Here is the fork. You have a WhatsApp Business API number, a list of several thousand phone numbers collected over three years of bookings, and a marketing team that wants to send an offer on Thursday. Legal (or the operations manager playing legal) says the consent record is thin. The marketing side says the numbers are customers, they gave you their phone, of course you can message them.
Both sides are arguing about the wrong thing. The question is not whether you have permission in some general sense. It is whether the sentence those customers actually read named WhatsApp, named the kind of message you are about to send, and left them free to say no without losing anything. Meta's Business Messaging Policy asks for exactly that: opt-in permission from the recipient confirming that they wish to receive your messages, and respect for every request to opt out. For a Dubai business there is a second layer, because the UAE's data protection law prohibits processing personal data without the owner's consent, so having the number on file settles nothing by itself. Most opt-in wording we audit fails on one of those three points, usually the first.
So the real decision is this: do we rewrite the opt-in now and rebuild consent properly, or do we send on Thursday and find out what quality rating feels like when it drops? We have watched both choices play out. This is how to make the first one, and how to write wording that does not tank your conversion rate in the process.
What Meta actually requires in opt-in wording
Meta's list is shorter than most people assume. Its opt-in guidance for the WhatsApp Business Platform requires three things: the wording must clearly state that the person is opting in to receive communication from your business, it must clearly state your business's name, and the flow must comply with applicable law. Note that Meta reviews message templates, never opt-in flows; the wording simply has to comply with the Business Messaging Policy, and you are solely responsible for how you collect the opt-in.
The structure we recommend builds on that baseline with three more elements: name WhatsApp as the channel, describe the kind of messages the person will get (order updates, appointment reminders, promotions), and tie the consent to the phone number the person entered. Meta's guidance lists message-category descriptions and clear opt-out instructions as best practices rather than requirements, but they are what make the consent defensible when a customer complains.
Consent must also be voluntary and provable, and those rules come from data-protection law rather than from Meta's policy text. Under GDPR a pre-ticked box, or a checkout that will not proceed unless you agree to marketing, does not count. The European Data Protection Board's consent guidelines also put the burden of proving consent on the business, so you need a record of when and where each person opted in. Meta's policy pulls all of this in through its requirement to comply with applicable law.
That is the whole list. It is short. What makes it hard is that the elements pull against the instinct to keep forms frictionless, and against the habit of writing consent language that sounds like a lease agreement.
Two things Meta does not require, which people assume it does. Double opt-in (sending a confirmation message and asking the person to reply YES before you add them) is a strong practice that appears nowhere in Meta's requirements. And a generic marketing consent checkbox from your email signup does not transfer to WhatsApp. If the sentence said "receive updates from us" without naming the channel, you have email consent that does not stretch to a new channel.
Auditing the consent you already have before you write anything new
We always start here, and clients always want to skip it. Before you draft a single new sentence, go find every place a phone number currently enters your business and write down the exact words that appear next to it. Check the live text itself, because memory flatters the wording.
In a typical clinic or salon, that list runs to five or six places: the website booking form, the paper intake sheet at reception, the Instagram lead form, the walk-in WiFi login, the old email newsletter signup, and a spreadsheet someone maintains from phone enquiries. Each one has different wording, or no wording, and each one produced a different grade of consent.
Sorting numbers into tiers instead of one big list
Once you have the wording inventory, split the database. We use three tiers:
- Clean marketing consent. The person saw wording that named WhatsApp and named promotional messages. You have a timestamp and the source. These can receive marketing template messages.
- Transactional only. The person gave a number for a booking or an order with wording that covered service messages. You can send appointment reminders and order updates. Not offers.
- Unknown. No recorded wording, no timestamp, or wording that only mentioned email or "updates". These need re-permission before anything commercial goes out.
This is the least glamorous part of the job and the part that decides whether everything downstream works. Our position on AI projects applies exactly the same way here: most implementations fail because of dirty data rather than bad technology. A CRM that cannot tell you which of two numbers has marketing consent will happily let an automation send a promotion to the wrong tier, and the automation will look confident while doing it.
The re-permission message, and its one honest limitation
For the unknown tier, you have one legitimate move: a utility or service-category message to people you have a genuine existing relationship with, asking whether they want to hear from you on WhatsApp. Keep it short, make the no as easy as the yes, and accept that most of the tier will simply not reply. Silence is not consent. Numbers that go quiet stay quiet.
Some businesses find that a large share of their database is unusable at this point. Uncomfortable as that is, it is an accurate measurement replacing an optimistic one. We covered why this reset caught so many operators off guard in our breakdown of the policy shift.
Writing the checkbox itself
Now the actual sentence. There is a version of this that reads like a warning label and a version that reads like an invitation, and both can be compliant. The difference is where you put the benefit.
The wording that fails the policy
The most common failing wording we find looks like this: a single checkbox saying "I agree to receive updates and offers", sitting under the terms and conditions link, with the terms doing the work of naming WhatsApp somewhere on page four. This fails twice. The channel is never named at the point of consent. And bundling marketing consent with terms acceptance undermines the consent itself: the EDPB's guidelines presume that consent bundled into terms acceptance was not freely given, which sinks it under GDPR, the UAE's data protection law carries its own consent requirement locally, and Meta's policy reaches the same result through its demand that you comply with applicable law.
The pattern that complies and converts
Structurally, working opt-in wording has four parts in this order: the channel, the message type, the frequency or control, and the exit. Here is the shape, written for a clinic booking form:
Send my appointment reminders and confirmations to this number on WhatsApp. (Separate, unticked box:) Also send me occasional offers and health tips on WhatsApp. You can stop these any time by replying STOP.
Notice what that does. Two separate boxes, because transactional and marketing consent are different things, and obtaining separate opt-in for each message category is one of the best practices in Meta's own guidance. WhatsApp is named in both. The message type is concrete: reminders and confirmations, or offers and tips. The exit is stated up front, which is the single change that most improves tick rates, because the fear people are managing is not privacy in the abstract, it is the fear of being stuck.
For a retail or e-commerce checkout, the same shape with different nouns:
Get order updates and delivery tracking on WhatsApp for this order. / Send me new arrivals and sale alerts on WhatsApp, no more than twice a month. Reply STOP to end at any time.
Why naming the frequency raises the yes rate
Think about how a good pharmacist hands over a prescription. They do not say "take these when you need them". They say one with breakfast, one with dinner, finish the course in seven days. Specificity removes the imagined worst case. An opt-in that says "occasional offers, no more than twice a month" is doing the same job: it replaces an unbounded commitment with a bounded one. It is also a promise, so only write a number you will keep.
Capturing consent where there is no form
Forms are the easy case. The hard cases are in-store, on the phone, and in the DMs.
The reception desk and the paper problem
A salon receptionist writing a client's number on an intake card is capturing data with no consent wording attached unless someone printed it there. If you use paper, the checkbox line has to be on the card, unticked, in the same font size as everything else, with the same four-part structure. Then someone has to key both the number and the consent state into the system on the same day, because a paper tick that never reaches the CRM is not a record you can produce when asked.
Honestly, the stronger fix is to remove the paper. A tablet at the desk with the same two checkboxes, feeding the CRM directly, closes the gap between the tick and the record. It also produces the timestamp your consent record needs without anyone remembering to write one.
Click-to-WhatsApp ads and inbound messages
When someone messages your business first, they have opened a customer service window, and Meta's pricing documentation confirms you can reply freely inside it: non-template messages can only be sent within an open service window, and they are free. What the person has not done is consent to marketing. A person clicking a WhatsApp ad to ask about villa listings has not agreed to receive promotional broadcasts three weeks later. This is the most frequently misunderstood point we deal with, and we unpicked several related misconceptions in our piece on the myths around Meta's policy.
The clean move is to ask inside the conversation, once, at a natural moment. After you have answered their question and been useful, a single line: would you like me to send you new listings in this area on WhatsApp as they come up? Reply YES and I will, or ignore this and I will not. Log the reply as the consent record.
Phone enquiries
Verbal consent is valid but hard to evidence. The workable pattern is a script line the agent reads (I can send your booking confirmation to this number on WhatsApp, is that alright?) plus a field in the CRM the agent ticks during the call. For marketing consent, we do not recommend relying on a verbal yes. Send the confirmation, and let the confirmation carry a link or a quick-reply button that captures the marketing opt-in in writing.
Storing consent so it survives an audit
An opt-in you cannot prove is an opt-in you do not have. Every consent record needs five fields: the phone number in full international format, the consent type (transactional or marketing), the timestamp, the source (which form, which desk, which conversation), and the exact wording version the person saw. That last field is the one everybody skips and the one that saves you, because wording changes and you need to know which sentence a given person agreed to.
Keep a versioned copy of every opt-in string you have ever used, with the dates it was live. It costs nothing and it turns a difficult conversation into a lookup.
Opt-outs go in the same place. When someone replies STOP, the marketing consent flag flips immediately and the transactional flag is a separate decision. Someone who stops promotions usually still wants their appointment reminder. Treating STOP as a nuclear opt-out from all messaging is a mistake we see in half-built systems, and it generates angry calls to reception on the morning people miss appointments.
When this opt-in playbook does not fit
We would be selling you something if we pretended this approach works everywhere. It does not.
The two-checkbox pattern hurts very short forms
If your entire conversion is a name, a number, and a button, adding two checkboxes adds two decisions to a form designed to have none. For high-volume, low-value lead capture (a competition entry, a downloadable price list), the extra field slows people down. Our answer there is to make the transactional consent implicit in the action itself, with a plain line of text rather than a box (we will send your price list to this number on WhatsApp), and to move the marketing opt-in into the first conversation instead. You will collect fewer marketing consents. The ones you collect will be worth more.
Businesses that should not run WhatsApp marketing at all
Some categories are a poor fit regardless of how good your wording is. If your service is sensitive enough that a message appearing on a shared family phone screen would embarrass the recipient (certain medical, legal, and financial services), the correct decision is transactional messaging only, with neutral wording and no promotional layer. We have talked more than one clinic out of a marketing broadcast programme for this reason. The revenue was real. The risk was worse.
Equally, if you cannot commit to a human answering within business hours, do not collect marketing consent. An offer message that generates a reply nobody reads is worse than no message. Our view on automation has not changed: AI should free your staff to have better conversations rather than stand in for conversations nobody is available to have. Clients pay premium prices for human expertise, and an automated sequence that dead-ends when someone actually engages destroys the exact trust the opt-in was meant to build.
What goes wrong at multi-branch scale
At a few hundred contacts, a manual consent tier works. At tens of thousands across multiple branches, three things break. Duplicate numbers with conflicting consent states, because the same person booked at two locations. Staff-created records that bypass the form entirely, because a manager exported a list from a supplier. And template messages that drift out of category, where a marketing offer gets submitted as a utility template and sits fine until it does not.
The fix for the first two is a single source of truth for the consent flag, enforced at the database level rather than left to goodwill. The fix for the third is that whoever writes templates and whoever holds the consent policy have to be the same person or talk weekly. When they are not, the follow-up sequence becomes the thing that damages you, which is why we argue the sequence design matters more than the chatbot in follow-up sequences.
Verifying that the opt-in actually works
Two kinds of verification, and you need both.
The compliance check is a paper exercise. Pick five random numbers from your marketing tier and try to produce, in under two minutes each, the timestamp, the source, and the exact wording they agreed to. If you cannot, the problem is your storage rather than your wording. Then send a test marketing template to an internal number and confirm the STOP reply flips the marketing flag and leaves the transactional flag alone.
The conversion check is a numbers exercise. Track the percentage of people completing your form who tick the marketing box, per source, per week. Watch it after every wording change. If the transactional box gets ticked far more often than the marketing one, that is normal and healthy. If almost nobody ticks marketing, your wording is either too vague about the benefit or too vague about the exit, and the exit is usually the problem.
Then watch the two numbers that tell you the truth over time: your WhatsApp quality rating and your block rate. Clean consent shows up there before it shows up anywhere else. Learnmind builds WhatsApp and AI phone systems for clinics, salons and agencies from our base in Dubai, and when we audit a WhatsApp setup the block rate is the first thing we look at, because it tells us what the customer thought of the opt-in regardless of what the checkbox said.
Common questions, answered
Does Meta require double opt-in for WhatsApp marketing messages?
No. Meta's opt-in rules require permission from the recipient before business-initiated messages go out, but a confirmation reply is nowhere mandated. Double opt-in is a best practice that strengthens your evidence and improves list quality, and we recommend it for marketing consent collected outside a form.
Can I message customers on WhatsApp if they gave me their number when booking?
You can send them service messages related to that booking, such as confirmations and reminders, if the wording at the point of collection covered it. Promotional messages need their own opt-in, because marketing is a different purpose from servicing a booking and consent under data-protection law is specific to the purpose disclosed when it was collected.
What happens if I send WhatsApp marketing without proper opt-in?
Recipients block or report the number, which lowers your quality rating. Meta's messaging limits documentation makes limit increases conditional on sending high-quality messages, so a low rating freezes your messaging limit where it is, and under the Business Messaging Policy Meta may limit or remove your access to the WhatsApp Business Services if you receive significant amounts of negative feedback. The commercial damage usually arrives before any policy action does, because a blocked number cannot deliver appointment reminders either.
Does an email marketing consent cover WhatsApp messages?
No. If the consent wording said "updates from us" or named email without naming WhatsApp, it does not transfer. Under the EDPB's consent guidelines, consent is specific to the purpose and channel disclosed at collection, so a new channel needs fresh consent. Naming WhatsApp in your wording is the safe application of Meta's opt-in guidance rather than something Meta demands verbatim, and those contacts belong in a re-permission flow before anything commercial goes to them.
Here is a simple next step. Copy your current opt-in text, exactly as it appears on your live form or intake card, and send it to hello@learnmind.ai for a free look. One sentence is usually enough for us to tell you whether it names the channel, separates marketing from service messages, and would survive a request to prove consent.
