In this guide · 8 sections
Short answer
Collect opt-in that names your business and the types of messages, with an unticked box for marketing. For each person, record the number, date and time, source (form, QR, in-store), exact wording shown and their choice. Keep it while you message them, and act on opt-outs within 21 days at most.
Two sets of rules ask for opt-in
WhatsApp opt-in in Singapore has to satisfy Meta and Singapore law at the same time.
| Rule | What it requires | Who enforces |
|---|---|---|
| WhatsApp Business Messaging Policy | Opt-in before you message people, naming your business; honour block and opt-out requests | Meta, through quality ratings, limits and bans |
| PDPA consent obligation | Consent, or an exception, to collect and use the phone number for your purpose | PDPC |
| PDPA Do Not Call provisions | For marketing to Singapore numbers: clear and unambiguous consent in evidential form, or a DNC Registry check | PDPC |
Meta's WhatsApp Business Messaging Policy says you may only contact people who have given you their number and opted in to receive messages from you, that you are solely responsible for how you collect opt-in under applicable law, and that you must respect all requests to block or opt out, on or off WhatsApp. For the wider marketing rules, see our guide to WhatsApp marketing rules in Singapore.
What Meta's opt-in must say
Meta's developer page on getting opt-in for WhatsApp (updated June 2026) says opt-in can be general rather than WhatsApp-specific, as long as you comply with local law, and sets three requirements:
- Clearly state that the person is opting in to receive communication from the business.
- Clearly state the business's name.
- Comply with applicable law.
Supported methods include SMS, your website, a phone IVR flow, and in person or on paper. Meta recommends covering the categories of messages you'll send, or taking separate opt-in per category, and giving clear instructions to opt out of each. It also warns that businesses with low quality ratings for a sustained period get rate-limited. In Singapore, a general opt-in that doesn't separate marketing from service messages is risky under the DNC rules, so ask for marketing separately.
PDPA and DNC: what consent must look like
Service messages, such as order updates or appointment reminders the customer asked for, usually rest on the customer giving you their number for that purpose. Our guide to deemed consent under PDPA explains when that applies. Marketing is different.
PDPC's Advisory Guidelines on the Do Not Call Provisions (revised 1 February 2021) say that to send a marketing message to a Singapore number without checking the DNC Registry, you need clear and unambiguous consent that is evidenced in written or other form so it is accessible for later reference. PDPC's Key Concepts guidelines add that consent collected with a pre-ticked box is not clear and unambiguous consent under the DNC provisions.
Opt-in wording that works for both
Keep the wording short, specific and separate for marketing. Example for a website or QR form:
- Service (can be tied to the booking): "We'll send your booking confirmation and reminders to this WhatsApp number."
- Marketing (unticked box): "[ ] Yes, [Business name] may send me offers and news on WhatsApp. I can opt out any time by replying STOP."
- Link: to your privacy policy, which explains how you use and store the number.
Name the actual business the customer recognises, not a parent company or platform. If you plan calls as well as messages, Meta's policy suggests a separate opt-in to initiate a call. For full form templates, see our guide to PDPA consent form wording.
What to record for every opt-in
PDPC's DNC guidelines say that for consent collected electronically, you should keep documentation or system logs capturing the person's choice, the date and time, the web page, pop-up or form they were looking at, and the clauses they agreed to. For paper forms, keep the original.
| Field | Example | Why |
|---|---|---|
| WhatsApp number | +65 9xxx xxxx | The number the consent covers |
| Choice | Marketing: yes; Service: yes | Separate record per message category |
| Date and time | 2026-10-22 14:31 SGT | Proves consent existed before the first message |
| Source | Website booking form v3, outlet QR code, in-store paper form | Shows how it was collected |
| Exact wording shown | Copy or screenshot of the consent text, with version | Proves what the person agreed to |
| Collected by | Staff name or system name | Accountability for offline consent |
| Opt-out | Date, channel and scope of any opt-out | Shows you honoured withdrawals |
Store these in your CRM, booking system or WhatsApp provider's contact attributes, not only in a WhatsApp chat. Chats can be deleted and don't show the form wording. Keep versions of your consent text, so a record that says form v3 can be matched to what v3 said.
Handling opt-outs and keeping records
Opt-outs are where consent records most often fail: the customer replies STOP, and the next campaign goes to them anyway.
Give a clear opt-out in marketing messages
For example, reply STOP to unsubscribe. On the WhatsApp Business Platform, users can also stop marketing messages from a business through WhatsApp's own controls.
Capture every opt-out, whatever the channel
Meta's policy says to respect requests on or off WhatsApp, so a phone call or email asking to stop counts too.
Act quickly, within 21 days at most
The DNC guidelines set 21 days as the prescribed period to give effect to withdrawal of marketing consent. Automate it so it happens straight away.
Respect the scope
If someone opts out of WhatsApp marketing, PDPC says a general withdrawal via one channel applies to marketing on that channel. Don't move them to SMS without checking their consent there.
Keep the records while you rely on them
PDPC says keep evidence of consent for as long as you rely on it, then follow the PDPA's retention limitation obligation and delete what you no longer need.
Do it yourself or get help?
If you use a booking system or store that already logs consent, the job is mostly wording and making sure opt-in choices flow into your WhatsApp tool. The risk is when opt-in is collected one way (paper, QR, staff phones) and messages are sent from another, with no record linking them.
Our WhatsApp Notifications (S$590) sets up a WhatsApp Business API number through an official provider, up to 3 message templates for approval, triggers from your store, form or booking system, opt-in handling for PDPA and a delivery report. For privacy policy and consent notices, the PDPA Compliance Pack is S$690. IT Sorted is a Singapore-based team of developers with over 10 years of experience; you pay upfront and brief us in writing. This guide is general information, not legal advice.
Frequently asked questions
Yes. Meta's WhatsApp Business Messaging Policy says you may only contact people who gave you their number and opted in to receive messages from you. Meta's developer guidance says opt-in must clearly state that the person is opting in to messages from your business, name the business, and comply with local law. The method is up to you.
PDPC's Do Not Call guidelines say to keep documentation or system logs showing the person's choice, the date and time, the web page or form they saw, and the clauses they agreed to. For paper forms, keep the original. Add the WhatsApp number, the source and version of the form, and any later opt-out with its date.
No. PDPC's Key Concepts guidelines say it does not consider a pre-ticked box appropriate for consent to marketing messages, and consent obtained that way is not clear and unambiguous consent under the Do Not Call provisions. Use an unticked box or another clear action, such as replying YES, and keep a record of it.
PDPC's guidelines say that a later registration with the DNC Registry does not withdraw clear and unambiguous consent the person gave you. You can still rely on that consent, but only if you can prove it with records. If the person tells you to stop, the withdrawal must take effect within 21 days.
Under the DNC rules, a withdrawal of consent to marketing messages must take effect within 21 days. Meta's policy also requires you to respect opt-out requests made on or off WhatsApp. In practice, set your system to stop marketing to that number immediately, and record the date and channel of the opt-out.