What Are WhatsApp's Opt-In Rules for Business Messages?

Short answer: before you message someone on WhatsApp, you need their number and their permission to receive messages from you. Meta requires the opt-in to say clearly that the person is agreeing to messages and to name your business, and you must follow local law. The opt-in does not have to be collected on WhatsApp, and you must honour every request to stop, whether it comes on WhatsApp or anywhere else.

What exactly does Meta require?

Meta's opt-in guidance and the WhatsApp Business Messaging Policy (last updated 23 September 2026, read 24 October 2026) set out four rules:

1. You may contact people only if they gave you their number and opted in to receive messages or calls from you.
2. The opt-in must clearly state that the person is opting in to communication from your business.
3. It must name your business.
4. You must respect all requests, on or off WhatsApp, to block, stop or opt out.

And always: comply with applicable law. Meta also notes the opt-in can be general rather than specific to WhatsApp, as long as local law allows it.

Where can you collect it?

Meta lists examples: a website, SMS, a phone call through an automated phone menu, and in person or on paper. Below is wording that meets Meta's two content rules in each place. Adapt it, and check it against your local law.

Do you need separate opt-in for marketing?

Meta does not require it, but recommends it: collect opt-in per message category, explain what people will receive and how to opt out of each kind. Someone who signed up for delivery updates and then gets weekly promotions is the person most likely to block you. Splitting the boxes costs you a few marketing contacts and protects your number.

What counts as a stop request?

• The word STOP, or anything like it, in the chat
• Tapping a "Stop promotions" button, or using WhatsApp's own control to stop marketing from your business
• An email, a phone call or a word at the counter: Meta's policy covers requests made off WhatsApp too
• Blocking or reporting your number

Meta's marketing template page says that when someone has stopped marketing from your business, the API accepts the request but does not send the message. Do not rely on that alone; it covers only that one control.

What happens if you skip opt-in?

People who did not expect your message block and report you. Meta uses that feedback in your quality rating, and can limit how many messages you send. Meta also caps how many marketing messages each person receives from all businesses, so an unwanted message wastes your share. See why numbers get restricted and error 131049.

How does local law add to Meta's rules?

Meta's rules are a minimum. Depending on where your customers are, rules on electronic marketing and personal data apply on top: in the UK, PECR and UK GDPR, overseen by the ICO; in the US, federal and state rules such as the TCPA may apply; in the UAE, the federal personal data law; in India, the DPDP Act and its rules. They can require more, such as records of when and how consent was given. Take advice. You are responsible for meeting them.

A record you can point at

The single most useful habit is to store each opt-in as a fact: who, when, where, and what they agreed to. When a campaign goes wrong, it tells you which source caused it; when someone complains, it shows what they agreed to.

In ThinnestAI, opt-in is a stored field, never guessed by the AI: recorded when a customer clearly says yes in the chat, when your team marks it, or when you confirm it for an imported list. A one-word STOP is honoured before the agent runs, broadcasts go only to opted-in contacts, and a do-not-contact list you keep is checked at send time. The mechanics are in sending broadcasts only to opted-in customers; see also WhatsApp broadcasts.