Opt-in for business messaging: what actually counts

Valid opt-in for business messaging has three parts: the person took an action, they were told who would message them and about what, and you kept the evidence. A phone number you happen to possess is not consent, however you came by it.

Two separate rulebooks apply and they are not the same. Meta's policy governs whether your number and Page keep working. Data protection law governs whether you are fined. You need both, and the second is stricter.

What Meta requires

In substance: the person must have opted in to receive messages from you on that channel, you must have made clear it was your business, and you must be able to demonstrate it if asked. Meta does not prescribe the form. It does enforce the consequence, and the enforcement mechanism is the one described in why numbers get banned - your recipients' block rate.

What the law requires, roughly

Kenya's Data Protection Act, the GDPR and most regimes modelled on it converge on the same requirements for consent: freely given, specific, informed, unambiguous, and as easy to withdraw as to give. Practically:

• Freely given - not the price of doing something unrelated. Requiring marketing consent to complete a purchase does not produce valid consent.
• Specific - consent to "marketing" does not cover every channel. Say WhatsApp.
• Informed - who you are, what you will send, how often, how to stop.
• Unambiguous - an action. Not a pre-ticked box, not silence, not "by continuing you agree".
• Withdrawable - and a reply of STOP has to actually work, permanently, without a person in the loop.

Four patterns that work

The checkout tick

Unticked, next to specific words: "Send me order updates and offers on WhatsApp at this number. Reply STOP any time." Store the timestamp, the wording shown, and the number. The wording matters because you will one day need to prove what somebody agreed to, and "they ticked a box" is not that.

The click to chat link

A wa.me link where the customer sends the first message is the cleanest opt-in there is: they initiated, on their own device, and it opens a 24 hour window at the same time. Put them on your site, your receipts and your packaging.

The keyword

"Send DEALS to this number" is unambiguous, self documenting and easy to evidence - the message they sent is the record. It is also the only pattern on this list where the customer's consent and their message are literally the same artefact.

The double opt-in

Confirm with a first message that asks them to reply to continue. It costs you some of the list and buys you a list that does not block you. For anything at volume this is worth it, because the people it filters out are exactly the ones whose complaints endanger your number.

What to store

For every opted-in number, keep:

• the number, normalised to E.164
• when they opted in, with a timezone
• where - which form, page or keyword
• the exact wording they were shown
• what they opted in to, separately per purpose
• when and how they opted out, kept forever

That last row is the one people delete, and it is the one that matters most: an opt-out record you deleted is an opt-out you will eventually violate when the same number is re-imported from a spreadsheet.

Making STOP work properly

Honour it on the channel it arrived on, immediately, without a human. Accept the obvious variants - stop, STOP, unsubscribe, cancel, and the local-language equivalents your customers actually use. Confirm once, briefly, and then be silent.

The business case is simple: every person who replies STOP instead of tapping Block is a signal you did not send to Meta. Making it easy to leave is the cheapest deliverability work available.