What Is Opt-In?
Opt-in is the verifiable consent you collect from a customer before sending them WhatsApp messages through your business. Under WhatsApp Business Messaging Policy and applicable privacy law (GDPR in the EU, CCPA in California, PDPL in Saudi Arabia, the Israeli Privacy Protection Law, and others), a recipient must have actively and knowingly agreed to receive messages on WhatsApp from your specific business.
Opt-in is not optional. It is a legal and platform requirement, and a foundation of GoUltra's compliance posture.
What Counts as Valid Opt-In?
Valid opt-in consent must meet all of the following criteria:
- Explicit: the customer must take a clear, affirmative action (a checkbox they actively check, a reply they actively send, a form they actively submit). Pre-checked boxes are not valid.
- Informed: the customer must understand what they are agreeing to — that they will receive WhatsApp messages, from your business, about specific topics or categories of content.
- Specific to your business: consent given to one company does not transfer to another. You cannot rely on opt-in collected by a marketing partner unless that partner explicitly named your business and the type of communication.
- Verifiable: you must keep records showing when, how, and on what page or channel each customer opted in. GoUltra automatically logs opt-in source and timestamp when imported via API or form integration.
Acceptable Opt-In Methods
The following methods produce valid opt-in:
- Web form with a checkbox. A booking form, contact form, or signup form that includes an unchecked box reading "I agree to receive WhatsApp messages from [Your Business] about my appointment, account, and related communications." The form should record the date and timestamp of submission.
- Click-to-WhatsApp button. When a customer clicks a "Chat on WhatsApp" or "wa.me" link from your website, ad, or social profile and sends an initial message, that constitutes opt-in for service-window communication. To send messages outside the 24-hour service window you also need explicit consent for that purpose.
- SMS or email confirmation. Send a one-time SMS or email asking the customer to reply YES (or click a link) if they want to receive WhatsApp messages. Record the response.
- Verbal opt-in at point of service. A reception desk, sales call, or in-person interaction where staff ask "May we send WhatsApp messages to confirm your appointment?" — but only if your business records this consent in writing in your CRM.
- Signed contract or paper form. A printed booking form or service agreement that includes a clearly-marked WhatsApp consent line.
What Does Not Count as Opt-In
- Pre-checked checkboxes on web forms.
- Bundled consent ("by signing up you agree to all communications").
- Phone numbers obtained from public directories, social media scraping, or third-party data brokers.
- Lists purchased or rented from another company.
- Numbers added by family members, employees, or referral chains without the actual person's consent.
- Inferred consent based on a past transaction with no explicit WhatsApp permission.
Recommended Opt-In Language
For a booking or appointment form:
"☐ I would like to receive WhatsApp messages from [Your Business Name] about my appointment confirmations, reminders, and follow-up. Message frequency: typically 1–4 messages per appointment. Reply STOP at any time to unsubscribe."
For a marketing list signup:
"☐ I would like to receive promotional WhatsApp messages from [Your Business Name] about offers, new services, and updates. Up to [N] messages per month. Reply STOP at any time to unsubscribe."
Record-Keeping
For each contact in your GoUltra database, you must be able to demonstrate, on demand, the source and date of opt-in. GoUltra automatically captures this metadata when contacts are imported via supported integrations. For manual imports, you are responsible for documenting consent in your own records.
In the event of a complaint to Meta, a GDPR data subject access request, or a regulator inquiry, the burden of proof rests on you as the data controller. GoUltra can provide platform-level logs of when contacts were imported, but cannot vouch for the consent process upstream of import.
Honoring Opt-Out
Opt-in is not permanent. A recipient may withdraw consent at any time by replying with STOP, UNSUBSCRIBE, CANCEL, the equivalent in their language, or any clearly-expressed request to stop. When this happens:
- GoUltra automatically flags the contact as unsubscribed.
- Subsequent marketing messages to that contact will be blocked at the platform level.
- Transactional messages (order confirmations, appointment reminders for already-booked appointments) may continue, but should be minimized.
- The contact must not be re-added to any marketing list without fresh, explicit opt-in.
Questions
If you are uncertain whether a particular opt-in method or list source is acceptable, contact compliance@goultra.ai before importing. We would rather review a borderline case than have your account suspended.
Last updated: April 2026.