Why compliance shapes deliverability
WhatsApp is a personal channel, and the platform enforces rules that keep it that way. A business that messages people who did not opt in, or sends too often, will see its quality rating fall — and with it, its ability to send at all. Compliance is not paperwork; it is the mechanism that keeps the channel open.
Not legal advice
This article is educational guidance, not legal advice. Requirements vary by jurisdiction and by agreement with the WhatsApp Business Platform. Have your compliance counsel review your consent, retention and messaging practices.
Opt-in: the foundation
Before any business-initiated campaign, the recipient must have opted in. A meaningful opt-in is specific (they know what they are signing up for), documented (you can prove it) and easy to withdraw. Collecting consent through a form, a checkbox or an inbound keyword is far stronger than assuming consent from an existing relationship.
- Document when, where and how each contact opted in.
- Record the exact wording of the consent prompt.
- Keep consent evidence as long as your data policy requires.
- Treat re-consent as a normal lifecycle step for dormant contacts.
Templates and the 24-hour window
WhatsApp separates customer-initiated conversations (where free-form replies are allowed inside the session window) from business-initiated messages (which must use an approved template). Campaigns that start new conversations therefore depend on templates — and on approval states your team can actually see.
| Scenario | What is allowed | What to avoid |
|---|---|---|
| Reply to a customer | Free-form within the session window | Replies outside the window |
| Start a conversation | Approved template to opted-in contacts | Sending before approval |
| Follow up later | A fresh template or a re-opened session | Treating an old window as open |
Frequency, relevance and opt-out
Even with consent, volume matters. Sending too many messages damages both the experience and the quality rating. Practical guardrails: send only messages with clear value, honour every opt-out promptly, and let contacts choose frequency where the content supports it. An opt-out must be as easy as the opt-in.
- Honour opt-outs immediately and across all campaign lists.
- Segment audiences so relevance stays high.
- Monitor unsubscribe and complaint patterns as early signals.
- Pause sends when engagement collapses instead of pushing through.
Record keeping and privacy
A defensible campaign operation keeps the data that proves how it behaves: consent records, template versions, send logs and opt-out history. Retention should follow your documented data policy — keep what you can justify, and delete the rest. RapidRoot's workspace keeps campaign and contact history in one place, which makes these records straightforward to maintain.
A practical starting point
Write down four things before your first campaign: how contacts opted in, which templates you may send, how often you will send, and how someone opts out. That single page will prevent most compliance mistakes.
Plan campaigns inside Messaging Cloud
Template states, audience segments and send logs in the same workspace as your conversations.
Get a compliance review of your setup
Our team can walk through your consent and template plan before you send.
Frequently asked
Is a business allowed to message someone who did not opt in?
No. Opt-in is required for business-initiated WhatsApp messages, and unsolicited messaging can harm the business's quality rating and sending ability.
When must a business use a template?
Outside the 24-hour session window, business-initiated messages must use an approved template. Inside the window, replies to a customer can be free-form.
Is this article legal advice?
No. Compliance requirements vary by jurisdiction and by your agreement with WhatsApp; have your counsel review your practices.