What Is Opt-In on WhatsApp?

What does WhatsApp require before you message someone?

WhatsApp’s Business Messaging Policy (updated September 23, 2026) says you may only contact people on WhatsApp if they have given you their mobile phone number or username and you have received opt-in permission from them. Businesses must also honor opt-outs, and WhatsApp may limit or remove access for “messaging people at scale in an unauthorized manner” (WhatsApp Business Messaging Policy).

This applies however you connect: a number linked by QR code (WhatsApp’s linked-device feature), a number on the WhatsApp Business app, or a number on the official WhatsApp Business Platform (Cloud API).

How do you collect a valid opt-in?

Meta’s policy does not prescribe one form, but the permission should be clear and tied to your business. Common ways to collect it:

These are common practices, not a checklist from Meta. Keep a record of when and how each person opted in, and make opting out as easy as opting in. For example, a clinic could add “Send me appointment reminders on WhatsApp” as an unticked checkbox on its booking form, and stop sending as soon as a patient replies “stop”.

Does opt-in differ between QR-linked numbers and the official API?

The consent rule is the same. What differs is what you can send:

• On a QR-linked number, you reply inside normal WhatsApp chats. Keep sending volume low and conversational; WhatsApp states that its products are not intended for bulk or automated messaging (WhatsApp Help Center).
• On the WhatsApp Business Platform, messages sent outside the 24-hour customer service window must use approved message templates, and marketing is one of the three template categories, alongside utility and authentication (Meta documentation). Each number also has a quality rating (green, yellow or red) based on blocks and reports from recipients over the past 7 days, so messaging people who did not opt in shows up quickly (Meta Business Help Center).

What should businesses in India know?

India’s Digital Personal Data Protection (DPDP) Act, 2023 is coming into force in phases under the DPDP Rules, 2025, notified in November 2025. Rule 4 on Consent Managers starts one year after publication (November 2026), and the rules on notice, security safeguards, breach intimation and retention start eighteen months after publication (May 2027) (DPDP Rules, 2025, eGazette). Under Rule 3, a notice must be in clear and plain language, itemise the personal data and purposes, and explain how to withdraw consent as easily as it was given. In January 2026 MeitY asked industry for views on shortening the eighteen-month window to twelve months (Storyboard18), so check the current schedule before relying on these dates. WhatsApp’s own opt-in requirement applies today regardless of that schedule.

What should businesses in the USA know?

Two points matter most. First, WhatsApp does not currently deliver marketing template messages to WhatsApp users with United States (+1) phone numbers; utility, authentication and service messages are not covered by this restriction (Meta documentation). Second, under the CCPA/CPRA, the business contacts and chat content a company holds count as personal information, and the B2B exemption expired on December 31, 2022 (California Attorney General). Twenty states had comprehensive privacy laws as of early 2026, so check the rules where your customers live (MultiState).

How does whatsappx.si help you respect opt-in?

With whatsappx.si you scan a QR code to link the WhatsApp number you already have, and your whole team replies from one shared inbox to people who have written to you or agreed to hear from you. Keyword-triggered auto-replies answer inside conversations customers start; AI replies are coming soon. If you also connect the official WhatsApp Business Platform, you can create message templates and sync them with Meta for approval. whatsappx.si does not offer bulk broadcast campaigns, and this page is general information, not legal advice.