Consent and opt-in

Overview

Before sending WhatsApp marketing, you need to satisfy both Meta's platform rules and the law that applies to your business and contacts. This page summarises the UK position under the Privacy and Electronic Communications Regulations (PECR) and UK GDPR.

This is general operational guidance, not legal advice. Obtain professional advice for unusual consent models, acquired databases, company transfers, or marketing outside the UK.

The safest standard

Use a clear, separate opt-in that:

• Names the business that will send messages
• Says that the person agrees to receive marketing by WhatsApp
• Describes the types of messages they will receive
• Requires a positive action, with no pre-ticked box, silence, or assumed consent
• Explains that consent can be withdrawn at any time and how to do it
• Links to the business's privacy notice

For example:

I agree to receive WhatsApp marketing messages from [business name] about [offers and new products]. I can opt out at any time by replying STOP. See the [privacy notice] for details.

If different channels send materially different types of messages, offer separate choices. Do not use the contact importer's automatic opt-in unless the recorded consent covers marketing across every company channel.

Meta's WhatsApp requirements

Meta requires the person to have:

• Given your business their mobile number
• Opted in to subsequent messages or calls from your business

The opt-in must clearly identify your business. Providing a phone number alone is not an opt-in. Consent given to another business, or wording that would make the messages unexpected, is not sufficient.

You can collect opt-in on WhatsApp or elsewhere, including through a website, SMS, telephone call, paper form, or in person. Whatever method you use must also comply with local law.

Meta recommends separate choices for different message categories, particularly marketing and transactional updates. Send useful messages at the cadence people expect, avoid excessive promotions, and stop or reduce messages when contacts disengage.

You must honour opt-outs made on or off WhatsApp. Make opt-out instructions clear and intuitive, and remove opted-out contacts from the relevant sending audiences.

Read Meta's current obtaining user opt-in guidance, WhatsApp Business Messaging Policy, and marketing messages best-practice guide.

UK law: PECR and UK GDPR

The Information Commissioner's Office (ICO) treats private in-app and social-media messages as electronic mail. WhatsApp marketing should therefore be treated as electronic mail marketing under PECR.

PECR determines whether you may send the message. UK GDPR separately governs how you collect, store, and use the phone number and other personal data. You must satisfy both.

Purely administrative or customer-service messages are not normally direct marketing. If a service message also promotes products, offers, or the business, the complete message may count as marketing.

Read the ICO's current electronic mail marketing guidance and UK GDPR consent guidance. The underlying law is in PECR's electronic mail definition, marketing rules, and sender and opt-out requirements.

Individual and corporate subscribers

For individual subscribers, unsolicited WhatsApp marketing normally requires consent unless every condition of PECR's limited soft opt-in applies. Individual subscribers include consumers, sole traders, and ordinary partnerships in England, Wales, and Northern Ireland.

PECR permits unsolicited electronic mail marketing to corporate subscribers without consent. Corporate subscribers include limited companies, LLPs, and Scottish partnerships. However:

• Subscriber status depends on who holds the phone or communications contract, not simply whether the message is B2B
• A personal mobile used for work may still have an individual subscriber
• UK GDPR still applies when the number identifies an employee or other person
• The individual has an absolute UK GDPR right to object to direct marketing
• Meta still requires WhatsApp opt-in regardless of PECR's corporate-subscriber exemption

If subscriber status is uncertain, follow the individual-subscriber rules. See the ICO's business-to-business marketing guidance.

Consent standard

Consent must be freely given, specific, informed, and unambiguous, and must involve a clear positive action. It should be separate from terms and conditions or acceptance of a privacy notice.

For UK contacts, explicitly name WhatsApp marketing rather than relying on broad wording such as “marketing communications”. Name the business, describe the purposes and message types, and explain the right to withdraw.

Consent for phone calls, SMS, email, transactional updates, another business, or another phone number does not automatically cover WhatsApp marketing.

PECR soft opt-in

The products and services soft opt-in is an exception to PECR consent; it is not consent. Every condition must be satisfied:

1. Your business obtained the contact details directly from the person.
2. It obtained them during a sale or genuine negotiation for a sale.
3. Marketing only covers your own similar products or services.
4. You offered a clear, simple opt-out when collecting the details.
5. You offer a simple, free opt-out in every later marketing message.

It does not apply to bought or shared lists, other companies in the same group, or historical customer numbers collected without the original opt-out. Read the ICO's soft opt-in requirements.

Keep evidence of consent

Where you rely on consent as the UK GDPR lawful basis, you must be able to demonstrate it. Meta opt-in and general accountability also make the same evidence important where another lawful basis applies. Keep an audit trail containing:

• Who consented and the WhatsApp number
• When and how they consented
• The positive action they took
• The exact consent statement, form, or call script and its version
• The privacy information shown at the time
• The named business, purposes, message types, and channels covered
• Any later withdrawal, objection, or preference change

A Boolean field or note saying only “consented” is not enough. Keep the evidence while you continue relying on that consent and review it when your purposes, channels, or messaging change.

Read the ICO's consent record guidance.

Privacy information and lawful basis

Tell people how you use their personal data when you collect it. Your privacy information should cover the controller, purposes, lawful basis, recipients and transfers, retention, withdrawal, objection, complaints, and any profiling.

Where PECR requires consent, consent will normally also be the UK GDPR lawful basis for the marketing use. Where a valid soft opt-in or corporate-subscriber exception applies, legitimate interests may be appropriate, but you should document a legitimate interests assessment. Legitimate interests cannot override missing PECR consent.

Collect only the data you need, define retention periods, and delete or anonymise stale data. You may retain minimal suppression information where necessary to prevent someone who opted out from being added again.

Honour withdrawals and objections

Make withdrawal as easy as opt-in and act on it promptly. Every marketing message should clearly identify the sender and provide a simple way to stop messages.

Keep a suppression record so imports or later data feeds do not re-add an opted-out contact. Do not switch to legitimate interests to continue the same consent-based marketing after consent is withdrawn.

ProConnect automatically records contacts as opted out when they stop marketing messages using WhatsApp's built-in Offers and announcements controls. If they use the same controls to resume marketing messages, ProConnect records them as opted back in.

Automated consent replies also include a STOP or START button whenever a contact can change their preference, so they can opt out or back in with one tap.

Bought, shared, and public lists

A public phone number is not consent. Do not assume that a bought or shared list can be used for WhatsApp marketing.

For a third-party list to be usable based on consent, the original consent must name your business, cover WhatsApp marketing, and be supported by evidence of who consented, when, how, and what they were told. The PECR soft opt-in never applies to a third-party list.

If you did not collect the data directly, additional UK GDPR privacy-information duties apply. You must normally provide the privacy information, including the data categories and source, within one month and no later than your first communication if that happens sooner. Acquired databases and changes of legal entity require case-specific legal review.