WhatsApp Marketing Compliance Guide: Consent, Templates and Records

This is an operational guide, not legal advice. Messaging rules come from two directions at once: the law where your customer is, and the policies of the platform carrying the message. Both change, and neither is uniform across countries. What follows is a way of organising your business so that whichever rules apply, you can meet them and show that you did. Confirm your own obligations with your regulator, and check the platform documentation that applies to your account for the current position on templates, categories, and limits.

The encouraging part is that the operational answer is stable even when the rules move. Businesses that get into trouble with messaging are almost never caught out by a subtle rule change. They are caught out because they sent to people who never asked, too often, and could not show afterwards on what basis.

Most businesses believe they have consent and cannot demonstrate it. The phone numbers arrived over years from web forms, in-store sign-ups, exhibitions, referrals, and a spreadsheet a former employee compiled. Somewhere in there, some of those people agreed to something.

Four fields, from now on

Store consent as structured data on the contact: what they agreed to receive, expressed as a purpose rather than a channel; when, to the date and ideally the time; where, meaning the form, page, or interaction; and the wording they actually saw, or a stored version of it. That fourth field is the one businesses skip and the one that answers a complaint, because consent is only meaningful in relation to what was described.

Consent per purpose

Do not hold one messaging switch. Hold a small set of named purposes: order and service updates, appointment reminders, account notices, and promotions or offers. Build every audience from a purpose rather than from a raw number list.

This is not bureaucracy for its own sake. It solves the most common real-world situation, which is a customer who is entirely happy to receive their delivery notification and entirely unhappy to receive a weekend promotion. With one switch you must choose between annoying them and losing the ability to serve them. With purposes, you honour exactly what they asked for.

What to do about the legacy list

Be honest about it. Contacts with no recorded consent basis are not the same as contacts who opted in, and folding them together to make the number bigger is how businesses end up with poor quality signals and complaints. Treat them as a separate population. Where you have a genuine existing relationship and a lawful basis to make contact, a single, clearly identified, easy-to-decline message that asks whether they want to hear from you is a defensible approach in many contexts, and it produces a smaller but real list. Confirm what is permitted where your contacts are before you do it.

The single most useful mental model in business messaging is the distinction between a conversation the customer started and a message you initiated.

When a customer messages you, you are in their conversation. Speed and usefulness are what matter; the compliance burden is comparatively light because they chose to make contact. When you initiate, or when you return to a conversation that lapsed long ago, you are starting something, and that is where templates, categories, opt-in basis, and frequency all apply.

Operationally these should look different inside your business. Conversations need an inbox, fast routing to whoever can answer, and a record on the customer file. Campaigns need an audience definition, a stated purpose, an approval step, a frequency check, and a send record. Running both through the same loose process is how a promotional message ends up in a support thread, which generates complaints faster than almost anything else.

Messages that begin a conversation generally have to use a pre-approved template, and the approval process is where a lot of frustration lives. The frustration usually comes from trying to make a promotional message pass as something else.

What tends to cause problems

Templates so generic that their use cannot be assessed. Templates categorised as a service notice but plainly written as an offer. Templates that ask for sensitive information. Templates that read as though sent to people who have no idea who you are. None of these are solved by rewording; they are solved by being clear about who receives this and why.

What good looks like

Identify your business in the first line, because a message from an unknown number is reported far more often. State the reason this person is receiving it, ideally referencing the thing they did. Put the useful content early rather than after two lines of pleasantries. Use variables for details that change, such as a name, an order number, or a date, and not for the meaning of the message. Give a clear way to stop.

The category and review rules are set by the platform and change over time, so check the current documentation rather than working from what a colleague did last year.

More messaging problems come from frequency than from any other cause. A relevant message sent once is welcome. The same message sent to the same person for the fourth time in ten days is a complaint waiting to happen, and the complaint is what damages your ability to message anyone.

Note that every control in that table is structural. None of them depends on a person remembering a policy while under pressure to hit a monthly number, which is precisely when policies are forgotten.

The failure mode here is nearly universal and easy to fix. Someone asks to stop, an agent acknowledges it politely in the thread, and nothing happens to any list. Three weeks later the next campaign arrives and a mildly irritated customer becomes a formal complaint.

Three requirements. First, one control: a suppression flag on the contact that applies to every campaign, sequence, and list simultaneously. Second, recognition of real language: people write remove me, stop sending these, or the same sentiment in their own language far more often than they send a single keyword, and anything ambiguous should reach a human rather than being discarded. Third, a test: opt a contact out and then deliberately attempt to include them in a send. If the system permits it, your control does not exist yet.

Where you hold consent by purpose, offer the narrower option too. Many people who want the promotions to stop still want the delivery notification, and giving them that choice keeps a useful channel open.

A retailer has around eleven thousand phone numbers gathered over four years and wants to run WhatsApp campaigns. The instinct is to message all eleven thousand.

The audit takes an afternoon. Roughly three thousand numbers came from a web form that included a clearly worded messaging opt-in, with the date recorded. Around four thousand came from point-of-sale capture where the receipt option was the stated purpose and nothing else was mentioned. Two thousand came from a competition entry with terms that mentioned marketing in general terms. The remaining two thousand have no identifiable source at all.

The decisions follow. The three thousand with explicit opt-in become the promotional audience, tagged with purpose, date, and source. The four thousand from point of sale are marked as service-purpose only and receive order and collection messages, not offers. The competition entrants are a grey area; the business decides on one clearly identified message asking whether they would like to receive offers, with an obvious way to decline, and keeps only those who say yes, which turns out to be a few hundred. The two thousand unattributed numbers are not messaged at all, and are kept for order lookup only.

Frequency is capped at two promotional messages per contact per month, enforced in the system. Quiet hours are set from the recipient location. A pre-send checklist requires a named approver.

The first campaign therefore goes to three thousand people rather than eleven thousand. It produces more replies than the previous broadcast attempt did, almost no blocks, and a small number of opt-outs that are honoured everywhere at once. The smaller list outperforms the larger one, which is the pattern that recurs in messaging more reliably than almost anything else.

One messaging switch instead of purposes

Fix: named purposes on the contact, audiences built from purpose. It solves the promotions-versus-delivery problem permanently.

Opt-outs recorded in a chat thread

Fix: a structured suppression flag, plus a periodic test that deliberately tries to message a suppressed contact.

Campaigns scheduled in the sender time zone

Fix: contact-level time zone and quiet hours. A message at four in the morning is remembered as an intrusion regardless of its content.

Buying or scraping numbers

Fix: do not. Beyond the legal exposure, purchased lists produce blocks and reports quickly, and the damage lands on your business number rather than on the list seller.

Business conversations on personal handsets

Fix: a business number connected to your system. Otherwise consent evidence, message history, and opt-out status live on a phone your business does not control and cannot search.

Nobody owns approvals

Fix: one named approver per campaign, recorded. It takes two minutes and prevents most of the sends people later regret.

Watch four things. Blocks and reports as a share of messages sent, which should stay very low and which reacts quickly to audience or frequency mistakes. Reply rate, which is the clearest signal that recipients consider the message relevant. Opt-out rate per campaign, treated as feedback about targeting rather than as an inevitable cost. And the time it takes you to answer a question about one specific contact, which should be under a minute.

If block and report rates rise, do not rewrite the message. Look at who received it and how recently they last heard from you. Relevance and frequency explain the great majority of poor messaging outcomes, and wording explains very little of it.

None of this requires a particular product, but all of it requires that consent, message history, and suppression live on the customer record rather than in three separate places. The moment those are split, the one-minute test fails and opt-outs start slipping through.

HelloGrowthCRM keeps WhatsApp conversations on the contact record alongside calls and email, holds consent and suppression as fields on the contact rather than per campaign, and supports contact-level timing so quiet hours reflect where the recipient actually is. There is a free plan to set your consent structure up on, and paid access is $10/user/month billed annually.

Related reading: WhatsApp CRM, CRM with WhatsApp, sales automation, lead management software, Wati alternative, CRM for small business, and pricing.