Channels
WhatsApp: opt-in, opt-out and consent
How consent to receive WhatsApp messages is captured and recorded for each customer, how opt-outs are honoured before any further message, and why this protects your number.
On this page
Customers who have agreed to hear from you read your messages. Customers who have not tend to block or report them, and on WhatsApp that has consequences for your number. The agent holds a consent record for every customer, checks it before any outbound message, and honours an opt-out before any further message is sent, on the channels and message types you define. Your legal team decides the rules, and every decision the agent makes against them is on record.
What Meta requires
Meta's rules for the WhatsApp Business Platform (the service Meta provides for businesses to message customers at scale) require a business to have a customer's agreement before messaging them first. In plain terms, the customer must:
- agree to receive messages from your business on WhatsApp;
- be told the name of the business they are agreeing to hear from;
- be able to opt out of the kinds of message they no longer want, and have that request honoured.
Meta accepts consent collected in any way that meets these conditions, such as a website form, a booking flow, a signed form or a conversation. Meta also expects businesses to follow the laws that apply to them, which in the UAE and Saudi Arabia go further, as set out below.
A customer who messages you first can receive replies within the 24-hour customer service window. That is a service conversation, not agreement to receive reminders or offers later.
Where consent comes from
| Source | Example | How it reaches the consent record |
|---|---|---|
| A form on your website or app | A buyer registers interest in a launch and ticks "Send me updates on WhatsApp" | Read from your CRM (the system that holds your customer records) or the form's system |
| A booking or purchase | A guest ticks a box for WhatsApp updates when booking a stay | Read from your booking or reservation system |
| A signed agreement | A policyholder's proposal form includes WhatsApp as a contact preference | Read from your policy administration system |
| A conversation with the agent | A caller asks to receive their claim reference on WhatsApp, and agrees to updates | Captured by the agent, with the wording and the customer's answer |
| Your team | A relationship manager records a buyer's preference after a meeting | Entered in your CRM, and read from there |
Consent your team already holds is used as it stands. The agent does not treat a phone number in your CRM as agreement to message it.
How consent is recorded
Consent is held against each customer in the customer record, and checked before any outbound message. For each customer, the record shows what they agreed to, on which channel, when, and where the agreement came from.
Opt-outs, honoured before any further message
Customers rarely write "STOP". They write "please don't message me about this", "لا ترسلوا لي عروض" ("don't send me offers"), or tap a button. The agent recognises an opt-out in the customer's own words, in Arabic, English or another language the agent works in, records it against the customer, and confirms it to them in the same conversation.
The opt-out is applied before any further message, on the channels and message types you define. You decide the scope in advance with your legal team. A customer who opts out of offers on WhatsApp can still receive updates on a claim or a booking they already have, if your rules allow. A customer who asks to stop all messages receives none.
Opt-outs and suppression lists (lists of people your organisation must not contact) held in your own systems are honoured in the same way. See Contact rules for outbound messages and calls.
The checks before every outbound message
Before the agent sends any outbound WhatsApp message, it checks that consent is on record for that message type, that the customer has not opted out, that the message falls within your sending hours, and that the template is approved. If any check fails, the message is not sent, and the reason is recorded. See Message templates and outbound messages.
Why consent protects your number
Meta gives every business number a quality rating (Meta's measure of how customers respond to your messages), based on signals such as how often customers block or report the number. When the rating falls, Meta can limit how many customers the number can contact first and pause templates that customers respond poorly to. Sustained poor quality can lead to further restrictions.
Messages sent only to customers who asked for them, on topics they asked about, keep the rating healthy. That is the practical reason to be strict about consent, alongside the legal one.
| Practice | Why it helps |
|---|---|
| Send outbound messages only with consent on record | Customers expect the message, so they rarely block or report it |
| Keep service updates and offers separate | A customer can refuse offers without losing updates they value |
| Offer an easy way out in marketing messages | Customers use it instead of blocking the number |
| Respect your sending hours | Messages arrive when customers are willing to read them |
How this fits with UAE and Saudi rules
In the UAE, the Federal Decree-Law on the Protection of Personal Data sets rules on processing personal data, including for marketing, and the UAE's telemarketing rules cover marketing messages sent by SMS and messaging apps as well as calls, including when they may be sent. In Saudi Arabia, the Personal Data Protection Law and its implementing regulations, overseen by SDAIA (the Saudi Data and Artificial Intelligence Authority), set rules on consent for marketing and a person's right to withdraw it.
Your organisation is responsible for its own compliance, and should take legal advice on the rules that apply to its messages. The product helps you apply the rules you set: consent is recorded per customer and per message type, opt-outs are honoured before any further message, sending hours are enforced, and every check is on record. We will walk your legal team through exactly how the product handles this. See Contact rules for outbound messages and calls and Data protection in the UAE and Saudi Arabia.
This section is general information about Meta's rules and regional law, not legal advice.
In practice
Qamar Stays, a hotel group in Abu Dhabi, sends pre-arrival messages and seasonal offers on WhatsApp.
- Karim books a stay on the group's website and ticks the box for WhatsApp booking updates. He leaves the offers box unticked. Both answers reach his consent record from the booking system.
- Three days before arrival, the agent checks his record and sends the approved pre-arrival template. He replies to request a late check-out, and the agent arranges it.
- The group launches a winter offer. Karim has no consent for offers, so he is not included, and the reason is recorded.
- Later, after ticking the offers box on a second booking, he receives an offer and replies "no more offers please". The agent records the opt-out for offers on WhatsApp and confirms that he will still receive booking updates.
- His next pre-arrival message goes out as normal. No offer does.
What your team controls
- The message types customers can agree to and opt out of, such as booking updates, claim updates and offers.
- The scope of each opt-out: one message type, one channel, or all messages.
- Where consent is read from in your systems.
- The wording the agent uses to ask for and confirm consent.
- Your sending hours, and your suppression lists.
Related
- Contact rules for outbound messages and callsLegal and compliance
- WhatsApp: message templates and outbound messagesChannels
- WhatsApp: overviewChannels
- Data protection in the UAE and Saudi ArabiaLegal and compliance
- The customer record: overviewCustomer record
Product names and logos are trademarks of their owners. Their mention shows systems Telonic connects to and does not imply partnership or endorsement.