WhatsApp's policy requires businesses to collect a clear opt-in before messaging anyone. The customer must understand they are agreeing to receive messages from that specific business on WhatsApp.
Opt-ins can be collected almost anywhere: a checkbox at checkout, a website widget, a form, a QR code, or a reply to an initial message. The opt-in should name WhatsApp and the business explicitly.
A valid opt-in protects deliverability. Messaging people who never agreed leads to blocks and reports, which lowers the phone number quality rating and can reduce messaging limits.