Two requirements come from the policy itself: the opt-in must clearly state that the person is agreeing to receive communication from the business, and it must clearly state the name of that business. Since the November 2024 policy update, the permission can be general and does not have to name WhatsApp specifically, as long as the business complies with local law (in Europe, the GDPR and ePrivacy rules).
The method is up to the business. Meta lists SMS, a website, a phone call with an interactive voice response flow, and in person or on paper as examples; a checkbox at checkout or a sign-up form on the store are the usual choices in e-commerce. Meta also recommends an opt-in that says which kinds of messages will follow (order updates, offers, product recommendations), or a separate opt-in per category.
A valid opt-in protects deliverability. People who receive messages they did not expect block or report the sender, which lowers its quality rating, and Meta rate-limits businesses whose quality stays low for a sustained period.
Kanal, a WhatsApp marketing and sales app for Shopify stores, collects opt-ins at checkout and on the store: see WhatsApp for Shopify. The WhatsApp opt-in and GDPR guide covers the legal side.
