Opt-in and GDPR on WhatsApp Business: how to write without burning the number

The WhatsApp Business API is not a channel to dump the sales rep's spreadsheet. Opt-in and GDPR are the difference between a campaign that arrives and a number limited in three days.

This guide is practical, not a legal opinion. If you bill at volume, have a lawyer look at it. Here is what Meta and a reasonable AEPD expect.

Two layers (do not mix them)

1. Meta's rules. Who gave you permission to write on WhatsApp, and of what type (service vs marketing).
2. GDPR. Legal basis, information, retention, opt-out.

You can comply with one and still get suspended on the other. Both close the channel.

What counts as opt-in

• Unchecked checkbox on the web: "I agree to alerts and offers on WhatsApp".
• The customer writes to you (click-to-chat, ad, listing).
• A "reply YES to join updates" that stays in the thread.
• A contractual relationship for utility: "I confirm the order / the appointment". That is not a licence for Black Friday.

Does not count: "WhatsApp is in the general terms", a bought list, scraping the phone directory, the mobile from a 2019 business card.

More sending context in WhatsApp campaigns and templates.

Where it is stored

On the contact: date, wording of the permission, source (form, chat, ad). If you use HubSpot or Pipedrive, that field has to travel. If it only lives in an intern's spreadsheet, it is not stored.

ManyContacts: tags, notes and fields. The thread is proof. €49/month (3 users) for the panel; Meta bills the message.

Opt-out

A "STOP" that works the same day. If the sales rep keeps writing "just in case", you are the spam.

24-hour window

That the customer wrote to you is not marketing opt-in forever. It is service for one day. After that, a template and the right permission.

Next step

Review the last campaign: can you point to the opt-in for each phone? If not, stop. Create the account or book a demo and store consent in the same inbox.