Useful consent is not a hidden formality. It identifies who will write, on which channel, about what, and how the person can stop the messages.
Explain what the person is agreeing to
At the point of opt-in, say that messages will arrive on WhatsApp. A vague phrase such as “receive our news” does not identify the channel or the types of communication.
Name the business, describe the message categories, and explain how to withdraw. Where GDPR consent applies, it must be freely given, specific, informed, and unambiguous through a clear affirmative action. Exact obligations vary by country, audience, and purpose.
Ask at a moment that makes sense
Permission can be requested during signup, checkout, account creation, an event, a store visit, or a conversation the person started. The flow should require a clear, positive choice.
Do not automatically add every available phone number. A smaller contact database with a known source is easier to manage and more likely to match what people expected.
- A separate, unticked checkbox on a form.
- An explicit WhatsApp choice at a point of sale.
- A keyword deliberately sent by the person.
- Editable communication preferences in an account.
Keep a usable consent record
Your record should answer a simple question: when, where, and to what did this person agree? Store the date, source, wording shown, contact identifier, and relevant form version.
Use structured fields rather than a loose note. That makes it possible to include eligible contacts, separate message categories, and exclude records with an unknown permission status.
- Date and time.
- Source or form.
- Version of the notice.
- Message categories covered.
- Date and scope of any later withdrawal.
Make opting out work immediately
WhatsApp’s Business Messaging Policy requires businesses to respect requests to block, discontinue, or otherwise opt out, whether the request arrives on or off WhatsApp. The route should be clear and easy.
Keep a suppression or do-not-contact record so an opted-out number cannot return during a later import. Removing someone from one campaign is not enough if the next spreadsheet adds them again.
Treat permission as an ongoing promise
Even with an opt-in, the content should remain within the expectation you created. Someone who requested stock alerts may not expect daily promotional messages.
Use separate choices when message categories differ substantially, and review old permissions before changing purpose or frequency. This article offers operational guidance, not legal advice; check the rules that apply to your organization and recipients.
