How to build a WhatsApp opt-in list (and keep it healthy)

Updated on October 25, 2026

WhatsApp opt-in is the permission a person gives to receive messages from your business. Under Meta’s rules, it must make clear that the person is agreeing to receive communications, name the business, and comply with local law; the collection method (website, SMS, phone, paper) is up to you. A healthy opt-in list is one where every contact has proof of when and how they agreed, opt-outs are honored immediately, and people who no longer read stop receiving messages.

This guide covers the official rules, seven ways to collect permission, what to store in your database, and the routines that keep the list clean.

What Meta requires

The Get opt-in for WhatsApp page says businesses may contact people on WhatsApp if (a) they have given their mobile phone number and (b) the business has received opt-in permission confirming they want to receive messages or calls from that business. There are three requirements:

1. Clearly state that the person is opting in to receive communications from the business.
2. Clearly state the business’s name.
3. Comply with applicable law.

Since the November 2024 policy update, opt-in can be general and doesn’t have to mention WhatsApp specifically, as long as it complies with local law.

The WhatsApp Business Messaging Policy (updated September 23, 2026) adds the other half of the rule: businesses must honor all requests to stop receiving messages, whether made on or off WhatsApp, and messages must not confuse, surprise or deceive recipients.

In short: having the number isn’t permission. A purchased list, numbers scraped from groups, or old records without consent are not opt-in.

General opt-in or per category?

Meta accepts a general opt-in, but the same page recommends as best practice:

• obtaining an opt-in that covers the categories of messages the business will send (order updates, offers, recommendations), or
• obtaining separate opt-ins per category, which reduces the risk of blocks caused by unexpected messages.

In practice, the per-category model is better for the list. Someone who agreed to “order status” and gets offers every week will block you; someone who agreed to “offers” expects them. Separate at least two purposes:

Purpose	Examples	Template
Transactional	Orders, delivery, billing, appointments, course access	Utility
Promotional	Offers, launches, news, invitations	Marketing

To see where each message fits, read event reminders: utility or marketing.

Want to try it while you read? Create a Vectalk account and send your first message through the official API. Create free account →

Seven ways to collect opt-in

Meta lists SMS, website, phone (IVR) and in person or on paper as supported examples. These are the most common methods in practice, all within those requirements:

1. Checkbox at checkout or sign-up. Unchecked by default, with the business name and purpose in the text.
2. Lead capture form (landing page). The WhatsApp field comes with a consent sentence right below it.
3. Customer-initiated conversation. The person messages you (through a link, QR code or ad). Within the 24-hour window you can reply freely. To send templates later, ask for permission right there, with buttons.
4. QR code at the point of sale. The QR opens a chat with a pre-filled message; the business’s first reply asks for confirmation.
5. SMS or email to your current base. “Reply YES to get updates from Example Store on WhatsApp.” Store the reply.
6. Phone or IVR. The agent or IVR asks and records the answer, with date and recording when available.
7. Signed paper form. A sign-up form at the store or clinic, with an authorization field.

Consent copy that meets all three requirements:

“I want to receive order updates and offers from Example Store on WhatsApp. I can cancel anytime by replying STOP.”

Asking for opt-in inside the chat

When the customer starts the conversation, use quick reply buttons to record their choice in one tap:

{
  "messaging_product": "whatsapp",
  "to": "5511988887777",
  "type": "interactive",
  "interactive": {
    "type": "button",
    "body": { "text": "Would you like to get order updates and offers from Example Store here? You can opt out anytime." },
    "action": {
      "buttons": [
        { "type": "reply", "reply": { "id": "optin_all", "title": "Orders and offers" } },
        { "type": "reply", "reply": { "id": "optin_orders", "title": "Orders only" } },
        { "type": "reply", "reply": { "id": "optin_no", "title": "No, thanks" } }
      ]
    }
  }
}

The answer arrives in the webhook as interactive.button_reply.id. For fuller forms (name, email, preferences), WhatsApp Flows has a dedicated consent component, OptIn.

Confirming opt-in collected elsewhere

If consent came from your website or email, Meta allows a confirmation message as a utility template, under the “Opt-In Management on WhatsApp” row of the categorization documentation. The official example reads: “Thanks for confirming opt-in! You’ll now receive notifications via WhatsApp.” Opt-out confirmations fall under the same row.

What to store as proof

Store consent with the contact, with enough detail to show when, how and for what the person agreed:

{
  "wa_id": "5511988887777",
  "consents": [
    {
      "purpose": "transactional",
      "source": "website_checkout",
      "accepted_text": "I want to receive order updates from Example Store on WhatsApp.",
      "text_version": "2026-09",
      "accepted_at": "2026-10-12T14:32:10-03:00",
      "ip": "200.0.0.10"
    },
    {
      "purpose": "promotional",
      "source": "whatsapp_button",
      "reply_wamid": "wamid.HBgN...",
      "accepted_at": "2026-10-12T14:40:02-03:00"
    }
  ],
  "optouts": []
}

Good rules for this record:

• Version your consent text. If you change the wording, the old record still points to the text the person saw.
• Store the source. Checkout, form, WhatsApp button, IVR, paper.
• For consent given on WhatsApp, store the wamid of the customer’s reply.
• Never delete an opt-out. Record its date and source; that’s what prevents an accidental re-import.

Depending on where you operate, privacy law also applies. In Brazil, that’s the LGPD (Law 13,709/2018, Brazil’s data protection law). Legal basis, retention and withdrawal of consent are matters for your legal team; the article LGPD and WhatsApp explains the concepts but is not legal advice.

How to keep the list healthy

Collecting is half the work. The other half is removing people who don’t want or no longer read your messages.

Opt-out through every door

• Opt-out button on marketing templates, such as “Stop offers”. The tap reaches your webhook with type: "button"; mark the opt-out immediately.
• Keywords in the chat, such as STOP, UNSUBSCRIBE, CANCEL. Handle variations and reply with a confirmation.
• Requests outside WhatsApp, by email, phone or customer service. The policy requires honoring them too.

Users can also stop marketing from WhatsApp itself

People can stop your business’s marketing messages directly in the app. Meta tells you in two ways:

• the user_preferences webhook arrives with category: "marketing_messages" and value: "stop" (or "resume" when they opt back in), per the webhook reference;
• if you send marketing anyway, the status comes back failed with error 131050, and Meta’s guidance is not to retry.

Sync both with your database: stop removes the contact from marketing audiences, resume adds them back.

Engagement and frequency

• Per-user limit. Error 131049 means Meta didn’t deliver the message to maintain healthy ecosystem engagement. The official guidance is to wait at least 24 hours before resending. Contacts that keep hitting this error are saturated. See per-user marketing limits.
• Inactive contacts. People who haven’t read or replied in months drag your read rate down. Run a reconfirmation campaign (“Do you still want our offers?”) and remove those who don’t answer.
• Frequency cap. Set in your own system how many marketing messages each contact gets per week.
• Quality. Blocks and reports lower your phone number quality rating. Monitor quality whenever you launch a new collection method, as Meta itself recommends.

Monthly routine

Task	How
Remove pending opt-outs	Cross-check buttons, keywords, user_preferences and 131050
Review contacts with frequent 131049	Lower their frequency
Reconfirm inactive contacts	Reconfirmation template; remove non-responders
Audit new sources	Check that the consent text names the business and purpose
Check quality	In WhatsApp Manager, before every large campaign

Before a large send, estimate the cost with how much a WhatsApp campaign costs.

How to do it with Vectalk

Vectalk uses the same payloads and webhooks as the Cloud API, so everything in this guide works the same way:

• Opt-in buttons: POST /api/messages with type: "interactive" (buttons docs).
• QR code with a pre-filled message: POST /api/qr-codes, which returns the wa.me link and the QR image (docs).
• Replies, opt-out buttons and 131050/131049 errors: in the webhook registered with POST /api/webhooks.

Create your account at apps.vectalk.com.br/register.

Frequently asked questions

If a customer messaged me, is that already opt-in?

It gives you the 24-hour window to reply. To send templates later, on the business’s initiative, ask for permission explicitly, with the business name and purpose, and store the answer.

Can I use my old customer database?

Only the contacts who gave permission to receive messages from your business. For the rest, ask for opt-in through a channel where you already have a relationship (email, SMS, at the next purchase) before messaging them on WhatsApp.

Does the opt-in have to mention WhatsApp?

Since the November 2024 update, not necessarily: it can be general, as long as it complies with local law. Naming the channel, though, sets clear expectations and reduces blocks.

How long is an opt-in valid?

Meta doesn’t set an expiry. What matters in practice is engagement: contacts who stopped reading long ago should be reconfirmed or removed.

Can I buy a list that has opt-in?

The opt-in has to be for your business, with its name. Permission given to another company doesn’t meet the requirement, and lists like that tend to generate blocks and reports.

---

Official sources checked on October 25, 2026: Get opt-in for WhatsApp, WhatsApp Business Messaging Policy (updated September 23, 2026), Template categorization, user_preferences webhook, Error codes, Flows components, Law 13,709/2018 (LGPD), Vectalk: QR codes.