Opt-in is the load-bearing rule of WhatsApp messaging. Get it right and almost everything else — quality rating, delivery, tier progression, complaints — takes care of itself. Get it wrong and no amount of good copy compensates.
What a valid opt-in requires
- It names WhatsApp. "Subscribe to updates" is not consent to be messaged on WhatsApp specifically.
- It names you. The business sending must be identified at the point of consent.
- It is an action. A tick they made, a box they filled, a message they sent. Not a pre-ticked box and not an inference.
- It says what they will get. Order updates and weekly promotions are different things, and consent to one is not consent to the other.
- It is recorded. Timestamp, method, and the exact wording shown.
None of these count as opt-in: a number given for delivery coordination, a number on a business card, a number from a purchased list, a number that messaged you two years ago about something unrelated, or membership of a WhatsApp group you administer.
Four collection methods that hold up
At checkout. An unticked box: "Send my order updates on WhatsApp." Highest quality consent you can get, because the intent is unambiguous and immediate. Keep marketing consent as a separate box.
A click-to-WhatsApp entry point. When someone opens a conversation with you from an ad or a website button, they have plainly chosen to talk to you. This is also commercially efficient, since customer-initiated conversations are treated differently on price.
A keyword opt-in. "Message JOIN to +91 …" produces an unambiguous, self-documenting consent record: their own message.
An in-conversation upgrade. Someone messages you about an order; at the end you ask whether they would like occasional offers too, and they answer. Explicit, contextual and well-timed.
Separate the two consents
Transactional and marketing consent should be collected and stored separately. Most people who want delivery updates do not want promotions, and bundling the two produces exactly the complaint pattern that damages a sender's quality rating.
Two boolean fields on a contact record, each with its own timestamp and source, is all the structure this needs.
What to store
- Timestamp of consent, in UTC.
- Method — checkout box, keyword, click-to-chat, in-conversation.
- The exact wording displayed at the time.
- Scope: transactional, marketing, or both.
- Withdrawal timestamp, when it happens.
If someone complains, this record is the whole of your defence. Without it you cannot demonstrate consent, and "we are sure they agreed" carries no weight with a regulator.
Consent goes stale
A permission given three years ago by someone who has not interacted since is technically valid and practically worthless — those are the contacts who block and report. Re-permission anyone dormant for a long period with a single message that makes staying easy and leaving easier. A smaller engaged list outperforms a large indifferent one on every metric that matters.