Meta takes opt-in seriously because it's the mechanism that keeps WhatsApp from turning into another spam-filled channel. Messaging people who haven't opted in doesn't just risk a complaint — it directly damages your account's quality rating, which throttles your sending limits (see our guide to rate limits and tiers for how that connects).
Numbers collected for a different purpose (a delivery address form, a warranty card) don't automatically grant WhatsApp messaging consent unless it was explicitly mentioned. Purchased or scraped contact lists are never valid opt-in and are one of the fastest routes to a restricted number.
"By submitting, you agree to receive WhatsApp updates about your order" as a visible checkbox or line of text is enough — it doesn't need to be complicated, just clear and honest about what the customer is agreeing to. Burying it in a long terms-of-service block that nobody reads technically checks a box but doesn't build the kind of trust that keeps engagement healthy.
Store when and how each contact opted in — form submission timestamp, order date, or the fact that they messaged you first. If Meta or a customer ever questions consent, having this on hand protects your account. Tagging a contact with how they were acquired (e.g. "checkout-optin," "inbound-enquiry") at the point you add them makes this trivial to look up later instead of having to reconstruct it from memory.
Always honor "STOP" or similar requests immediately. This shouldn't depend on someone on your team remembering to manually update a spreadsheet — a contact who texts STOP should be excluded from every future broadcast automatically, at the moment they ask, not whenever someone next reviews the list. Mentioning how to opt out in your first message to new contacts ("Reply STOP anytime to unsubscribe") builds trust and, in practice, doesn't cost you as many subscribers as businesses fear — customers who know they can leave easily are often more comfortable staying subscribed.
Someone who opted out during a busy season might genuinely want updates again later. Supporting a simple "START" keyword to resubscribe (with an automatic confirmation so they know it worked) is a small courtesy that keeps the door open without you having to manually re-add them.
A customer who messaged you about a specific order has implicitly opted into replies about that order (a "service" conversation) — that's different from having opted into ongoing marketing broadcasts about new products. Treating every inbound message as a green light to add someone to your marketing list is a common mistake that inflates your list with people who never actually agreed to promotional messages.
If you sell to businesses rather than consumers, opt-in is still required, but it often happens more naturally through direct conversation — a prospect who messages your sales number, or who provides their WhatsApp number on a demo-request form that clearly states they'll be contacted there, has opted in for that context. The same rule applies though: consent for one type of conversation (a sales enquiry) doesn't automatically extend to unrelated ongoing marketing broadcasts unless that was made clear upfront.
Opt-in quality isn't a one-time checkbox you set and forget — it's the foundation your quality rating and messaging tier are built on for the life of the account. A business that's careful about consent from day one tends to see steadily improving delivery and engagement as its list grows, while a business that cuts corners early often hits a ceiling that's difficult to recover from later, since a damaged quality rating takes sustained good behavior to rebuild.
If you're not sure how clean your current contact list is, it's worth a one-time review: for each contact, can you point to how and when they opted in? Contacts you can't account for are the ones most likely to report or block a future message, dragging down your quality rating for everyone else on the list. Tagging contacts by opt-in source going forward, rather than trying to reconstruct this after the fact, is the cheap way to avoid ever facing this problem again.
Q: Does replying to a customer's question count as marketing consent? A: No — answering an inbound question is a service reply, not permission to add that person to future marketing broadcasts. Those are separate consents.
Q: What happens if I message someone who never opted in? A: At minimum it risks a block or spam report, which damages your account's quality rating and can throttle your sending tier; repeated violations risk account restrictions from Meta.
Q: Do I need to re-confirm opt-in periodically? A: There's no fixed Meta requirement to do so, but keeping your list clean by honoring opt-outs promptly and not messaging inactive, unengaged contacts indefinitely protects your quality rating regardless.