A valid WhatsApp opt-in is a checkbox nobody ticked for the person, wording that says who is writing and about what, and a stored record of both. That is the whole standard. Most opt-ins fail it for reasons that look small on a form and large in a complaint.
The rules come from two places. The GDPR defines consent in Article 4(11) and sets the conditions in Article 7. The ePrivacy Directive is what makes consent the relevant basis for marketing messages in the first place. Its Art. 13(1) speaks of “electronic mail”, but Art. 2(h) defines that term as any text, voice, sound or image message sent over a public communications network that can be stored in the recipient’s terminal equipment — a description a WhatsApp message fits. Germany’s § 7(2) No. 2 UWG uses the same term. We are not aware of a CJEU ruling on messengers specifically.
The four conditions, translated
Freely given. The person must be able to say no without losing anything they were promised. A checkout that will not complete unless you accept WhatsApp updates is not free. A prize draw that requires the tick is on thin ice — the consent becomes the price of entry, which is exactly the bundling Article 7(4) tells regulators to weigh against you.
Specific. One purpose, one consent. “Marketing and partner offers and service updates” is three things wearing one checkbox. If you want to send both appointment reminders and promotions, either name both explicitly in one clear sentence or collect them separately.
Informed. Before ticking, the person should know who is writing, on which channel, roughly what about, and how to stop. Your privacy notice should be one click away, not required reading.
Unambiguous. A clear affirmative action. Not a pre-ticked box, not silence, not “by continuing you agree”. The tick, the tap, or the message the person sends you.
What you have to be able to prove
Article 7(1): “the controller shall be able to demonstrate that the data subject has consented.” Not that your form was well designed. That this person consented.
So the record has to be per contact, and it has to contain:
| Field | Why it matters |
|---|---|
| Phone number in E.164, or WhatsApp username | Identifies the record you will need to produce — since the 23 September 2026 policy update Meta’s opt-in rule covers people who gave you “their mobile phone number or username” (usernames are not yet live for users as of 1 November 2026) |
| The consent text as displayed | Proves what they actually agreed to, not what your form says today |
| Timestamp (UTC) | Establishes when, and whether it predates the messages you sent |
| Source | Which form, which page, which campaign — shows the context |
| IP address, where available | Corroborates the timestamp for web forms — store it only where it adds proof (EDPB Guidelines 05/2020, para. 106, data minimisation) |
| Method | Web form, WhatsApp keyword, QR code, imported, offline |
The second row is the one people get wrong. If you store a reference to your current consent wording rather than a copy of the wording that was on screen, then every time marketing edits the form, your entire consent history quietly changes to something nobody agreed to. Store the text. The EDPB says the same in Guidelines 05/2020, para. 108: keep “a copy of the information that was presented to the data subject at that time”, because “it would not be sufficient to merely refer to a correct configuration of the respective website”.
Five wordings that fail
These are common, and each one is defective for a specific reason.
- “I agree to the terms and conditions and to receiving WhatsApp updates.” Bundled. Under Art. 7(4), making a contract conditional on consent that is not necessary for it weighs heavily against that consent being freely given — which is why bundled ticks rarely survive scrutiny.
- “Sign up for our newsletter” — with a phone field on the same form. Not specific to the channel. A newsletter is email.
- “We may contact you about offers from us and selected partners.” Who are the partners? Unnamed third parties cannot be consented to.
- A pre-ticked box. Explicitly ruled out; the CJEU settled this in Planet49 in 2019 and the reasoning applies to any consent, not just cookies.
- “By submitting this form you consent to…” with the submit button as the only action. Not unambiguous — the person acted to submit a form, not to accept marketing.
The fix for all five is the same shape: a separate, unticked box, with one sentence that names you, names WhatsApp, names the message type, and mentions the way out.
Yes, send me appointment reminders and offers from Muster GmbH on WhatsApp. Reply STOP any time to unsubscribe. [Privacy notice]
Boring. Defensible.
Where the opt-in comes from changes what you should store
Web form. The strongest common case, because you control the page and can capture the wording, timestamp and IP together. Make sure the phone field is typed by the person, not prefilled from a purchased list.
QR code or link on a physical touchpoint. The person scans, WhatsApp opens with a prefilled message, they hit send. The inbound message is the affirmative action, and it comes from the number itself — which quietly solves the mistyped-number problem. Store the message and its timestamp as the record, and reply immediately with what they just signed up for.
Click-to-WhatsApp ads. Same mechanic: the person starts the conversation. Meta’s own Business Messaging Policy requires opt-in before you message someone. Meta does not say outright that an inbound message counts; the common reading is that it covers the conversation the person started, no more. It is not blanket permission for a promotional broadcast three months later — ask for that separately, in the chat, and store the answer.
Worth knowing: Meta’s bar is lower than the GDPR’s. Its opt-in documentation accepts a general opt-in that does not name WhatsApp, as long as it names your business and local law is met. For EU contacts local law is the GDPR, so the channel-specific wording is on you, not on Meta.
Offline, on paper or verbally. Legitimate, and the hardest to evidence. Keep the signed form or log the interaction with the staff member, the date and the wording used, then send a confirmation message so there is a digital trace.
Imported from another system. Only defensible if the original consent covered WhatsApp specifically and you can produce that original record. Usually it does not, which is its own article.
The confirmation step is worth it
The GDPR does not require double opt-in. It is simply the strongest evidence available under Art. 7(1), and German courts have long treated the confirmed double opt-in as the practical way to prove an email consent. On WhatsApp it costs one message.
The mechanic: the person opts in on your form, you send a single utility template asking them to confirm, they reply. Now you have a record that ties the consent to the device holding the number. Someone who typo’d a digit never confirms, so you never message a stranger; someone who entered a colleague’s number as a joke never confirms either.
Their reply also opens the 24-hour customer service window, so you can answer in free-form text instead of a pre-approved template. Note the change of economics: since 1 October 2026 Meta bills service and utility messages inside that window per message — service replies after a free tier of 1,000 delivered service messages per business phone number per month, utility templates with no free tier, and without a payment method on file service messages stop being delivered once the free tier is used — so “inside the window” no longer means “free” (Meta, pricing and pricing updates for non-template messages, as of 1 November 2026).
The one exception, and why it rarely helps here
There is a statutory alternative to consent, and it is narrower than people hope. Art. 13(2) of the ePrivacy Directive lets you market your own similar products to someone whose details you obtained in the course of a sale, provided they were offered a way to object at collection and in every message. Germany implements it in § 7(3) UWG.
Two problems on WhatsApp. The provision is written around “electronic mail” — a term Art. 2(h) defines broadly enough to cover messengers, though no court has said so for WhatsApp. And the marketing has to concern your own similar products. The CJEU has recently read the exception generously: a free account can count as obtained “in the context of a sale” if it gives access to a paid product, a free newsletter about that product counted as marketing “similar products”, and a mailing that satisfies Art. 13(2) needs no separate Art. 6(1) GDPR basis (Inteligo Media, C-654/23, 13 November 2025). But the case turned on a publisher’s e-mail newsletter and says nothing about messengers. If your case looks like it fits, that is a question for a lawyer who knows your jurisdiction — in practice, asking for consent is faster than arguing the exception.
Opt-out has to be as easy as opt-in
Article 7(3): withdrawing consent must be as easy as giving it. On WhatsApp that means a keyword, honoured automatically.
Three things make it work. Every marketing message mentions the way out, once, at the end. The system acts on the keyword itself rather than waiting for a human to read the inbox. And the opt-out is recorded with a timestamp, because “we stopped messaging them” is a claim and “we stopped at 14:03 on 4 March” is evidence.
One more, easy to forget: an opt-out has to survive a re-import. If someone opts out and then arrives again in next month’s CSV, your system must keep them suppressed. A suppression list that only lives in the current contact record is not a suppression list.
And the keyword is not the only valid way out. Meta’s policy requires you to respect opt-out requests made “either on or off WhatsApp”. Italy’s supervisory authority fined BBVA EUR 5,508,000 because a customer who objected to marketing in the bank’s app and via customer service kept getting promotions for seven months — two internal systems did not sync. Controllers “cannot disregard a valid request merely because it was not submitted through a preferred channel” (EDPB summary, Garante decision of 3 September 2026, retrieved 1 November 2026).
What this means for you
Go and look at your own form. If the consent shares a checkbox with anything else, split it. If you store a pointer to the wording rather than the wording, start storing the text. If your opt-outs depend on someone reading the inbox, automate them today — that is the one failure that turns an annoyed customer into a complainant.
In Nybero, the consent record is append-only per contact and carries the timestamp, the source and — for WhatsApp form opt-ins — the wording as displayed; consent sent through the API stores whatever proof text you pass in, and the hosted web opt-in form records source and IP address, not the wording. STOP is handled by the platform rather than by a person, and the suppression survives a later import. Not because it is a clever feature, but because reconstructing consent afterwards is impossible and everyone eventually needs it.
Updated 1 November 2026 (Meta opt-in documentation as source for “general opt-in”, Inteligo on “similar products”, username status, BBVA case). Updated 1 October 2026 for the policy of 23 September 2026, the October pricing change and Inteligo. National implementations of the ePrivacy Directive differ, particularly on the existing-customer exception. An earlier version described replies inside the 24-hour window as unpaid, which has not been true since 1 October 2026. Orientation, not legal advice.
