How to collect WhatsApp opt-in that holds up: wording, checkboxes, records, and what the DPDP Rules change

Kavita Desai runs a ghee and millet-snacks brand in Vadodara with a team of ten. Customers find her three ways: her website, a stall at two weekend farmers’ markets, and click-to-WhatsApp ads. After three years she has a spreadsheet of about 6,000 phone numbers. Some came from a website form with a box ticked. Some were written on a clipboard at the stall. A few hundred were copied off her own phone by a former employee, and nobody remembers what those people were told.

She wants to send a winter offer on WhatsApp. Before she does, she needs to know which of those 6,000 people she’s allowed to message, and how she’d show it if someone asked.

What Meta actually requires

Meta’s opt-in page lists three requirements. You must clearly state that the person is opting in to receive messages from you. You must clearly state your business’s name. And you must comply with applicable law. The WhatsApp Business Messaging Policy adds that you may only contact someone who has given you their number and has given you opt-in permission to receive messages or calls from you.

That’s the whole rule. Meta doesn’t fix the collection method. Its examples include websites, phone IVR systems and paper forms, and it says the opt-in “can be general and not specifically for WhatsApp, as long as businesses comply with all local laws”.

We’d still name WhatsApp every time. A general “we may contact you” line meets Meta’s minimum, but it’s weak evidence when a customer says they never agreed, and India’s consent rules, covered below, ask for consent that is specific.

Meta’s best practices also suggest asking separately for different kinds of message, such as order updates and offers. Do this. It’s the difference between a customer who stops your offers and keeps their delivery updates, and a customer who blocks you.

Opt-in wording for each place you collect numbers

Leave every box unticked by default. A pre-ticked box is your decision, not the customer’s.

Website or enquiry form

Put the checkboxes directly under the phone number field, not in the footer or the terms.

[ ] Send me order and delivery updates from Sattvik Ghee Co. on WhatsApp.
[ ] Send me offers and new products from Sattvik Ghee Co. on WhatsApp. About two a month. Reply STOP anytime.

The second line promises a frequency. Only write it if you’ll keep to it.

The order page, before payment

The shopper is about to pay and won’t read a paragraph. One line, next to the number:

[ ] Get order updates on WhatsApp from Sattvik Ghee Co.

Ask about offers on the thank-you page instead, once the order is placed. Fewer people tick it there, and those who do actually want offers. Our abandoned-cart playbook explains why the reminder itself needs this opt-in too.

Click-to-WhatsApp ads

Someone who taps your ad and writes “price for 1 litre?” has started a chat, so you can answer them. That isn’t the same as agreeing to receive offers next month. Ask once, inside the chat, after you’ve answered their question:

MI Meenakshi Iyer talking to Sattvik Ghee Co.

1. Meenakshi Iyer:
   hi price for 1 litre A2 ghee? 9:12 pm
2. Sattvik Ghee Co.:
   1 litre is ₹1,450, delivered in Vadodara in 2 days. Shall I share the order link? 9:14 pm
3. Meenakshi Iyer:
   yes pls 9:15 pm
4. Sattvik Ghee Co.:
   Here you go. One more thing: can Sattvik Ghee Co. send you offers and new batches on WhatsApp? About two a month, and you can reply STOP anytime. 9:15 pm
   • Yes, send offers
   • No thanks
5. Meenakshi Iyer:
   Yes, send offers 9:16 pm
6. Recorded: offers opt-in · source: ad chat · date and wording saved

Because this chat came from an ad and was answered in time, these messages fall inside Meta’s free entry point window; our ads guide explains how that works. In an ordinary chat the same question is a service message. Since 1 October 2026 the first 1,000 per number each month are free, and after that each costs ₹0.115 in India, before GST. One message is a cheap price for a clean record.

In-store QR code

At Kavita’s stall, a standee with a QR code opens a WhatsApp chat with a message already typed:

Hi Sattvik Ghee Co., please send me offers and new batches on WhatsApp.

The customer sends it, which is the opt-in, and you have their words with a timestamp. Print the same sentence on the standee so they know what they’re agreeing to. Meta also offers in-app signup links in the form wa.me/<number>/signup/<id>: the customer sees your signup message inside WhatsApp, confirms, and gets a confirmation message, which can carry a promo code.

If you still use a paper sign-up sheet, put the wording at the top of every page and keep the pages. Write the date on each one.

Web chat on your site

If a visitor in your website chat asks you to continue on WhatsApp, ask in the chat and keep a copy of the conversation: “Shall we send updates on this enquiry to your WhatsApp? Please confirm your number.” Use separate wording if you also want to send them offers.

What to record for each opt-in

The test is simple: could you show, for any one number, that this person agreed to this kind of message from you? A ticked box that left no trace fails it.

Field	Example
Phone number	As entered, with country code
Date and time	14 Sep 2026, 9:16 pm
Source	Website form, order page, ad chat, stall QR, paper sheet
Exact wording shown	Store a version code, such as “WEB-OFFERS-v2”, and keep the text for every version
What they agreed to	Order updates, offers, or both
Collected by	For paper and counter opt-ins, the staff member’s name
Withdrawn on	The date they stopped, and how

Keep old wording versions. When you change “about two a month” to “about four a month”, people who agreed to the first version agreed to two.

The old spreadsheet

Kavita’s 6,000 numbers split into three groups. People with a ticked website box: keep, and fill in the fields above from the form logs. People from the clipboard: keep the ones whose sheets you still have. Everyone else, including the numbers copied off a former employee’s phone, should not get the winter offer.

That costs reach. Kavita may lose a third of her list. The alternative is sending offers to people who never asked, who then block and report the number, and blocks are what pull down your template quality. Wait for those people to message you, then ask, as in the ad chat above. Our piece on customers in staff phones covers how those lists build up in the first place.

Opt-outs: STOP, buttons, and requests made off WhatsApp

The policy is broad: you must respect all requests, “either on or off WhatsApp”, to block, discontinue or opt out of your messages. A customer who tells your delivery rider “please stop the WhatsApp messages” has opted out.

In practice, cover these:

• Typed keywords: STOP, UNSUBSCRIBE, and the words your customers actually use, including in Hindi or Gujarati. Decide which ones remove someone from offers.
• A stop button on every marketing template. Meta supports a marketing opt-out quick-reply button on marketing templates. Our Diwali send plan puts one on every festive template.
• WhatsApp’s own setting. Customers can stop marketing messages from a business through WhatsApp’s “Offers and announcements” setting. Meta then won’t deliver your marketing templates to them, and the send fails with error 131050. Treat a 131050 as an opt-out and update your records.
• Requests by phone, email or in person. Someone has to type these in. Name that person.

An opt-out from offers isn’t an opt-out from order updates, unless the customer says so. Keep the two lists apart.

What the DPDP Act and Rules change, and when

India’s Digital Personal Data Protection Act, 2023 is the law. The Digital Personal Data Protection Rules, 2025 were published in the Gazette dated 13 November 2025 (G.S.R. 846(E)), and the Rules come into force in three steps.

When	What comes into force
13 November 2025	Definitions and the rules setting up the Data Protection Board (rules 1, 2 and 17 to 21)
Mid-November 2026	Rule 4: registration and duties of consent managers
Around May 2027	Rules 3, 5 to 16, 22 and 23, including the consent notice, security safeguards, breach reporting and children’s data

Consent managers are registered platforms through which a person can give, manage, review and withdraw consent. They must be Indian companies. The Rules don’t require a business to use one, so the November date changes little for Kavita this year.

The May 2027 step is the one that matters for your opt-in wording. The government describes consent under the Act as free, specific, informed, unconditional and unambiguous, given with or after a notice describing the data and the purpose. Rule 3 says that notice must be understandable on its own and, at minimum, give:

• an itemised description of the personal data you collect;
• the specific purpose, and the goods or services it’s for;
• a link and any other means for the person to withdraw consent, “with the ease of doing so being comparable to that with which such consent was given”, to exercise their rights, and to complain to the Board.

For a WhatsApp opt-in, that last point is the practical one. If someone agreed with one tap, stopping should take one tap or one word, not an email to an address hidden in your privacy policy.

None of this is in force today for most businesses. Treat the months until around May 2027 as preparation time: keep separate boxes per purpose, make sure every opt-in leaves a record, and write a notice that lists what you collect and why. This article is general information, not legal advice. For your own notice, talk to a lawyer.

Before your next campaign

• Every form, order page and QR standee has unticked, separate boxes for updates and offers, naming your business
• Each opt-in stores number, date, source, wording version and purpose
• Old contacts without a record are left out of marketing sends
• Every marketing template has a stop button
• 131050 failures and off-WhatsApp requests update the record within a day
• One named person owns opt-outs

Start with the last item. Lists stay clean because someone is responsible for them.