Compliance & ContractsFree templatePDF, Excel, Word export

WhatsApp Opt-In Policy Template for Business Messaging

Meta requires businesses to obtain opt-in before sending business-initiated WhatsApp messages, and privacy laws add their own consent duties. This template gives you an internal policy that documents how you ask, what you send and how people stop it.

Fill in

Company name

Policy owner

Effective date

Business WhatsApp number

Primary jurisdiction

Privacy law reference

Name the law that applies to your recipients, for example GDPR or CCPA.

Where consent is collected

Permitted message types

Opt-out keywords

Consent record retention

Live preview

Download:

WhatsApp Opt-In Policy Template

WhatsApp Business Messaging and Opt-In Policy

Company: Acme Precision Ltd Policy owner: IT Manager Effective date: 2026-11-01 Business number: +91 98123 45678 Jurisdiction: India

1. Purpose and scope

This policy sets how Acme Precision Ltd collects permission to contact people on WhatsApp, what we send, and how we honor requests to stop. It applies to employees, contractors and integrations that send messages from +91 98123 45678. We follow the WhatsApp Business Messaging Policy and applicable law, including the Digital Personal Data Protection Act 2023.

2. Obtaining opt-in

We only send business-initiated messages to a person who has given clear permission to receive them on WhatsApp from Acme Precision Ltd. Consent must be specific to WhatsApp, say what types of messages to expect, and be given by an affirmative action. Pre-ticked boxes and bundled consent are not accepted.

Approved collection points: Order form checkbox, customer portal profile page, supplier onboarding form, inbound WhatsApp conversation started by the contact.

3. Permitted message types

Order and shipment updates, invoice and payment reminders, delivery scheduling, service appointment confirmations.

Marketing messages require separate consent from transactional messages. Anything outside the permitted list needs written approval from the policy owner before sending.

4. Consent wording

Suggested text at the point of collection: "I agree to receive messages from Acme Precision Ltd on WhatsApp at the number I have provided, about my orders, deliveries and account. I can stop at any time by replying STOP."

5. Opt-out

Contacts can opt out by sending any of these keywords: STOP, UNSUBSCRIBE, CANCEL. We stop business-initiated messages immediately, confirm once, and update every system that holds the contact. Opt-outs must be processed before the next scheduled send and are never reversed without new consent.

6. Records and retention

For each contact we store the phone number, date and time of consent, collection point, wording version, and any opt-out. Records are kept for the life of the relationship plus 3 years and are available to auditors and regulators on request.

7. Data protection

Messages must not contain sensitive personal data, full payment details, passwords or confidential commercial terms. Access to the WhatsApp account and API tokens is restricted to named staff and reviewed quarterly.

8. Quality and enforcement

We monitor block and report rates and message quality ratings. Teams that send without valid consent lose sending rights until retrained. Breaches are reported to the policy owner.

Approval

Policy owner / Date

Legal or compliance reviewer / Date

Head of customer service / Date

This is a starting point and not legal advice. Consent rules differ by country and by law, and WhatsApp's own policy changes. Have counsel review before publishing, and align the wording with your privacy notice.

Add a consent gate to your ERP messaging

Optional: we can show how to store consent on the contact and check it before every send.

Optional. The tool and every export work without this. No spam.

How to use the template

Complete the fields with your company details, the places where you actually capture consent and the message types you really send. Review the generated policy with your privacy or legal lead, then circulate it to teams that own order, service and finance communications. Store it with your WhatsApp Business Account documentation. The suggested consent sentence can be pasted into forms and portal screens, and you should keep a version history because auditors ask which wording a contact saw.

What good opt-in looks like

Good consent is specific, informed and recorded. The person knows it is WhatsApp, knows who will message them and about what, and can refuse without losing the core service. A phone number simply sitting in your ERP customer master is not proof of consent. For supplier and B2B contacts the same expectation applies to the individual receiving messages, even where the relationship is commercial.

Say WhatsApp explicitly in the consent text
Name the message types
Capture date, time and source
Keep opt-out as easy as opt-in

Common mistakes

Companies frequently import an old contact list and message it, reuse email consent for WhatsApp, forget to honor opt-outs in a second system, or send marketing under a transactional consent. Another common gap is no consent field in the ERP, so integrations cannot check permission before sending. Add a consent flag, timestamp and source to the contact record and block sends when it is missing.

Frequently Asked Questions

Is opt-in mandatory for WhatsApp Business?

Yes. WhatsApp's business policy requires that people opt in before you message them first, and many privacy laws require consent as well. Messages inside a window the customer opened are a separate case.

Can I collect opt-in through a phone call?

Meta allows several methods including verbal consent, but you should record it with date, agent and wording. Written or digital capture is easier to prove later.

Does one opt-in cover marketing and alerts?

Best practice is separate consent for marketing, because expectations differ and regulators look at purpose. Keep the two flags separate in your system.

How long must I keep consent records?

There is no single rule. Keep them at least as long as you message the person, and often longer for dispute defence. Set the period with your legal adviser.

If your ERP integration should check consent before every send, Netray can build that gate into the messaging layer.

Talk to an Expert Explore More Free Tools

Related Tools

Developer Tools

More Compliance & Contracts tools

See all

Back to All Tools