Quick answer: To message someone on the WhatsApp Business API you must have their phone number and their opt-in permission, which confirms they want to receive messages from you. You choose how to collect it and you are responsible for following the law. Honour every request to stop, because users can block or report you, and WhatsApp can limit what you send based on that.
Opt-in is the first thing to settle before any campaign, and the one most often skipped. If you are new to the platform, begin with our guide to what the WhatsApp Business API is and how it works in India. This article covers permission only.
What WhatsApp's policy says
The WhatsApp Business Messaging Policy, which showed a last-updated date of 23 September 2026 when we read it, says a business may contact people only if they gave it their mobile number or username and it has their opt-in permission. That permission must confirm they want to receive later messages or calls from the business.
The policy also says the business alone is responsible for choosing the opt-in method, making sure it follows applicable law, and giving the notices and obtaining the permissions the law requires. In plain terms, WhatsApp will not do your compliance for you.
Good practice the policy recommends
- Get opt-in that covers the kinds of messages you will send.
- Get separate opt-in for calls.
- Get separate opt-in for each message category where it makes sense.
- Give clear instructions for opting out of specific categories or calls, and honour them.
- Make the opt-in and opt-out flows clear and easy.
- Tell people what value they will get from the messages.
Ways to collect opt-in
- A checkbox on a form. Unticked by default, with a plain sentence such as "Send me order updates on WhatsApp".
- A message from the customer. If someone messages you first, ask in the chat whether they would like updates.
- At the point of sale. A counter form or a QR code that opens a chat, with the wording on display.
- On a website or app. A clear option at checkout or on an account page.
Whichever you use, keep a record: the number, the date, the wording shown and the source. If someone complains, that record is your proof.
What does not count
- A number you bought or scraped.
- A phone number given for another purpose, such as a delivery call, with nothing said about WhatsApp.
- A pre-ticked box.
- Silence after a message you sent without permission.
Opt-out
Meta's policy says you must respect requests to block, stop or otherwise opt out, whether the request is made on WhatsApp or somewhere else, and that includes removing the person from your contacts. In practice:
- Include a simple way to stop in your marketing templates, for example a reply keyword or a button.
- Act on a stop request immediately, in every system that holds the number.
- If someone asks you to stop by phone or email, treat that as an opt-out too.
What complaints cost
Users can block or report a business. The policy says WhatsApp's systems may limit the number of messages or calls a business can send, and may limit or remove access for significant negative feedback or policy violations. In the worst cases, a business can be barred from WhatsApp products entirely. Our guide to WhatsApp messaging limits and quality rating explains how this feeds into your sending limit.
Opt-in and templates
Opt-in is what lets you send a template to a customer who has not messaged you. Without it, a template is just an unwanted message. Our guide to WhatsApp message templates covers how the templates themselves are approved, and the guide to the customer service window explains what you can send once the customer replies.
Check the use itself is allowed
Permission is not the only test. Meta's policy lists uses it does not allow on the platform, and a message can have full opt-in and still breach it. Read the policy's list of prohibited uses before planning a campaign in a sensitive area.
Nexcomm's WhatsApp API and chatbot service can help set up opt-in flows, but the permission itself has to come from your customers. If you also use SMS or voice, TRAI's consent rules apply to those channels separately, and our guide to SMS consent in India covers them.
Frequently asked questions
Can I message people from a purchased list?
No. WhatsApp's policy requires opt-in from the person, and a bought list gives you none.
Do I need separate opt-in for each type of message?
The policy recommends it as good practice. At minimum, the opt-in should cover the kinds of message you actually send.
Can a customer who messaged me be sent marketing?
A customer writing to you opens a service window for replies. Marketing messages outside that need opt-in for that purpose, so ask clearly.
How should I record opt-in?
Keep the number, date, wording shown and where it was collected.
What if someone asks to stop by phone?
Treat it as an opt-out. The policy says requests made on or off WhatsApp must be respected.
Sources checked
- WhatsApp Business Messaging Policy (whatsappbusiness.com/policy), showing a last-updated date of 23 September 2026: opt-in requirements, opt-out, blocking and reporting consequences.
- This article is general information, not legal advice. Which Indian laws apply to your messages was not assessed here.
More in WhatsApp Business API guides.
Written by Rohit Jadhav. Last reviewed 2 November 2026.