A list without permission burns a new number in just a few hours — and changing the number usually makes it worse, because now there is a pattern. This article explains what a truly protective opt-in is, where it can come from, how to record it as proof, and the cost of ignoring it.
In this article
What opt-in means in practice
Opt-in is the permission a customer gives to receive messages from your company on WhatsApp. Said like this, it sounds bureaucratic, and that’s where most companies go wrong: they treat it as a checkbox to tick, comply on paper, and keep sending messages to people who never asked for them. The result appears weeks later, when the number starts being blocked by unknown users and the quality plummets.
It’s worth separating two things that are often confused. The platform requirement says you need user permission to start a conversation via template. The legal requirement, in Brazil the LGPD, deals with consent for personal data use. These are different layers with different origins — and you need both.
There is also a third filter, which is not in any rule and is the most ruthless: the recipient themselves. They decide, in two seconds, whether the message is authorized or a nuisance. This judgment leads to blocking or reporting — and it’s what WhatsApp uses to decide your number’s future.
Why this determines your number’s fate
The mechanism is straightforward. When a recipient blocks or reports your company, the signal goes to the platform. Accumulating these signals lowers the number’s quality, reduces the daily sending limit, and ultimately suspends the ability to start conversations.
What makes this dangerous is the speed. A purchased list blasted in a single day can burn a new number in just a few hours. There is no quick appeal, no support to reverse it, and the history stays tied to that number.
There is an aggravating factor that surprises many: the problem is not solved by changing the number. The platform evaluates the whole — the business account, portfolio, behavior. Those who burn one number with a cold list tend to burn the second faster than the first, because now there is a pattern. This is the known path to the company’s number being banned.
Keep reading for free
Fill out once and unlock this and all other blog articles. We charge nothing — we just want to know who we’re writing for.
Takes 20 seconds. Prefer to talk directly on WhatsApp?
What a valid opt-in is
An opt-in that protects you has five characteristics. Just keeping the checked box isn’t enough.
It’s specific to the channel. "I agree to be contacted" is vague. "I agree to receive messages on WhatsApp" is specific. The person needs to know where you will contact them.
It’s affirmative. Pre-checked boxes are not consent. The person must take the action to accept.
It’s informed. It states what they will receive and how often. "News and promotions, up to twice a month" is different from a blank check.
It’s recorded with proof. Date, time, origin, exact text accepted, and when possible, IP address. Without this, you have a claim, not proof.
It has an easy opt-out. Every message must clearly state how to stop receiving. It seems counterintuitive to make opting out easy, but those who opt out by choice don’t block — and blocking is what hurts.
The six legitimate sources of opt-in
1. Website form. With a WhatsApp field and visible consent phrase, not hidden in a link. Record the exact text shown on the date.
2. Click-to-WhatsApp ad. The person clicked and started the conversation. It’s one of the strongest opt-ins because the initiative was theirs.
3. Customer who already purchased. An existing commercial relationship is a solid base, as long as communication relates to what they contracted.
4. In-person registration. Form at the store, event, reception — with the authorization field signed and scanned.
5. QR Code with clear destination. Material that says "point here to talk to us on WhatsApp." Whoever points is initiating.
6. Referral with confirmation. Someone passed a contact of an acquaintance. Here the opt-in doesn’t yet exist — the first message must say who referred and ask permission to continue.
Note what’s not on the list: purchased lists, scraped website databases, group contacts, and spreadsheets inherited from another company. None of these generate permission, even if the phone number is correct.
How to record it as proof
If someone questions it — the customer, the platform, or a data protection agency — you need to show the record. Keep, for each contact, seven fields: phone · name · date and time of acceptance · origin (URL, campaign, form) · exact consent text shown · current privacy policy version · capture channel.
Two precautions most forget. First: keep the text shown at the time, not the current text. If you changed the form wording in March, those who accepted in January accepted something else, and that’s what counts. Second: also record opt-outs — when someone asks to stop, the date and time of the request and when sending was actually stopped.
This record must be retrievable within minutes, by phone. If locating a specific contact’s consent requires digging through spreadsheets, it practically doesn’t exist.
How to ask without scaring people away
Asking permission seems like friction, but it’s friction that saves money: it filters out those who would block later.
On the form, one line is enough: "I authorize receiving WhatsApp messages about my quote and news. I can cancel anytime." Short, specific, and with opt-out announced.
In the first message to referrals, use a three-part structure: who you are, who referred, and the question. "Hi, Marcos. This is Ana from Construtora Silva. Pedro Alves gave me your contact because he mentioned you’re renovating. Can I send you some information here?" The question at the end turns the approach into an invitation.
At reception or in-store, ask when the customer is satisfied, not on arrival. Someone just well served accepts easily; someone still waiting sees it as a demand.
One measure is worth more than any script: track the blocking rate by contact source. If leads from the form block 0.5% and those from a specific list block 9%, you don’t have a messaging problem — you have a source problem, and no text improvement will fix that.
The cost of ignoring it, with numbers
A company with a number in TIER_1000, able to start a thousand conversations per day. It blasts a list of 3,000 contacts without opt-in.
In the first hours: 7% block, 210 people. Quality drops to red the same day. The limit is reduced, and new attempts are rejected.
The direct cost: the number returns to the lowest tier and takes weeks to recover reputation — if it recovers. Add to that the legitimate conversations that don’t happen. If that number served 40 real customers per day and the average ticket is R$ 800 with 10% conversion, that’s R$ 3,200 per day of interrupted revenue. In two weeks of recovery, R$ 44,800.
Compare with the expected return from the blast: 3,000 cold messages with optimistic conversion of 0.5% and ticket of R$ 800 would yield R$ 12,000 — in the best case, and not counting that much wasn’t even delivered. The math is clearly bad, and it ignores the worst: reputation damage, which is priceless because it has no timeline. It’s the difference between a well-done blast and one that destroys the channel.
Applicable materials: the opt-in kit
1. Standard form text. "I authorize contact via WhatsApp about [subject]. You can cancel anytime by replying STOP. See Privacy Policy."
2. Registration spreadsheet, with the seven fields mentioned, automatically fed by the form whenever possible.
3. Standard footer for the first message of each campaign: "If you no longer want to receive messages, reply STOP."
4. Opt-out routine: keyword that stops sending immediately, confirmation to the person, and date recorded. Continuing to send after an opt-out request turns someone indifferent into someone who reports.
5. Monthly dashboard by source: contacts captured, response rate, blocking rate, and opt-out requests. One line per source.
This dashboard is the most valuable item on the list because it turns opt-in from an obligation into a management tool. A source with high blocking is money spent destroying your own channel — and once visible in the spreadsheet, that decision stops being opinion and becomes a number.
Frequently Asked Questions
Does buying a contact list and asking for opt-in in the first message work?
No, because the first message is already the problem. To start a conversation via template you need permission beforehand, and it’s precisely this unauthorized first send that generates blocking and reporting in volume. The legitimate path for referred contacts is different: the initial message says who you are, who referred the contact, and asks if you can continue — and this works for individual cases, not for thousands of numbers from a purchased spreadsheet.
Does an existing customer who already purchased need a new opt-in?
An existing commercial relationship is a solid base for communication related to what the person contracted — billing, scheduling, support, news about the same service. The caution is not to stretch this to unrelated topics: someone who bought a product once did not authorize receiving promotions for everything the company sells. When in doubt, the cheap way out is to ask for confirmation in an ongoing conversation and record the response.
What needs to be stored for the opt-in to serve as proof?
Seven fields per contact: phone, name, date and time of acceptance, origin with URL or campaign, the exact consent text shown on that date, the current privacy policy version, and the capture channel. Keep the text from the time, not the current one — those who accepted in January accepted the January wording. Also record opt-outs, with request date and when sending stopped. And ensure locating all this by phone takes minutes, not hours.
Centralize service without changing your number
Connection via QR or official API, single queue with assigned responsible, client history stays with the company, and sales funnel on the same WhatsApp panel.