WhatsApp opt-in and compliance: a practical guide for businesses

Published 24 June 2026

Compliance on WhatsApp is less about paperwork than about one question: can you show that this person asked to hear from you on this number? If yes, almost everything else follows.

Valid opt-in means the person actively agreed, knew it was WhatsApp specifically, and knew which business would message them. A checkbox on your form that says 'Send me updates on WhatsApp' next to your business name is fine. A pre-ticked box, a purchased list, or a number scraped from a group is not.

Record the evidence at the moment of collection: the source, the exact wording shown, the timestamp, and the channel. WAFollow stores consent state and source on the contact record so you can answer a complaint months later without digging through screenshots.

Opt-out has to be effortless. Accept the obvious keywords, act on them instantly and permanently, and never require someone to email you to unsubscribe. Under GDPR and India's DPDP Act, withdrawal of consent must be as easy as giving it — and Meta measures blocks and reports directly through your quality rating.

Quality rating is your real compliance dashboard. If it drops, you are messaging people who did not want it, too often, or with content that surprises them. The fix is targeting and frequency, not a different tool.

Keep the boring hygiene in place too: a published privacy policy, a documented retention period, an honest sub-processor list, and a route for data deletion requests. It takes an afternoon and it is what enterprise buyers ask for first.