WhatsApp opt-in: getting permission that actually holds
Opt-in is not a checkbox you can point at later. It is the mechanism that protects your number's ability to send at all, and the enforcement is automatic.
Key takeaways
- Enforcement is mechanical: blocks and reports lower your quality rating and reduce how many people you may message.
- Valid opt-in names the business, names the channel, states the content type, and is recorded with a timestamp.
- Honour stop requests written as ordinary sentences in either language, not only exact keywords.
- Saudi and UAE data protection regimes apply to conversation content; decide storage and retention deliberately.
WhatsApp requires that you obtain opt-in before messaging a customer, that the person understands they are opting in to messages from your business specifically, and that opting out is easy. Enforcement is not primarily regulatory; it is mechanical. Recipients who block or report you lower your number's quality rating, and a low rating reduces how many customers you are permitted to message.
What a valid opt-in looks like
- The business is named. Consent to be contacted by an unnamed party is not consent to be contacted by you.
- The channel is named. The person agreed to receive WhatsApp messages, not to be contacted generally.
- The content type is clear. If you will send promotions as well as order updates, say so. Consent for delivery notifications is not consent for weekly offers.
- It is recorded with a timestamp and source. When a complaint arrives, you need to show when and where permission was given.
Where opt-in is collected well
The best opt-in is a customer messaging you first, which is unambiguous and costs nothing. After that: a clearly labelled checkbox at checkout that is not pre-ticked, a form field where the number is collected with the purpose stated beside it, and click-to-message advertising where the act of messaging is itself the consent. Each of these produces a record you can point to.
What does not work is importing a list of numbers collected for another purpose. A phone number given for delivery coordination is not permission to market, and treating it as such produces exactly the block rate that damages the channel.
Opting out has to be easy
Honour stop requests in whatever form they arrive, including a plain sentence in Arabic or English rather than a specific keyword. Customers will not read instructions; they will type stop, or unsubscribe, or a sentence asking you to stop messaging them, and all three need to work. Process it immediately across every flow, not just the one that sent the last message, and confirm it once so the person knows it worked.
Data handling in the region
Both Saudi Arabia and the UAE now have personal data protection regimes with requirements around consent, purpose limitation and cross-border transfer. Conversation content frequently contains personal data, sometimes including identity documents customers send unprompted. Decide deliberately where transcripts are stored, how long you keep them, and who can read them, and take specific legal advice rather than assuming your provider's default settings satisfy local law.
A number given for delivery coordination is not permission to market. That distinction is what protects your sending capacity.