# WhatsApp consent: what Meta and the GDPR require > To message a customer first on WhatsApp, Meta requires that they gave you their number and agreed to receive your messages, knowing who you are. In France and Spain, the law adds two rules for offers: a separate box, never pre-ticked, and dated proof of each consent. Key points - Two different consents: being contacted on WhatsApp (the channel) and receiving your offers (marketing). Ask for them separately. - Meta wants your business name and agreement to receive its messages; a form on your website is an accepted way to collect it. - For offers to consumers in France, and to everyone in Spain: a dedicated box, never pre-ticked, and an easy way out such as STOP. - Keep the proof: text shown, version, date and time, page, number. A screenshot is not enough. - This guide covers France and Spain. It is not legal advice. ## Two consents not to confuse A customer who leaves their number to be called back agrees to be contacted. That does not mean they agree to your promotions. The Spanish data protection authority (AEPD) made this point when it fined a business for advertising sent on WhatsApp to someone who had only asked for information. | | Channel consent | Marketing consent | | --- | --- | --- | | What it allows | Replying to the request on WhatsApp, on your initiative | Sending offers, news, sales follow-ups | | Who requires it | Meta, for any message you send first | The law: CNIL in France, LSSI in Spain | | How to ask | A clear choice: WhatsApp and phone, or phone only | A separate, unticked box that names WhatsApp | | How it ends | STOP, “It’s not me”, or a request made another way | STOP (BAJA in Spain) or a simple request | *Both are asked for in the same form, but never with the same box.* ## What Meta requires - The customer gave you their number and agreed to receive your messages or calls. - The request clearly names your business and says they agree to receive its messages. - Accepted methods: SMS, a website form, an IVR phone flow, in person or on paper. - Meta accepts general consent, not specific to WhatsApp, where local law allows. In France and Spain, naming WhatsApp is safer. - A request to stop must be honoured, whether it arrives on WhatsApp or elsewhere. - To call a customer on WhatsApp, Meta advises separate consent: agreeing to messages does not cover WhatsApp calls. The message that confirms consent collected elsewhere can be a “utility” template, cheaper than a marketing one: €0.0248 per delivered message in France, €0.0166 in Spain. On one condition: no offer in the text. A template mixed with promotion is classed as marketing, and Meta can re-categorise a template that was already approved. ## What the law requires in France - Offers to consumers: prior consent, through a dedicated tick box that is never pre-ticked. Accepting terms and conditions is not enough. - Offers to professionals, on a subject linked to their work: inform them and let them object simply and for free. - One consent per purpose: the CNIL does not accept bundled consent. - Every message shows who is writing and offers a simple way to stop. - You must be able to demonstrate consent at any time. ## What the law requires in Spain - Law 34/2002 (LSSI), article 21: an electronic commercial communication must have been requested or expressly authorised. The text does not distinguish consumers from businesses. - Article 21.2 exception: an existing customer, for products similar to those they bought, with the option to object in every message. - Article 22: consent is withdrawn by simply notifying that wish. - Organic Law 3/2018 (LOPDGDD): a contract cannot depend on consent to offers. - The AEPD requires consents to be documented, recorded and kept. In the UK, the UK GDPR and PECR apply, with guidance from the ICO. This guide does not cover them. ## The proof to keep The AEPD has ruled that a screenshot proves nothing. Proof is a dated record, made when consent is given, that you can export: - the exact text shown, with its version (if it changes, the old version stays linked to earlier consents); - the date and time, and the page where the form was placed; - the name, the number, the channel choice and the offers box as submitted; - the confirmation on WhatsApp, with the IDs of the message sent and of the reply; - every withdrawal: STOP, “It’s not me”, a request made to the team. A one-tap confirmation on WhatsApp proves that the number belongs to that person. Without it, anyone can type someone else’s number. ## Ready-to-copy wording This wording is the one used by the WYP.chat WhatsApp consent form. Replace the brackets and keep the question, the two choices and the box separate. STOP and BAJA are the recognised opt-out words. ### In English *Question and two choices, neither pre-selected* > How may \[Your business\] get back to you? > ○ WhatsApp and phone > ○ Phone only *Offers box, separate and never pre-ticked* > ☐ I agree to receive offers and news from \[Your business\] on WhatsApp. I can stop at any time by replying STOP. *Notice under the button* > Data controller: \[Legal name\]. Your details are used to answer your request and, if you tick the box, to send you offers from \[Your business\] on WhatsApp. Choosing “WhatsApp and phone” does not cover WhatsApp calls. To stop, reply STOP. Privacy policy: \[link to your privacy policy\] ### In French *Question and two choices, neither pre-selected* > Comment acceptez-vous que \[Votre entreprise\] vous recontacte ? > ○ WhatsApp et téléphone > ○ Téléphone seulement *Offers box, separate and never pre-ticked* > ☐ J’accepte de recevoir les offres et nouveautés de \[Votre entreprise\] sur WhatsApp. Je peux arrêter à tout moment en répondant STOP. *Notice under the button* > Responsable du traitement : \[Raison sociale\]. Vos coordonnées servent à répondre à votre demande et, si vous cochez la case, à vous envoyer les offres de \[Votre entreprise\] sur WhatsApp. Le choix « WhatsApp et téléphone » ne vaut pas accord pour des appels WhatsApp. Pour arrêter, répondez STOP. Politique de confidentialité : \[lien de votre politique de confidentialité\] ### In Spanish (Spain, informal) *Question and two choices, neither pre-selected* > ¿Cómo aceptas que \[Tu empresa\] te vuelva a contactar? > ○ WhatsApp y teléfono > ○ Solo teléfono *Offers box, separate and never pre-ticked* > ☐ Acepto recibir ofertas y novedades de \[Tu empresa\] por WhatsApp. Puedo darme de baja cuando quiera respondiendo BAJA. *Notice under the button* > Responsable del tratamiento: \[Razón social\]. Tus datos se usan para responder a tu solicitud y, si marcas la casilla, para enviarte las ofertas de \[Tu empresa\] por WhatsApp. Elegir «WhatsApp y teléfono» no autoriza llamadas de WhatsApp. Para darte de baja, responde BAJA. Política de privacidad: \[enlace a tu política de privacidad\] The Spanish wording has not yet been reviewed by a lawyer: have it checked before you use it. This wording is not legal advice. ## The confirmation on WhatsApp After the form, a utility template, with no offer or link, asks the customer to confirm with one tap. Offers are only recorded after “Yes, it’s me”. Emma WhatsApp Today Hello Emma, you asked Martin Bakery to get back to you on WhatsApp. Is this you? · 10:02 Yes, it’s me It’s not me Yes, it’s me · 10:03 Thank you, that’s noted. To stop, reply STOP. · 10:03 ## Edge cases: STOP, withdrawal, minors - **STOP**: The customer stops both offers and contact on WhatsApp. A new form filled in with their number never lifts this: only the customer, by writing to you, can start again. - **“It’s not me”**: Someone typed another person’s number. No more messages on your initiative, and this refusal is kept even if the record is deleted. - **Withdrawal made another way**: An email, a call, a request in the shop: it counts as much as STOP. Note it on the record. - **Phone only**: No WhatsApp message on your initiative. If the customer writes to you, you can reply within the [24-hour window](https://wyp.chat/en/glossary#fenetre-24h). - **Minors**: To consent on their own, the age is 15 in France and 14 in Spain. If your customers are young, take advice. - **Existing customers**: Meta asks for consent to be contacted on WhatsApp: a purchase on its own is not consent. The legal exceptions for existing customers are narrow: if in doubt, ask. ## Doing it with WYP.chat The WhatsApp consent form is created in Settings, Entry points, and goes on your website as a frame you copy, with no script. It does what this guide describes: - name, number, a required choice of “WhatsApp and phone” or “Phone only”, and a separate, unticked offers box; - question, choices, box and notice fixed and versioned: they are the proof; - a two-button confirmation on WhatsApp, with no WYP.chat credits; Meta charges for the delivered message; - offers recorded only after “Yes, it’s me”, dropped with no tap within 30 days; - proof exportable as JSON or text from the contact record, with no IP address; - a form never lifts a STOP; “Phone only” blocks every [WhatsApp template](https://wyp.chat/en/glossary#modele). What it does not do: it does not cover WhatsApp calls, and it does not decide the existing-customer exception for you. - [Price of a utility or marketing message, country by country](https://wyp.chat/en/guides/whatsapp-message-pricing) - [Create a WhatsApp link and its QR code](https://wyp.chat/en/guides/whatsapp-link-generator) - [Reply as a team from one WhatsApp number](https://wyp.chat/en/guides/whatsapp-business-multiple-users) - [WhatsApp campaigns with consent and STOP](https://wyp.chat/en/features/whatsapp-campaigns) ## How to do it in WYP.chat Help centre articles that walk through each setting, screen by screen. - [WhatsApp consent form on your website](https://wyp.chat/en/help/formulaire-accord-whatsapp) - [WhatsApp links and QR codes: entry points](https://wyp.chat/en/help/points-entree) - [Import your contacts and their permission for offers](https://wyp.chat/en/help/importer-contacts) - [Send a WhatsApp campaign](https://wyp.chat/en/help/lancer-campagne) ## Sources 1. Meta, Get opt-in for WhatsApp: [developers.facebook.com/documentation/business-messaging/whatsapp/getting-opt-in](https://developers.facebook.com/documentation/business-messaging/whatsapp/getting-opt-in) 2. WhatsApp, Business Messaging Policy: [business.whatsapp.com/policy](https://business.whatsapp.com/policy) 3. Meta, Template categorization: [developers.facebook.com/documentation/business-messaging/whatsapp/templates/template-categorization](https://developers.facebook.com/documentation/business-messaging/whatsapp/templates/template-categorization) 4. CNIL, La prospection commerciale par courrier électronique, SMS-MMS et automate d’appel: [www.cnil.fr/fr/la-prospection-commerciale-par-courrier-electronique-sms-mms-et-automate-dappel](https://www.cnil.fr/fr/la-prospection-commerciale-par-courrier-electronique-sms-mms-et-automate-dappel) 5. CNIL, Comment recueillir le consentement des personnes: [www.cnil.fr/fr/les-bases-legales/consentement](https://www.cnil.fr/fr/les-bases-legales/consentement) 6. BOE, Law 34/2002 (LSSI), articles 21 and 22: [www.boe.es/buscar/act.php?id=BOE-A-2002-13758#a21](https://www.boe.es/buscar/act.php?id=BOE-A-2002-13758#a21) 7. BOE, Organic Law 3/2018 (LOPDGDD), articles 6 and 7: [www.boe.es/buscar/act.php?id=BOE-A-2018-16673#a7](https://www.boe.es/buscar/act.php?id=BOE-A-2018-16673#a7) 8. AEPD, PS/00407/2023 (proof of consent): [www.aepd.es/documento/ps-00407-2023.pdf](https://www.aepd.es/documento/ps-00407-2023.pdf) 9. AEPD, PS/00323/2020 (advertising on WhatsApp): [www.aepd.es/documento/ps-00323-2020.pdf](https://www.aepd.es/documento/ps-00323-2020.pdf) Pages checked on 13 October 2026; Meta’s page re-read on 15 October 2026. Prices from the Meta rate card used by WYP.chat. This guide is not legal advice. ## Frequently asked questions ### Do I need a customer’s consent to message them on WhatsApp? Yes, for any message you send first: Meta requires that the customer gave you their number and agreed to your messages. For offers, French and Spanish law also require a dedicated, unticked box. ### Is a pre-ticked box or accepting the terms enough? No. The CNIL rules out pre-ticked boxes and bundled consent. Consent to offers is given with a separate box. ### Does consent given for email cover WhatsApp? Meta accepts general consent where local law allows. The GDPR asks for specific consent: the safest way is to name WhatsApp in the box. ### What should a WhatsApp consent request say? Your business name and that the person agrees to receive your messages on WhatsApp. The confirmation sent afterwards should contain no offer, so that it stays a utility template. ### How do I prove WhatsApp consent? With a record made at the time: text shown and its version, date and time, page, number, choice, then the confirmation on WhatsApp. A screenshot is not enough. ### What do I do when a customer replies STOP? Stop every message on your initiative on WhatsApp, offers included, and keep a record of the refusal. A form filled in later with the same number does not lift it. ### From what age can a customer consent on their own? 15 in France, according to the CNIL, and 14 in Spain, under Organic Law 3/2018. ## Read next - [WhatsApp Business message pricing by country in 2026](https://wyp.chat/en/guides/whatsapp-message-pricing) - [WhatsApp link and QR code generator](https://wyp.chat/en/guides/whatsapp-link-generator) - [WhatsApp campaigns for small businesses](https://wyp.chat/en/features/whatsapp-campaigns) --- Source: https://wyp.chat/en/guides/whatsapp-consent · Updated on 15 October 2026