How to Collect WhatsApp Opt-Ins Before the Festive Rush
Every festive broadcast plan assumes something nobody checks: that you are allowed to message the list.
Most Indian businesses are not. They have a database of phone numbers from orders, enquiries and walk-ins. That is not a list. Under Meta's rules it is not consent, and under Indian law it is about to be a liability.
Big Billion Days is expected to open on 23 September. That gives you roughly two weeks. Here is what actually counts as an opt-in, the nine places to collect one, and why the box you build this month has to satisfy a law that bites in 2027.
What opt-in actually means
Meta requires opt-in before you message anyone. Since the November 2024 policy update the permission does not have to be WhatsApp-specific. It can be general consent to hear from your business, as long as you follow local law.
Two things must be clear at the moment of consent:
- That the person is agreeing to receive messages.
- The name of the business they will receive them from.
That second one catches people out. Your WhatsApp display name has to match the business name in the opt-in text. Collecting consent for one brand and messaging from another is a policy breach, not a technicality.
Three things that are not consent
This is where most Indian SMBs are exposed.
- A phone number in your billing software. Storing a number does not grant permission to broadcast to it. Your CRM is not a subscriber list.
- A transaction. Somebody buying from you is not marketing consent. They bought a product, they did not subscribe to offers.
- An inbound message. Someone messaging you first opens a service window. It does not permit promotional broadcasts later.
Marketing consent is always separate and always explicit. If you take one thing from this post, take that.
The proof problem
Meta puts the burden of proof on the sender. Not on the customer, and not on your platform.
So an opt-in you cannot evidence is an opt-in you do not have. If a complaint lands, "they bought from us in March" is not a defence.
Log three fields against every contact from now on:
- Timestamp. The exact date and time of the opt-in action.
- Source. Where it happened. Checkout, QR at the counter, ad click, website widget.
- Consent text. The exact wording the person saw and agreed to.
That third field is the one everyone skips. Wording changes over time. If you cannot show what a customer agreed to in September, you cannot prove what they agreed to at all.
Nine places to collect an opt-in
You do not need all nine. You need the three or four that match how you actually sell.
| Where | Best for | Speed |
|---|---|---|
| Checkout checkbox | Any online store | Compounds slowly |
| Website chat widget | Sites with real traffic | Medium |
| Click-to-WhatsApp ads | Anyone with an ad budget | Immediate |
| QR code at the counter | Shops, clinics, salons, restaurants | Medium |
| Invoice or bill footer | Service businesses, B2B | Slow |
| Order confirmation message | Stores already sending utility templates | Medium |
| Packaging insert | D2C and marketplace sellers | Slow but cheap |
| Staff asking at the till | High-footfall retail | Fast, if staff actually ask |
| Missed-call number | Tier-two and tier-three, low-smartphone segments | Medium |
Marketplace sellers should look hard at the packaging insert row. Flipkart and Amazon mask buyer numbers, so an insert with a QR code is one of the few legitimate routes from a marketplace order to a contact you own. The Big Billion Days plan covers that constraint in more detail.
The checkout checkbox
This is the highest-value box on your site, and most stores word it badly.
Wording that works:
Send me order updates on WhatsApp from [Business Name].
Send me offers and promotions on WhatsApp from [Business Name].
Reply STOP to either at any time.
Note that this is two boxes, not one. Order updates and marketing offers are separate purposes, and the section below explains why bundling them is a problem.
Four things the wording does. It names the business. It says what will be sent. It says where. And it shows the exit up front, which raises tick rates rather than lowering them.
Now the part that is no longer optional.
Never pre-tick the box. This used to be filed under best practice. In India it is now a legal requirement, and that changes the calculation.
The law behind the checkbox
India's Digital Personal Data Protection Rules were notified in November 2025, starting an 18-month phased rollout of the DPDP Act.
Two dates matter:
| Date | What happens |
|---|---|
| 13 November 2026 | Rule 4 comes into force, covering registration of Consent Managers. |
| 13 May 2027 | Full compliance. This is the hard enforcement date. |
What the rules require of a consent flow:
- No pre-ticked boxes. Consent must be an affirmative act.
- Granular and purpose-specific. Each purpose needs its own consent. Order updates and marketing offers are two purposes, not one.
- A plain-language notice that stands on its own, not buried in terms and conditions.
- A stated way to withdraw. Withdrawal has to be as easy as giving consent was.
Penalties run to Rs 250 crore. That number is aimed at large processors rather than a 300-order store, but the design requirements apply to everyone.
Here is why this matters in September rather than in 2027. You are about to build or rewrite a consent flow for the festive season. Build it to the 2027 standard now and you never touch it again. Build it the quick way and you will rebuild it, then re-permission a list you already collected.
The granular point is the one that trips people. If you want to send both order updates and offers, ask for both, separately. A single box covering "communication from us" is the kind of thing that fails a purpose-specific test.
QR codes, for anyone with a counter
This is the cheapest list-building available to an offline business. A printed QR that opens a WhatsApp chat with a pre-filled message costs the price of a card.
Three things separate the ones that work from the ones that get ignored:
- Give a reason to scan. "Follow us" fails. "Scan for your bill on WhatsApp" or "scan for 10 percent off your next visit" works.
- Put it where people wait. The billing counter, the table, the back of the receipt. Not the entrance.
- Confirm the opt-in in the first reply. The scan opens a chat. The chat is where you state what they are signing up for and log the consent.
A scan alone is an inbound message, which is not marketing consent. The confirmation step is what converts it into one.
Click-to-WhatsApp ads, and why they improve on 1 October
Click-to-WhatsApp ads are the only lever here that builds a list this week rather than this quarter. The lead arrives in a chat, and you capture consent in the conversation.
They are also about to become relatively cheaper, which almost nobody has noticed.
On 1 October the free 24-hour service window closes and free-text replies become billable at Rs 0.115 in India. But the 72-hour free entry point window opened by a click-to-WhatsApp ad survives that change. Every message inside those 72 hours, templates included, stays free.
So from October, an ad-sourced conversation is the last free messaging window on the platform. You still pay Meta Ads Manager for the click. The WhatsApp conversation on the other side costs nothing for three days.
Two practical notes. You build the ad and creative in Meta Ads Manager, not inside your WhatsApp platform. And 72 hours is long enough to qualify a lead, answer questions and close, if you have a flow ready rather than an agent typing from scratch.
Wamafy captures click-to-WhatsApp leads and routes them into a chatbot or Flow, and sends conversion events back to Meta through the Conversions API so the ad optimises on what actually converted.
What to do with the list you already have
You have a database of past customers with no marketing consent. You cannot broadcast offers to it. You can, carefully, ask.
The safe version:
- Use a channel you already have permission on. Email, SMS if you have consent there, or a utility message tied to a real transaction.
- Ask them to opt in, do not assume it. One clear question with a yes or no answer.
- Start small. A few hundred contacts, not the whole database on day one.
- Watch the quality rating daily. If it slips to yellow, stop and let it recover.
What not to do is import 8,000 old numbers and broadcast a festive offer to them on 23 September. Blocks from that will damage the rating that controls your daily sending limit, during the week you need it most. The quality rating explainer covers how fast that damage lands.
When you do import, clean the file first. Wamafy normalises numbers to E.164 and removes duplicates on upload, which matters more than it sounds: duplicates mean the same person gets the same broadcast twice, and that is a block waiting to happen.
How fast a list actually grows
Time for honest arithmetic, because the two-week framing needs a reality check.
Take a store doing 300 orders a month. Assume a checkout checkbox that around a third of buyers tick. That is roughly 100 opt-ins a month, or about 50 in the two weeks before the sale.
Fifty contacts is not a festive campaign. Substitute your own order volume and tick rate, and the shape of the answer will be the same.
So be clear about what each lever is for:
- For this sale: click-to-WhatsApp ads, QR codes if you have footfall, and a careful re-permission ask to your existing customers.
- For next year: the checkout checkbox, packaging inserts and invoice footers. These compound. A store adding 100 a month has 1,200 by next Diwali.
The checkout checkbox will not save your September. It is still the highest-return thing you will build this month.
The welcome message decides whether they stay
The first message after opt-in is the one that determines whether the second one gets read.
Send it immediately, while the intent is fresh. Keep it to four things:
- Thank them and name your business.
- Say what you will send and roughly how often.
- Give one piece of value straight away. The discount you promised, or the order link.
- State how to stop. Reply STOP, in plain words.
Do not open with a sale. A welcome message that is purely promotional teaches people that opting in was a mistake, and they act on that within a day. The India compliance guide has more on opt-out handling.
Frequently Asked Questions
Can I import my existing customer list into WhatsApp?
You can import the numbers, but you cannot send marketing broadcasts to people who have not given marketing consent. A past purchase is not consent. Ask them to opt in through a channel you already have permission on, in small batches.
Do I need opt-in to send order updates?
Order and delivery updates are utility messages tied to a transaction the customer initiated, so they sit differently from marketing. Even so, name your business clearly and give an easy way to stop. Under DPDP, order updates and marketing offers are separate purposes and need separate consent.
What counts as a valid WhatsApp opt-in in India?
A clear affirmative action where the person is told they will receive messages and told which business will send them. You must be able to evidence it, so log the timestamp, the source and the exact consent wording shown.
Can I pre-tick the opt-in box on my checkout?
No. India's DPDP Rules require consent to be an affirmative act, which rules out pre-ticked boxes. Full compliance is due by 13 May 2027, so build the flow correctly now rather than rebuilding it later.
Are click-to-WhatsApp ad conversations still free after October 2026?
Yes. The 72-hour free entry point window opened by a click-to-WhatsApp ad survives the 1 October change, and all messages inside it stay free. You still pay for the ad click in Meta Ads Manager.
How many opt-ins can I collect before the festive sale?
Fewer than you would like. A store doing 300 orders a month with a checkout checkbox might add 50 in two weeks. Ads and QR codes move faster, which is why they are the levers for this sale and the checkbox is the lever for next year.
Build it once, correctly
The temptation this month is to bolt a checkbox onto checkout, tick it by default, and worry about the rest later. That version has to be rebuilt before May 2027, and the list it collects has to be re-permissioned.
The version that names your business, asks separately for offers, logs the wording and shows the exit costs about an hour more to build and never needs touching again.
If you want to collect opt-ins from ads, QR codes and checkout in one place, with the source and timestamp held against each contact, Wamafy is an official Meta Tech Provider with a 14-day free trial. Your card is authorized when the trial starts and charged only on day 15, and you pay Meta's message rates directly with no per-conversation markup added on top.