WhatsApp opt-in and data protection law: how to ask for consent and send safely

WhatsApp opt-in: what it is and why Meta and data protection law require it

WhatsApp opt-in is the permission a person gives to receive messages from a company, and the Official API requires you to obtain it before sending any message outside the 24-hour window. For Meta, the opt-in must make clear the person wants to receive communications and from which company. For Brazilian data protection law (LGPD), processing a phone number needs a legal basis, and consent is the most used one in marketing.

The two rules complement each other. Meta defines whether your account can send the message and the law defines whether you may use that data for it. Complying with only the first leaves the company exposed, and complying with only the second does not protect your number quality. This article is a practical guide and does not replace legal advice for your case.

What Meta requires from the opt-in

Meta policy asks three things of any opt-in. If you meet all three, the method you choose is accepted:

• Make clear the person is agreeing to receive communications from the business
• State the name of the business the person is agreeing to receive messages from
• Comply with applicable law, which in Brazil includes the LGPD

Since the policy update in November 2024, opt-in can be general, without mentioning WhatsApp specifically, as long as the business complies with local law. Meta lists as example methods a website, SMS, phone service (IVR) and a paper signed in a physical store. The choice of method is the business, and so is the responsibility to prove consent exists.

Meta also recommends asking for separate opt-in by message category (for example, order updates and offers), offering clear instructions to stop receiving messages and honoring that request. Without control over this, the quality rating drops and the account can have its sending limit reduced.

What the LGPD requires from consent

The LGPD (Law 13,709/2018) defines consent as the free, informed and unambiguous statement of the data subject, for a specific purpose (art. 5, XII). In marketing practice, that means four precautions:

• Clear purpose: say the phone number will be used to send WhatsApp messages, and about what
• Affirmative act: the person must tick or click, and a pre-ticked box does not prove consent
• No generic authorization: wording that is too broad, covering "any use", is void (art. 8, paragraph 4)
• Easy revocation: the person can withdraw consent at any time, through a free and simple procedure (art. 8, paragraph 5)

There is also an obligation that is often forgotten: the burden of proof lies with whoever collects (art. 8, paragraph 2). If the person says they never authorized, the company must show when, where and with what text consent was given.

Consent or legitimate interest: which basis to use on WhatsApp

For marketing messages, consent is the safest basis. Legitimate interest (art. 7, IX) exists in the law and can be used in some cases, such as communicating a recent purchase to someone who just bought, but it requires a documented balancing test and cannot override the reasonable expectations of the person.

A simple rule helps: a message the customer expects to receive because of what they just did (purchase confirmation, product access) has a firmer basis. An offer message to someone who only left their contact on an old form needs consent. When in doubt, ask for consent.

How to collect opt-in in practice

The best opt-in is the one the person gives at the moment they hand over their phone number, in short, specific wording. The most common collection points are:

• Store or sales platform checkout, next to the phone field
• Lead capture form and launch sign-up page
• WhatsApp link with a starting message, where the person writes first and opens the conversation
• In-person or phone service, with a record of the acceptance

A consent text that meets the requirements, to place next to an unticked box: "I want to receive WhatsApp messages from Example Store with order updates and offers. I can stop receiving them at any time by replying STOP." It says what, from whom and how to leave.

When the person writes first, the 24-hour service window opens and you can reply freely inside it. The Claryflow link generator creates a link with a ready starting message, which helps capture leads who arrive on their own initiative.

How to prove consent later

Consent you cannot prove is worth little. For each contact, keep four pieces of information: the date and time, the exact text shown, the channel or form of origin, and the contact identification (phone and, if available, e-mail).

In a CRM this becomes structured data. Use a consent-source tag (checkout, form, WhatsApp link) and record the date. That way you can segment campaigns only to people who agreed and respond quickly to a data subject request.

How to handle a request to stop receiving messages

When someone asks to leave, remove the contact from campaigns right away and confirm with a short message. Insisting after the request is the fastest way to get reported, and reports lower the number quality rating. Meta also lets users stop receiving marketing messages from a company themselves, so the easier it is to leave your list, the lower the chance the person blocks you.

• Accept simple variations, such as "stop", "unsubscribe", "cancel" and "I do not want this anymore"
• Apply an exclusion tag and take the contact out of every future broadcast
• Keep a record that the person asked to leave, so you do not re-add them by mistake in a future import
• Review frequency and content if opt-out requests rise after a campaign

Who is the controller of your leads data

The company that collects the phone number and decides to send messages is the controller of that data and answers for consent. The platform that stores and sends on its behalf acts as the processor. In Claryflow, that is the role of the platform regarding customer lead data: Claryflow carries out the sending, and the legal basis and opt-in text remain the responsibility of whoever collects.

That is why the design of the form and checkout matters as much as the broadcast tool. The details of how Claryflow handles data are in the Privacy Policy.

How Claryflow helps keep opt-in organized

In Claryflow, each lead enters the CRM with the source and tags you define, and broadcast campaigns are segmented by tag, so you send only to people who agreed to receive. All sending goes through Meta Official API, with approved templates and a tracked quality rating.

FAQ

Do I need opt-in to send WhatsApp messages?

Yes. Meta requires opt-in before messages outside the 24-hour window, and the LGPD requires a legal basis to use the phone number, with consent being the most common in marketing.

Can I message people who are on my contact list?

Only if those people authorized receiving messages from your company. Having the number in a list, spreadsheet or phonebook is not opt-in.

Does the opt-in have to mention WhatsApp?

Not necessarily. Since November 2024 Meta accepts general opt-in, as long as it makes clear the person wants to receive communications from the business, states its name and complies with local law. Mentioning WhatsApp makes the consent more specific and easier to defend.

Who is responsible for consent, the company or the broadcast platform?

The company that collects the phone number. It is the controller and answers for the legal basis and the opt-in text. The platform acts as the processor and carries out the sending.