Updated on October 28, 2026
Meta’s policy does not allow cold outreach on WhatsApp: a business may only message people who have given their number and permission to receive messages from that business. This applies to B2B too, because on the other end there is a person with a phone. Outbound prospecting on WhatsApp works when first contact happens in another channel (LinkedIn, email, an event, an ad), the lead opts in or starts the conversation, and only then does the business send an approved template.
This article covers what the policy says, what does and doesn’t count as permission, the flow from LinkedIn to template, the risks to your number and a sample cadence.
What Meta’s policy says
The WhatsApp Business Messaging Policy, updated September 23, 2026, has four rules that shape prospecting:
- Opt-in. You may only contact people who gave you their mobile number (or username) and agreed to receive messages or calls from your business.
- Opt-out. Requests to stop, made on or off WhatsApp, must be honored, including removal from your contact list.
- No surprises. The business must not confuse, surprise, deceive or spam people.
- Templates outside the window. Outside the 24-hour customer service window, only approved message templates are allowed.
The Get opt-in for WhatsApp page details what the opt-in must include: make clear the person is agreeing to receive communications from the business, state the business name, and comply with applicable law. The opt-in can be general and doesn’t need to mention WhatsApp. The method (website, SMS, phone, paper) is up to you.
In practice: having the number is not permission. A cell number on the target company’s website, in a business database or on a LinkedIn profile does not authorize a message.
Cold outreach vs opt-in: what counts as permission
| Situation | Can you message on WhatsApp? | Why |
|---|---|---|
| Purchased list or numbers scraped from public sources | No | The person never gave your business permission |
| Number found on a LinkedIn profile or company website | No | A public number is not opt-in |
| Business card exchanged at an event | Only after asking for consent | Handing over a card doesn’t clearly agree to messages |
| Form with a WhatsApp field and consent text | Yes, within what was accepted | Meets Meta’s three requirements |
| Lead replies to an email: “feel free to WhatsApp me” | Yes, keeping the email as proof | Clear permission given to your business |
| Lead taps a link or ad and writes first | Yes, reply within the 24-hour window | The lead started the conversation |
| General opt-in to “communications from Company X” with a cell number | Yes | Opt-in can be general, without mentioning WhatsApp |
If the lead says “no thanks” in any channel, the policy requires you to respect it.
Want to try it while you read? Create a Vectalk account and send your first message through the official API. Create free account →
The flow that works: from LinkedIn to template
The idea is to use channels where cold outreach is common to bring the lead to a consent point. After that, WhatsApp becomes the fastest channel for the conversation.
- First contact outside WhatsApp. A LinkedIn message, email, call or event conversation, following each channel’s rules.
- A value offer. An assessment, a resource, a demo. Something that justifies the conversation.
- Consent point. A
wa.melink with a pre-filled message (the lead starts the chat) or a form with a phone field and consent text. - Proof on record. Date, source, accepted text and, if available, the message ID.
- Approved template. If the lead filled out the form but didn’t write, the first message is a template.
- Conversation in the window. When the lead replies, the 24-hour window opens and the SDR chats with free-form messages.
The cleanest path is step 3 with a link: the lead taps, WhatsApp opens with the message ready, and they send it. There is no doubt about who started. An invitation line for your email signature or LinkedIn:
“If you prefer, message me on WhatsApp and I’ll send the assessment there: wa.me/15551234567?text=I%20want%20the%20assessment”
For the form, a B2B consent text:
“I agree to be contacted by Sample Co. on WhatsApp about the assessment I requested. I can opt out at any time by replying STOP.”
Store the record with the lead in your CRM:
{
"wa_id": "15551234567",
"lead_company": "Alpha Manufacturing",
"optin": {
"purpose": "sales_contact",
"source": "assessment_landing_page",
"accepted_text": "I agree to be contacted by Sample Co. on WhatsApp about the assessment I requested.",
"accepted_at": "2026-10-28T10:12:00-04:00"
},
"optout": null
}The article how to build a WhatsApp opt-in list has more collection and record formats.
Which template to use for the first message
A sales message is marketing. The template categorization documentation is clear: utility cannot contain promotional content or try to sell; when in doubt, Meta classifies it as marketing and can recategorize approved templates. Marketing is the most expensive category; for recipients in Brazil, for example, each delivered marketing template costs R$ 0.3217 (Brazilian reais) since October 1, 2026. Rates for other countries are on Meta’s pricing page.
A first-contact template that respects the “no surprises” rule:
“Hi {{1}}, this is {{2}} from Sample Co. You requested our {{3}} assessment on our website. Can I send it here and book 15 minutes to walk you through the results?”
With two quick reply buttons: “Send it” and “Not interested”. The second one is your opt-out: when the webhook arrives with that button, flag the lead and stop. The template library by industry has more examples.
Three things to watch:
- Person’s and company’s names in the text. The recipient must recognize where the message came from.
- Reference to the source. “You requested”, “we met at event X”. This reduces blocks.
- One question only. It makes replying easy and opens the window.
Risks to your number
Cold outreach is not just a rules issue. It generates blocks and reports, and Meta measures them.
| Risk | What happens | Source |
|---|---|---|
| Low quality | Templates paused and, if it repeats, disabled | Phone number quality rating |
| Stuck limit | A new portfolio stays at 250 unique recipients per 24 h; automatic scaling requires high-quality messages | Messaging limits |
| Per-user limit | People who receive a lot of marketing won’t get yours (error 131049) | Per-user marketing limit |
| Messaging restriction | 1 or 3 days without templates; 5, 7 or 30 days without any messages; indefinite lock | Policy enforcement |
| Offboarding | Accounts that don’t change after warnings and restrictions can be removed from the platform | Policy enforcement |
Meta’s opt-in page also says WhatsApp may rate limit businesses whose quality stays low for a sustained period, and that users can block, report or stop marketing from a specific business. Switching numbers doesn’t help: the limit belongs to the portfolio.
Suggested cadence for B2B prospecting
Meta doesn’t define a cadence. The one below is our suggestion, designed to keep quality high, and a starting point to tune with your own data:
| When | Channel | Action |
|---|---|---|
| Day 0 | LinkedIn or email | First contact with a value offer and a wa.me link |
| Day 0 (after consent) | Marketing template referencing the source, with an opt-out button | |
| If they reply | Free-form chat in the 24-hour window; book the meeting there | |
| No reply, day 3 to 5 | One shorter follow-up template, with the same opt-out button | |
| Still no reply | Email or LinkedIn | Stop on WhatsApp and go back to the original channel |
| “Not interested” or “STOP” | All | Immediate opt-out in the CRM |
Rules that go with the cadence:
- At most two unanswered templates per lead.
- The lead’s business hours, on weekdays.
- One SDR per lead, so the prospect doesn’t get messages from two people at your company.
- Monitor the number’s quality in WhatsApp Manager during the first week of each new lead source, as Meta itself recommends when launching a new opt-in method.
What about privacy law?
B2B contact with people at other companies involves personal data (name and cell number). In Brazil, Law 13,709/2018 (LGPD, Brazil’s data protection law) requires a legal basis for processing; Article 7 lists them, including consent and legitimate interest. In the EU, the GDPR plays a similar role. But note: even if your legal team concludes there is a legitimate interest, WhatsApp’s policy still requires opt-in before messaging. The two sets of rules add up. This text is not legal advice; the article LGPD and WhatsApp goes deeper.
How to do it with Vectalk
Vectalk is a proxy for the official WhatsApp Cloud API: same payloads and webhooks as Meta. For B2B prospecting, the useful features are:
- QR codes with a pre-filled message, created via API (
POST /api/qr-codes), for slides, booths and printed materials. The lead scans and starts the conversation. - Template sending with
POST /api/messages, using Meta’s JSON format. - Webhooks to log the “Not interested” button and every reply in your CRM.
The docs are at docs.vectalk.com.br and you can sign up at apps.vectalk.com.br/register. If you are still evaluating the API, start with our WhatsApp Cloud API guide.
Frequently asked questions
Can I message a number I found on LinkedIn?
No. A public number is not opt-in. Use LinkedIn for first contact and offer a link so the lead can start the conversation on WhatsApp.
Can an opted-in email list become a WhatsApp list?
Yes, if the consent was to receive communications from your business, naming it, and the person gave you their cell number. Meta accepts general opt-in without mentioning WhatsApp. If the consent was only for an email newsletter, ask again.
Can I use a utility template for prospecting, since it’s cheaper?
No. Sales content is marketing, and Meta can recategorize the template and restrict new utility templates for businesses that keep misusing the category.
What if the lead messaged me from an ad?
Someone who taps a click-to-WhatsApp ad and writes has started the conversation. You can reply freely within the 24-hour window; after that, only with templates and within what they agreed to. See how to track click-to-WhatsApp ads.
Can I reach out using someone’s WhatsApp username?
The policy treats a username like a number: only with permission. We explain the change in WhatsApp usernames and BSUID.
Official sources checked on October 28, 2026: WhatsApp Business Messaging Policy (updated September 23, 2026), Get opt-in for WhatsApp, Template categorization, Messaging limits, Policy enforcement, Pricing, Law 13,709/2018 (LGPD).
Put your business on the official WhatsApp
Create your account, connect your number to the official API (you can keep the app with coexistence) and start serving customers and sending messages.