How to Collect WhatsApp Opt-Ins That Actually Protect You

Every business that has had a WhatsApp number restricted says the same thing afterwards: "but they were our customers". Being your customer is not the same as having agreed to receive messages, and Meta judges you on how people react, not on how you got the number.

What counts as an opt-in

The person must have actively agreed to hear from your business on WhatsApp, and it must be clear it was your business they agreed to. A ticked box they did not notice is weak. A phone number collected for delivery is not consent to marketing. A number bought from a list is nothing at all.

The test that matters in practice: if this person reported your message, could you show when and how they agreed?

Six ways that work in India

1. Website checkbox — unticked by default, next to the phone field, with plain wording: "Send me order updates and offers on WhatsApp."
2. Click-to-WhatsApp — when someone messages you first, you have both consent and an open window. This is the cleanest opt-in there is.
3. QR code in the shop — scanning and sending a message is an active choice. Works well at billing counters.
4. Missed call or keyword — "WhatsApp JOIN to 86691 17894". Low friction, and the message itself is the record.
5. During checkout or billing — one line on the invoice flow, with the box unticked.
6. At the end of a service — after a delivery or appointment, ask once. People say yes when the experience is fresh.

What all six have in common: the customer does something. They are not added because they exist in your database.

What to record, every time

Keep four fields with each opt-in, because in a dispute these are the only thing that helps:

• The number
• Date and time
• Where it came from — which form, which QR, which counter
• The exact wording the person agreed to

Store the wording itself, not a link to a page you will redesign next year. Under India's data protection law you also need to be able to show this on request, so treat it as a record rather than a marketing nicety.

Opt-out is part of opt-in

Make leaving easy and visible. One word — STOP — handled automatically, with no "are you sure" and no delay. Businesses resist this because every exit feels like a lost customer. In reality a quiet unsubscribe is far cheaper than a block, because blocks are what Meta counts against your number. Read what actually happens when a number gets restricted before deciding this is optional.

The mistakes that cause bans

• Importing an old customer list and broadcasting on day one. The fastest way to destroy a new number.
• Treating an enquiry as permanent consent. Someone who asked a price in 2024 did not sign up for festival offers in 2026.
• Buying a list. There is no version of this that ends well.
• One consent for everything. Order updates and promotional offers are different things; people accept the first and resent the second.

Start here if you are starting from zero

Put the checkbox on your website form, add a QR code at your counter, and turn on click-to-WhatsApp. Those three cost nothing and will build a cleaner list in two months than any purchased database — and that list will still be sending at full rate next year, which a bought one will not.

What India's data protection law expects of you

The Digital Personal Data Protection Act treats a phone number as personal data and consent as something you have to be able to produce, not something you can assert. Three parts of it change how a WhatsApp list should be built.

Notice has to come with the ask. At the moment someone ticks the box, they should be able to see what you will send and who is sending it. A link to a privacy policy three clicks away is not notice; one plain line next to the field is.

Consent is tied to a purpose. Consent collected for order updates does not cover festival offers. If you want to do both, say both in the wording, or collect them separately and tag the contact accordingly. This is the single most common mistake in Indian WhatsApp lists, and it is also the one that produces blocks.

Withdrawal has to be as easy as giving it. If joining took one tap, leaving cannot take an email to support. One keyword, handled automatically.

You also need a named person who handles complaints and a way to reach them. Put that contact on the same page as the form.

Wording that survives a dispute

The difference between a defensible opt-in and a weak one is usually fifteen words. Compare:

• Weak: "I agree to the terms and conditions." Covers nothing about WhatsApp, names no sender, mentions no purpose.
• Weak: "Stay updated!" next to a pre-ticked box. Pre-ticked is not an active choice, and "updates" is not a purpose.
• Defensible: "Send me order updates and occasional offers from [Business Name] on WhatsApp at this number." Names the sender, names both purposes, sits next to the number it applies to, unticked by default.

Store that sentence with the contact, word for word, along with the date. When a complaint arrives eight months later, the sentence is your answer. A link to the page is not, because the page will have changed.

Bringing an old list across without burning your number

Most businesses arrive at WhatsApp with a database they collected for something else. Blasting it is how numbers get restricted in week one. The order that works:

1. Segment by recency. People who bought or spoke to you in the last ninety days behave completely differently from a list from 2023. Start with the recent group only.
2. Lead with utility, not marketing. The first message to a cold contact should be something they want — an order status, an appointment reminder, a document they asked for. Reaction rates on utility messages are far better, and reactions are what Meta measures.
3. Run a re-permission message. One message explaining what you will send, with a clear way to say yes and a clear way to say no. Keep only the yes. A smaller list that nobody reports is worth more than a large one that throttles your number.
4. Send in small batches first. A few hundred, then look at blocks and reports before scaling. If the first batch goes badly, you have lost a few hundred contacts instead of your number.

Older contacts you never re-permission are not lost, they are simply not a WhatsApp audience. Reach them on a channel where the consent you have actually applies.

How to tell whether your opt-in is working

Do not judge opt-in by list size. Judge it by three things you can read off your own account, and watch the direction they move rather than comparing yourself to someone else's numbers:

• Block and report rate per campaign. The number that matters most, because it is the one Meta acts on. If it rises after a particular source starts feeding contacts in, that source is the problem.
• Opt-outs by source. Tag every contact with where it came from. A QR code at the counter and a bought list look identical in a contact table and nothing alike in this column.
• Quality rating on the number itself. Check it weekly. It moves before your reach does, so it is an early warning rather than a post-mortem.

If you cannot break those down by source, that is the first thing to fix — not the wording.

Most Indian stores never get as far as collecting opt-ins: in our study of 667 Indian online stores, 58.5% had no WhatsApp link on the site at all — see Indian online stores and WhatsApp.

Frequently Asked Questions

Is a customer's phone number enough to message them on WhatsApp?

No. Having the number is not consent. The person must have actively agreed to receive messages from your business on WhatsApp, and you should be able to show when and how they agreed if the message is ever reported.

What should we store when someone opts in?

The number, the date and time, the source such as a specific form or QR code, and the exact wording the person agreed to. Store the wording itself rather than a link to a page that may change later.

Does offering an easy opt-out hurt our list?

It protects it. A quiet unsubscribe costs you one contact; a block counts against your number's quality rating with Meta and reduces how many people you can reach overall. Handle STOP automatically and immediately.

Do we need separate consent for marketing and order updates?

Strictly, yes, because consent in India is tied to the purpose you stated when you collected it. Either say both purposes in one line of wording, so the person is agreeing to both, or collect them separately and tag the contact so campaigns only go to the people who agreed to campaigns. Sending offers to a list collected for delivery updates is the most common cause of reports.

Can we message a list we collected before we started using WhatsApp?

Not safely as it stands. Segment it by recency, send utility messages first to the most recent group, then run a single re-permission message asking people to confirm, and keep only those who do. Send in batches of a few hundred and watch blocks before scaling. A smaller confirmed list sends at full rate; a large unconfirmed one gets your number throttled.