WhatsApp opt-in rules for businesses: what Meta requires and what happens if you skip it

The rule

Meta's WhatsApp Business Messaging Policy (last updated 23 September 2026) says you may contact people on WhatsApp only if two things are true: they have given you their mobile phone number or username, and you have received opt-in permission from them confirming that they want to receive later messages or calls from you.

Meta's developer page explains that, under the November 2024 update to the policy, the permission can be general and not specifically for WhatsApp, as long as you follow all local laws. So a customer who agreed on your website or at your counter to hear from you can count, provided the request was clear.

What the request must say

Meta's developer page (updated 16 June 2026) lists three requirements for how you ask:

1. You must clearly state that the person is opting in to receive communication from your business.
2. You must clearly state your business's name, the one the person is agreeing to hear from.
3. You must comply with applicable law.

Meta says that any method meeting these requirements is policy compliant. A pre-ticked box that does not name you, or a line buried in terms, does not obviously meet the first two.

How people can opt in

Meta says the choice of method is yours. It lists these as examples of supported methods:

1. SMS.
2. Your website.
3. By phone, using an interactive voice response (IVR) menu.
4. In person or on paper, where the customer signs a document.

Meta also says you alone are responsible for making sure the opt-in follows the laws that apply to your messages, and for giving any notices and getting any permissions that law requires. Its pages do not name any country's law, so for India you need to check yours. We cannot tell you that a given form is lawful.

Does a reply need opt-in too?

Meta's policy says you may reply to a person's message without a template while the 24-hour customer service window is open, and that outside the window you may only send approved templates. The window opens, and restarts, each time the person writes to you.

Meta's page on service messages adds a reminder that you can only send messages to people who have opted in to hear from your business. Meta's pages do not say whether a customer writing to you first counts as that opt-in. If you rely on it, treat it as your own judgement, and keep a record of what the person asked for.

What Meta suggests, to keep people from blocking you

Meta lists these as tips, not as rules:

1. Ask for an opt-in that covers the categories you will send, such as order updates, relevant offers and product recommendations.
2. Better still, ask separately for each category. Meta says this lowers the risk that people block you for messages they did not expect.
3. For calls, Meta's policy suggests a separate opt-in to start one.
4. Say clearly what the person gets out of it.
5. Watch your quality rating when you roll out a new way of collecting opt-ins.

Opting out

Meta's policy says you must respect every request, on or off WhatsApp, to block, stop or opt out of messages from you, including removing the person from your contact list. It also says not to confuse, deceive, spam or surprise people with your messages.

Meta's tips ask for clear instructions on how to opt out of particular categories, honoured when asked, and opt-in and opt-out flows that are clear and simple.

What happens when you get it wrong

Meta says a number's quality score comes from how people received your messages in the past seven days, weighted towards the latest, using blocks, reports, mutes, archives and the reasons people give when they block you. If quality stays low for a long period, Meta's systems limit how much you can send. Meta also says it may look at your opt-in flows after the fact, including user feedback, to flag policy breaks.

For repeated breaches, such as spam, Meta's enforcement page describes a ladder. Accounts first get a warning. After that, restrictions that grow longer:

1. A 1-day or 3-day block on sending template messages, and on adding phone numbers.
2. A 5, 7 or 30-day block on sending any messages.
3. An account lock: an indefinite block on sending, which only an appeal can remove.
4. Permanent removal from the WhatsApp Business Platform, if nothing changes after repeated warnings and limits.

Meta says that for severe harm it can remove an account at once, and that it may limit or remove a business that receives excessive negative feedback. Notices appear in Business Support Home in Meta Business Suite, go by email to the business portfolio's admins, and can arrive as an account_update webhook. You can ask for a review there; Meta says a decision typically takes 24 to 48 hours, and that not every spam violation can be appealed.

What Meta does not say

1. It does not say how long to keep a record of each opt-in, or what proof it would accept.
2. It does not give wording you must use, beyond the three requirements above.
3. It does not say whether a customer messaging you first, or giving a number for another purpose, is enough on its own.
4. It does not name Indian law. It tells you that the law is your responsibility.

We found no disagreement between Meta's pages on the rule itself. The policy page adds that a person can give a username instead of a number, and mentions calls; the developer page speaks of phone numbers and messages.

What VartaAPI does, and what it does not

VartaAPI does not decide whether your opt-in is valid, and it cannot prove that a customer agreed. That stays with you. It gives you tools for the opt-out side and a record of changes:

1. When a customer sends one of your opt-out words, such as STOP, they are marked opted out, get your reply, and are left out of campaigns. The words, the START words and both replies are yours to edit, in any language.
2. Every change of a contact's opt-in status is recorded with the time and how it happened (a word they sent, a team member, or the API). Owners and admins can download that record from Reports.
3. An optional switch makes the API refuse to send to a contact who has opted out. It is off by default so existing connections keep working.
4. A website enquiry form connected to VartaAPI adds a person to your WhatsApp list only if the visitor ticked a WhatsApp box.

The history starts from the day this feature was switched on; earlier opt-outs have no row. If you have not connected a number yet, start with the official WhatsApp Business API guide.