Skip to content
BitByteCore ConnectBook a demo
Open the product menu
ProductSolutionsPricingHow it worksFAQCompany

Guide · Policy · For the owner with a customer list and no record of consent

Do you need permission to message customers on WhatsApp? Meta's opt-in rule in plain words

Yes. Meta requires a business to hold a person's opt-in before it starts a WhatsApp conversation with them. Having their number is not enough. Since Meta's November 2024 policy update the permission does not have to mention WhatsApp by name, but it does have to name your business and say what the person is agreeing to receive.

Published 1 October 2026 · Updated 14 October 2026

What Meta requires

Meta's rule has two parts, and a business may message a person on WhatsApp only when both are true.

They gave you their number
The person provided their mobile number to your business themselves.
They agreed to hear from you
You hold their permission confirming they wish to receive messages or calls from your business in particular, not from businesses in general.

General opt-in counts, since November 2024

Meta's page says the opt-in can be general rather than specific to WhatsApp, as long as the business complies with all local laws. A customer who agreed to receive updates from you by message when they ordered has, in Meta's terms, opted in. What local law says about that agreement is a separate question, and it applies on top.

What the opt-in itself must say

Three requirements, from Meta's page. An opt-in that meets all three is policy-compliant.

  1. It clearly states that the person is opting in to receive communication from the business. Not buried in terms nobody reads.
  2. It clearly states the name of the business. The person must know who will be writing to them.
  3. It complies with applicable law. Meta leaves the method to you and makes you responsible for its legality.

What the customer is told when they sign up

WhatsApp's Help Center has a page written for the customer, not the business. It explains what tapping Sign up, or a similar button, in a business's ad or on its website means. Reading it tells you how WhatsApp explains the sign-up to your customers.

They gave you permission to contact them
Signing up through a business ad or website to receive messages on WhatsApp gives that business permission to contact them.
They shared their number
They agree to share their phone number with that business, and their WhatsApp number becomes visible to it.
They can receive marketing
The business can send messages including marketing and promotional content. WhatsApp lists welcome messages, promotional offers and updates, product updates and announcements, and personalized recommendations.

The same page tells them how to stop: open the chat, tap the business name at the top, and tap Block. Or tap and hold one of the business's messages and select Report. WhatsApp adds that businesses cannot see their profile photo, status or last seen unless they changed their privacy settings.

Our reading

A sign-up the customer did not understand tends to end in a block or a report. The button is only half of it: Meta's rule above still requires the opt-in to clearly name your business and clearly state that the person is opting in to receive messages from you, so the words next to the button should say both.

Ways to collect it

Meta does not prescribe a method. Its page lists these as examples that work when they meet the three requirements above.

On your website
A tick box or button at checkout, on a booking form, or on a contact form.
By SMS
A reply from the customer confirming they want messages from you.
By phone
A choice made in an automated phone menu.
In person or on paper
A signed form, at the counter or on delivery.

What does not appear on Meta's list: a number copied from a business card, a number scraped from a directory, or a number a customer gave to someone else.

A switch in Ads Manager is a promise, not an opt-in

Meta's Ads Manager can send WhatsApp promotions as part of an ad campaign, but only to people who agreed to receive the business's marketing. Meta's Business Help Center says one of its settings adds every contact the business sent a marketing, utility or login-code message in the past 15 days, and that turning it on represents that the business has permission to send marketing to all of them. A customer who only received an order update may never have agreed. The placement is explained in the Ads Manager placement guide.

Meta's advice on doing it well

The page separates what is required from what is wise. The wise part is about not getting blocked, because blocks and reports feed the quality rating that decides how many people your number can reach.

Say what they will get
Order updates, offers, product recommendations. People should expect the messages they receive.
Consider separate opt-ins by type
A customer who wanted delivery updates and gets a sale announcement is the customer who blocks you. Meta suggests opting people in per category.
Make opting out easy, and honour it
Clear instructions for stopping each type of message, and a system that actually stops them.
Explain the value
Why receiving these messages is worth it to the customer, not to you.
Watch the quality rating
Especially in the weeks after a new opt-in method goes live. A rush of blocks shows up there first.

WhatsApp's Help Center gives owners of the WhatsApp Business app similar advice on its page about marketing messages, which are now called business broadcasts in some countries and may not be available to you yet. Get opt-in for each category of message, and a separate opt-in before you call a customer. Give clear instructions for opting out of each category and honour them, keep the opt-in and opt-out steps clear, and explain the value of the messages.

If many people report or block a business for unwanted messages, it gets a warning. If the spam continues, its marketing messages are suspended for three days, and repeated restrictions may bring longer suspensions. Its prevention list includes: send marketing messages only to people who opted in, remove contacts who have not interacted with your business recently, and make sure your messages match what people signed up to receive. The full suspension rules are in the business broadcasts guide.

Broadcast lists only reach people who saved your number

In the WhatsApp Business app, a broadcast list is a saved list of customers you can message at once. WhatsApp says the message reaches only customers who have your number saved in their phone's address book. Replies arrive as normal chats in your Chats screen and are not sent to anyone else on the list.

WhatsApp's page on using WhatsApp responsibly warns against over-using them: frequent broadcasts may lead people to report your messages, and WhatsApp bans accounts that are reported multiple times.

To reach customers who have not saved your number, the app can turn a broadcast into a marketing message, sent with Send now or set for later with Schedule. WhatsApp sets that message's audience automatically to the customers who did not receive the broadcast. Where marketing messages have become business broadcasts, or are not available yet, this option may look different or be missing.

Our reading

A customer who saved your number has done something on purpose. A marketing message also reaches the ones who have not, so the opt-in rule matters more there, not less.

What WhatsApp says can get any account banned

WhatsApp's page on using WhatsApp responsibly says all WhatsApp users should review its guidelines. Its first best practice: only send messages to people who contacted you first or asked you to contact them on WhatsApp. It says it is best to give people your number so they can message you first.

The same page lists practices that may cause an account to be banned.

Messaging someone who asked you to stop
Remove them from your address book and do not contact them again.
Using contact lists that are not yours
Sharing phone numbers without consent, or messaging people with data obtained from illicit sources.
Bulk and automated messages
Bulk messaging, auto-messaging or auto-dialling, creating accounts or groups in unauthorized or automated ways, and modified versions of WhatsApp. WhatsApp says it uses machine learning and reports from users to detect and ban accounts that send unwanted automated messages.
Harvesting personal information
Automated extraction of information from WhatsApp for purposes it does not permit, such as phone numbers, profile pictures or statuses.

A separate Help Center page on unauthorized automated or bulk messaging says WhatsApp's products are not intended for bulk or automated messaging, which has always broken its Terms of Service. WhatsApp says it bans accounts with machine-learning classifiers and has found and stopped millions of abusive accounts. It also takes legal action against people or companies it links to evidence on the platform. And it gave notice that, from 7 December 2019, it would take legal action even when its only evidence came from outside WhatsApp, such as a company's public claims about using WhatsApp in ways that break its Terms.

The same page has one reassurance: boosting content may bring many people to message you on WhatsApp at once, and receiving many messages at once will not result in an account ban.

Our reading

The line these pages draw is direction and consent. Many customers writing to you at once is fine. Sending in bulk, or messaging numbers that never agreed to hear from you, is what they warn against.

What happens to businesses that skip it

People can block a business, report it, or switch off its marketing messages. Meta's page says its systems rate-limit a business whose quality stays low for a sustained period, that it reviews user reports for policy violations, and that it may add further enforcement over time. In practice a number built on a bought or scraped list stops being able to reach people, which is the one outcome a messaging channel cannot survive.

WhatsApp's page on reporting and blocking says what a report carries. When a customer reports a business in a one-to-one chat, WhatsApp receives up to five of the last messages that business sent them and, if a call took place, it may also receive basic information about the last five calls. The business is not notified. WhatsApp says it might ban accounts it believes break its Terms of Service, and keeps the right to do so without notification, though a report does not necessarily lead to a ban. Blocking stops the business's messages and calls reaching them.

Our reading

A report carries your own last messages to that customer. If those were unwanted, they are what WhatsApp receives.

This guide covers conversations your business starts. When a customer writes to you first, the rules of the 24-hour window apply to your replies, and the messaging limit decides how many new people you can write to first in a day.

Questions

We have years of customer numbers from invoices. Can we message them?

Only the ones who agreed to hear from you. Meta needs both things: they gave you the number, and they gave permission for messages or calls from your business. An invoice gives you the first and usually not the second. Collect the opt-in first, by any of the methods above. WhatsApp's Help Center also lists bulk messaging as a practice that may get an account banned.

Is a customer who signed up through our ad or website opted in?

WhatsApp tells customers that signing up through a business ad or website to receive messages on WhatsApp gives that business permission to contact them, including with marketing and promotional content. Meta's rule still requires the opt-in to clearly name your business and clearly state that the person is opting in to receive messages from you, so put both next to the button.

Can we buy or borrow a contact list?

WhatsApp's Help Center lists using contact lists that are not yours as a practice that may get an account banned: do not share phone numbers without consent or use data obtained from illicit sources. Our reading: a bought or borrowed list is not yours. Meta's rule also needs the person to have given their mobile number.

Does the opt-in have to mention WhatsApp?

Not since Meta's November 2024 policy update. A general permission to receive messages from your named business is enough for Meta, provided local law allows it.

Can we send a WhatsApp message asking people to opt in?

Meta's page describes opt-in as something obtained before messaging, through channels such as SMS, your website, phone or paper. It does list confirming an opt-in collected elsewhere as a legitimate WhatsApp message, so the pattern is: permission first, confirmation on WhatsApp second.

Does switching on contact syncing in Ads Manager count as getting opt-in?

No. Meta's Business Help Center says turning on the sync of recent WhatsApp contacts represents that the business already has permission to send marketing to all of them. The opt-in has to exist first.

Is this the law, or Meta's rule?

It is Meta's rule, written into the WhatsApp Business Messaging Policy, and it says the business must also comply with applicable law. The two stack. This guide covers Meta's rule and WhatsApp's Help Center only and is not legal advice.

Who is BitByteCore?

BitByteCore is a verified Meta Tech Provider (since 9 September 2026). This guide explains Meta's opt-in documentation and WhatsApp's own Help Center pages. Meta makes the business responsible for how its opt-in is collected.

Sources

More plain-language notes like this one are on the guides page.

Want the opt-in built into how customers already reach you?

We set up a business's WhatsApp number on a proper system with the opt-in collected where customers already give you their number, and the opt-out honoured automatically. A short call is the easiest way to see whether it fits your business.

Book a demo