# Opt-in and GDPR on WhatsApp Business: how to write without burning the number

Canonical: https://www.manycontacts.com/en/blog/whatsapp-opt-in-gdpr/
Published: 2026-06-24

The **WhatsApp Business API** is not a channel to dump the sales rep's spreadsheet. **Opt-in and GDPR** are the difference between a campaign that arrives and a number limited in three days.

This guide is practical, not a legal opinion. If you bill at volume, have a lawyer look at it. Here is what Meta and a reasonable AEPD expect.

## Two layers (do not mix them)

1. **Meta's rules.** Who gave you permission to write on WhatsApp, and of what type (service vs marketing).
2. **GDPR.** Legal basis, information, retention, opt-out.

You can comply with one and still get suspended on the other. Both close the channel.

## What counts as opt-in

- **Unchecked** checkbox on the web: "I agree to alerts and offers on WhatsApp".
- The customer **writes to you** (click-to-chat, ad, listing).
- A "reply YES to join updates" that stays in the thread.
- A contractual relationship for **utility**: "I confirm the order / the appointment". That is not a licence for Black Friday.

Does not count: "WhatsApp is in the general terms", a bought list, scraping the phone directory, the mobile from a 2019 business card.

More sending context in [WhatsApp campaigns](/en/blog/whatsapp-marketing-campaigns/) and [templates](/en/blog/whatsapp-business-templates/).

## Where it is stored

On the contact: date, wording of the permission, source (form, chat, ad). If you use [HubSpot](/en/blog/whatsapp-hubspot/) or [Pipedrive](/en/blog/whatsapp-pipedrive/), that field has to travel. If it only lives in an intern's spreadsheet, it is not stored.

ManyContacts: tags, notes and fields. The thread is proof. **€49/month** (3 users) for the panel; Meta bills the [message](/en/blog/whatsapp-business-api-pricing/).

## Opt-out

A "STOP" that works the same day. If the sales rep keeps writing "just in case", you are the spam.

## 24-hour window

That the customer wrote to you is not marketing opt-in forever. It is [service](/en/blog/whatsapp-24-hour-window/) for one day. After that, a template and the right permission.

## Next step

Review the last campaign: can you point to the opt-in for each phone? If not, stop. [Create the account](https://app.manycontacts.com/register) or [book a demo](https://calendar.app.google/PH1wtumtQQwLGz756) and store consent in the same inbox.