WhatsApp Opt-In for Developers: What Meta Requires and What to Store

Disclosure: this article was written with AI assistance and checked by the WABB team against Meta's documentation and the WhatsApp Business Messaging Policy (read on 5 November 2026).

Before a business can message anyone on WhatsApp, the person has to have said yes. For a developer, that turns into a product question (where do we ask?) and a data question (what do we keep so the yes can be shown later?). This post covers both, using only what Meta publishes, and marks the parts that are our own suggestion.

The short version

• WhatsApp's policy lets a business message a person only if (a) the person gave their mobile phone number or username and (b) the business received opt-in permission confirming they want later messages or calls from it.
• The opt-in must say that the person is opting in to messages, and it must name the business.
• Meta leaves the method to you. It lists SMS, a website, a phone call with an IVR flow, and in person or on paper as supported examples.
• Meta does not say what to store. A permission record is our suggestion, below.

What the rule says

Meta's documentation refers to the November 2024 update of the WhatsApp Business Messaging Policy. Under it, the opt-in can be general rather than specific to WhatsApp, as long as the business follows all local laws. So a permission you collected on your website or on paper can count, if it meets three requirements:

1. The business clearly states that the person is opting in to receive communication from it.
2. The business clearly states its name, the one the person is opting in to hear from.
3. The business complies with applicable law.

Figure 1. What a valid opt-in needs, and the methods Meta lists.

The policy adds that you alone decide the method and are responsible for obtaining the notices and permissions that applicable law requires. Meta does not write that for you, and neither does this post: if you are unsure about a law, ask a lawyer.

Source: Meta for Developers, "Get opt-in for WhatsApp" (updated 16 Jun 2026); WhatsApp Business Messaging Policy (last updated 23 Sep 2026), checked 5 November 2026.

Where you can ask

Meta lists four methods as supported examples. Any method that meets the requirements above is policy compliant.

Method	What it looks like in a product
SMS	A text asking the person to confirm they want WhatsApp messages from the business
Website	A form or checkbox that names the business and says messages will come on WhatsApp
Phone (IVR)	A menu option in an automated call system (interactive voice response, IVR) that records the person's choice
In person or on paper	A signed form, for example at a shop counter

Table 1. Opt-in methods that Meta lists as supported examples. The right-hand column is our description.

Source: Meta for Developers, "Get opt-in for WhatsApp" (updated 16 Jun 2026), checked 5 November 2026.

For a website, the requirement translates into plain wording on the form. For example: "I agree to receive order updates from [your business name] on WhatsApp." It names the business and says what the messages are for. If your site has a WhatsApp chat button, this wording can sit next to it.

A pre-ticked box with unclear text is a weaker answer to Meta's wording "clearly state". The pages we read do not mention pre-ticked boxes at all, so treat this as our reading, not Meta's.

Ask by category, not once for everything

Meta's tips are about the user experience, and they are practical for developers because they decide how many flags your data model needs:

• Get an opt-in that covers the different categories of messages you will send, for example order updates, relevant offers and product recommendations.
• Or get a separate opt-in for each category. Meta says this reduces the risk that people block you because they receive messages they did not expect.
• Tell people how to opt out of specific categories, and honour the request.
• Say what the person gets by agreeing.

Figure 3. The two ways Meta describes to ask for permission by message category.

On opting out, the messaging policy is firm: you must respect requests to block, discontinue or opt out, either on or off WhatsApp, including removing the person from your contacts list. In practice, an opt-out has to reach every system that can send a message, not just the one where the person typed "stop".

Source: Meta for Developers, "Get opt-in for WhatsApp"; WhatsApp Business Messaging Policy, checked 5 November 2026.

A permission record you can store

Meta publishes no required fields. The record below is our suggestion, built from the requirements above, so that for any person and any message category you can answer one question: when, where and in what words did they agree?

{
  "phone": "+91XXXXXXXXXX",
  "business_name_shown": "Your Business Name",
  "categories": ["order_updates"],
  "method": "website_form",
  "wording_version": "2026-11-01",
  "given_at": "2026-11-05T10:12:00+05:30",
  "revoked_at": null
}

Why each field is there:

• business_name_shown and wording_version keep the two things Meta asks you to state: that the person is opting in, and to whom. If you change the form text, you can still tell which text a given person saw.
• categories matches the per-category approach Meta suggests.
• method records which of the supported methods was used.
• revoked_at makes an opt-out a fact in the data, so a sending job can skip the person without anyone remembering to.

A simple check before any outbound job: no matching record for that person and category, or revoked_at is set, means the message is not sent. This is our design choice, not a Meta requirement, but it turns the policy into something a test can cover.

Figure 2. A check before every outbound message. It is our suggestion, not a Meta rule.

What happens if you get it wrong

Meta's page says that people can send feedback, stop marketing messages from a business, or block and report it. Its systems rate-limit businesses whose quality is low for a sustained period, and it may evaluate user feedback to flag policy violations. Meta advises monitoring your quality rating, especially when you roll out a new opt-in method.

If you send marketing messages from the WhatsApp Business app, our broadcast guide covers lists, limits and cost.

Our suggestion: treat a new opt-in form like a deployment. Ship it to a small share of traffic, watch the quality rating (the score WhatsApp gives a business number from customer feedback), then widen it.

Source: Meta for Developers, "Get opt-in for WhatsApp", checked 5 November 2026.

A person who writes first

Opt-in is about when you start the conversation. When a person messages you first, a different rule applies: the policy says you may reply without a template within the 24-hour customer service window, which opens and resets with each message from the user.

A chat link or QR code is one way to get a person to write first. WABB has a chat link generator and a guide to QR codes and short links.

Outside that window, only approved message templates (pre-approved message formats) are allowed, and you can only start a conversation with one.

The pages we read do not say whether a customer's first message counts as opt-in for later template messages. Our suggestion: record the opt-in explicitly, as in the record above, instead of assuming the first message covers it.

Source: WhatsApp Business Messaging Policy (last updated 23 Sep 2026), checked 5 November 2026.

Checklist

• The form or script says it is for WhatsApp messages and names your business
• You know the method you used for each person (website, SMS, IVR or in person)
• You can tell which categories each person agreed to
• An opt-out, wherever it arrives, reaches every system that sends
• You watch your quality rating after a new opt-in method goes live
• A lawyer has confirmed your wording against the laws that apply to you

FAQ

Does the opt-in have to mention WhatsApp? Meta says opt-in can be general, not specifically for WhatsApp, as long as you comply with local laws. Mentioning WhatsApp is still clearer for the person.

Can I use a signed paper form? Yes. Meta lists "in person or on paper" as a supported method.

Does Meta tell me what to store? No. Keeping a record is our suggestion.

Does a customer writing first count as opt-in? The pages we read do not say, so we suggest recording the opt-in explicitly.

We build tools for WhatsApp messaging at WABB. If you are moving to the API, our API prerequisites guide lists what to prepare first. This post uses only Meta's public documentation.