What changed in November 2024
For years the rule was strict: your opt-in had to explicitly say messages would arrive on WhatsApp, and it had to name your business. A general marketing consent was not enough.
Meta has since relaxed that. Under the updated Business Messaging Policy, a general opt-in to receive marketing or service messages — collected on any channel — now satisfies the platform requirement, provided it is a genuine opt-in and complies with local law.
What this does not mean: it is not permission to message anyone whose number you hold. The wording requirement was removed. The consent requirement was not. Plenty of guidance published before late 2024 still describes the old rule.
What still has to be true
- —Consent must be affirmative. Someone has to take an action — tick a box, submit a form, send a keyword, click a button. A pre-ticked checkbox is not consent, and neither is a number you bought.
- —You must be able to evidence it. Keep a record of when and how each contact opted in. If Meta questions your practices, this is what you produce.
- —Local law still applies, on top. Meta's policy is the platform floor, not your legal position. In India, the DPDP Act governs how you collect, store and process personal data — including phone numbers.
- —Opt-out must work. Honour requests to stop promptly and completely.
Where to collect opt-in
Any of these produce valid consent. The best programmes use several, so the list grows from multiple directions.
An unticked box offering order updates on WhatsApp. High acceptance, because the value is obvious at that moment.
Someone who taps an ad and messages you has opened a conversation themselves — the cleanest possible signal.
A chat button or a printed QR in-store. The customer initiates, which also opens a 24-hour service window.
A standard lead form with a clear consent line. Keep the wording plain about what you will send and how often.
Quality rating: the metric that governs everything
Meta scores every WhatsApp number on how recipients react — reads, replies, blocks and reports. That score appears in Business Manager as a simple colour.
Healthy. You can progress up the messaging tiers as volume grows.
A warning. Your tier is frozen — you cannot scale up until quality recovers.
Serious. Your messaging limit can be reduced, and sustained red risks restrictions.
The important thing to internalise: sending more does not fix a quality problem. Quality gates the tier ladder, so a business messaging too many uninterested people permanently caps its own capacity. Segmenting hard and sending less is usually the faster route to sending more.
A practical compliance checklist
- 1.Collect affirmative opt-in and store the timestamp and source against every contact.
- 2.Keep utility and marketing messaging separate — do not smuggle promotions into transactional templates.
- 3.Put a visible opt-out on marketing messages and process it automatically.
- 4.Segment by behaviour rather than broadcasting to the whole list.
- 5.Check quality rating weekly and investigate the moment it moves to yellow.
- 6.Publish a privacy policy covering WhatsApp data, and keep it current with the DPDP Act.
- 7.Never buy contact lists. It is the single most reliable way to lose a WhatsApp number.
- 8.If you let an AI agent send on your behalf, make sure opt-in is enforced in the connection layer rather than left to the model’s judgement.
This guide explains Meta's platform policy as it stood in August 2026. It is not legal advice — for your obligations under the DPDP Act or sector-specific regulation, take advice from a qualified professional.
