leave easily block instead. Blocks hurt more.
Somebody watching the rating
- It falls before access is lost. That is a warning you can use.
Separating consent types
Worth doing properly, because it prevents most problems.
Somebody who agreed to order updates has not agreed to promotions.
Treating those as the same thing is how businesses end up sending marketing to people who wanted notifications, getting reported, and damaging the channel that was working.
Keep them as separate flags on the customer record. Two questions at signup, two stored values, and every send checks the right one.
Legal requirements
These vary by country and this is not legal advice. But the principles are consistent.
Consent before messaging. Most jurisdictions require it for marketing, and many for any commercial messaging.
Clear identification. The recipient must know who is messaging them.
Working opt-out. Required nearly everywhere.
Data protection. Phone numbers are personal data. Storage, retention and deletion rules apply.
Records. You may need to show consent existed.
Check what applies where you operate, and where your customers are — the two can differ.
What actually goes wrong
Five patterns, in order of frequency.
Sending to a list you already had. Existing customer phone numbers are not opted-in contacts. This is the most common mistake and it damages your rating fastest.
Mixing consent types. Marketing sent to people who agreed to order updates.
Opt-outs not propagating. Somebody unsubscribes in one system and another keeps messaging.
Nobody watching the rating. The warning goes unheard until access is restricted.
Too much, too often. Frequency alone can sink a rating even when every message is technically permitted.
Getting it right from the start
Seven things, before the first message.
- Add a specific WhatsApp opt-in to your signup and checkout, separate from email
- Store consent with a date and a source
- Keep marketing consent separate from utility consent
- Build opt-out handling that accepts plain language and acts immediately
- Make sure opt-out reaches every system that might send
- Start with utility messages only — order updates, reminders
- Check the quality rating weekly from day one
Point 6 is worth emphasising. Starting with utility builds a good rating. Starting with promotion means you are managing a problem from the first week.
If your rating drops
Stop sending immediately. Do not push through.
Look at what changed. New message type? Higher volume? A new list?
Check your consent for whoever you have been messaging.
Reduce frequency and go back to utility-only.
Wait. Ratings recover, slowly, if the behaviour changes.
Do not switch to a new number and continue as before. Meta notices, and it makes the eventual outcome worse.
The short version
Consent is specific. Agreeing to order updates is not agreeing to promotions.
Opt-out must be easy and immediate, because people who cannot leave easily block instead — and blocks are what cost you the channel.
Watch your quality rating weekly. It is a warning you can act on.
Start with utility messaging. It builds the rating that lets you keep using the channel at all.
Building a WhatsApp programme and unsure about consent?
Get in touch. We set up consent capture and opt-out handling before the first message — because getting it wrong costs you the channel, not just a fine.
