Consent Record

Why it matters on the WhatsApp Business API

Meta's Business Messaging Policy makes opt-in a hard requirement: you may only message people who have agreed to hear from you, through any channel, in a way that clearly names your business. Consent records are how you back that up. When customers block you or tap 'report', WhatsApp weighs those signals into your quality rating and messaging limits — and a solid consent trail is your defence that those recipients genuinely opted in. Without records, a spike in blocks can quietly throttle your number or, in serious cases, get it flagged. Consent is not the same as billing: since 1 July 2025, WhatsApp bills per delivered message by category (marketing, utility, authentication), and InfiQ applies transparent ₹ pricing. But no amount of correct billing setup protects a number that is messaging people who never agreed — consent is the layer that keeps your account healthy enough to keep sending.

How consent maps to message categories

Not all opt-in is equal, and the scope you record should match the kind of messages you intend to send. Utility messages (order confirmations, shipping updates, appointment reminders) are tied to a transaction the customer initiated, so consent is usually implicit in the purchase — but you should still record it. Marketing messages (offers, launches, re-engagement) require clearer, more explicit opt-in because they are promotional, and customers who did not expect them are far more likely to block or report. Recording scope granularly lets you honour a customer who wants delivery alerts but not promotions, which both keeps you compliant and protects your quality rating from unwanted marketing sends.

• Utility / transactional: consent often implicit in the order, but log it anyway
• Authentication: opt-in tied to the account the OTP secures
• Marketing: needs explicit, unambiguous opt-in — the highest-risk category for blocks
• Granular scope lets you respect partial consent (updates yes, offers no)

Consent records and India's DPDP Act

For Indian businesses, consent records are not only a Meta requirement — they are increasingly a legal one. India's Digital Personal Data Protection Act frames consent as something that must be free, specific, informed, unambiguous, and given by a clear affirmative action, with the business (the Data Fiduciary) able to demonstrate that valid consent was obtained. A timestamped consent record with a stored copy of the notice the customer saw is exactly the kind of evidence that demonstrates compliance. The DPDP framework also gives individuals the right to withdraw consent as easily as they gave it, which means your record-keeping must capture opt-outs too — a consent record that never updates when someone leaves is a liability, not an asset.

Common mistakes to avoid

Most consent problems are not malicious — they come from shortcuts that seem harmless until a review or a complaint exposes them. The classic error is uploading a bought or scraped contact list and treating a business relationship as consent; it is not, and it is the fastest route to blocks and a damaged number. Another is capturing a single blanket opt-in and then messaging across every category, which frustrates customers who only wanted transactional updates. Teams also frequently forget to log opt-outs, so a customer who unsubscribed keeps receiving messages — a direct policy and DPDP violation. Finally, storing consent only in a spreadsheet a staff member edits by hand undermines the whole point: if the timestamp can be changed after the fact, it is no longer trustworthy evidence.

• Treating purchased or scraped lists as consent — never valid
• Using one broad opt-in to justify marketing the customer never expected
• Failing to record and honour opt-outs and withdrawal requests
• Keeping editable, un-timestamped records that cannot survive scrutiny
• Re-messaging a number after a long silence without re-confirming interest