Skip to content

Playbook · 5 steps

Double Opt-in

Also called: Double opt in · DOI · Confirmed opt-in · Two-step opt-in

5steps

Level
Practitioner
Reading time
About 5 min

Reviewed

Definition
A two-step consent flow in which a sign-up is confirmed by a second explicit action, such as replying to a WhatsApp message, before marketing starts.

01 · How it works, in 5 steps

How does double opt-in work?

  1. 1

    Capture step one with a notice

    On the form or QR landing page, say what the person will receive on WhatsApp, from which business, how often and how to stop. Leave any marketing box unticked.

  2. 2

    Send the confirmation request

    If the person messaged you first (from a QR code or click-to-chat link), reply inside the open window with reply buttons. If they only filled in a form, send a short, non-promotional confirmation template.

  3. 3

    Wait for an explicit yes

    Only a tap on 'Yes, send offers' or a matching reply counts. Silence, a read receipt or a reply about something else is not confirmation.

  4. 4

    Record both steps

    Store the sign-up and the confirmation with timestamps, the wording shown, the source, the purpose and the confirming message's wamid in one consent record.

  5. 5

    Welcome, then market

    Send a welcome that repeats what they signed up for and how to opt out, then start campaigns. Unconfirmed sign-ups get no marketing; expire them after a few days.

02Try it

Hands-on: use the controls to work through it yourself.

Where does a double opt-in flow lose people?

6 / 6

  2. 11.9% drop-off · 500 people lost(biggest leak)

  3. 0.54% drop-off · 20 people lost

  4. 7.1% drop-off · 260 people lost

  5. 10.8% drop-off · 370 people lost

  6. 5.2% drop-off · 160 people lost

Stage 6 of 6

Still subscribed at 90 days

2,890 people

94.8% of the previous stage made it here (5.2% drop-off, 160 people lost). That is 68.8% of the top.

Few people opt out later when the list is confirmed.

Top to bottom
68.8%
Biggest leak
Scanned the QR code → Sent the join message (11.9%)
An illustrative month of QR-code sign-ups for a retail shop. Watch each step narrow the list and find the biggest drop: between asking and confirming.

Stage 6 of 6: Still subscribed at 90 days, 2,890 people. 94.8% of the previous stage made it here (5.2% drop-off, 160 people lost). That is 68.8% of the top. Few people opt out later when the list is confirmed.

03What is double opt-in?

Double opt-in (DOI), also called confirmed opt-in, is a consent flow with two steps. The person first signs up (ticks a box on a website form, scans a QR code, or gives their number at a store counter) and then confirms with a second, explicit action that only the owner of that number can take, typically tapping a 'Yes' button or replying to a WhatsApp confirmation message. Marketing starts only after the second step.

On WhatsApp the second step does two jobs. It shows the person really wants the messages, and it shows the number is theirs, because the confirmation can only come from the WhatsApp account on that number. A number typed into a form can be mistyped or belong to someone else; a tap on a button sent to that number cannot. That is why double opt-in produces stronger evidence than a single Opt-in, where the first action alone is treated as permission.

Meta's WhatsApp Business Messaging Policy requires opt-in before a business messages people, and the DPDP Act requires consent that is free, specific, informed and given by a clear affirmative action, but neither prescribes a second step. Double opt-in is a design choice: it trades some drop-off at the confirmation step for a smaller, cleaner list, lower block and report rates, and a consent record that shows exactly what the person agreed to and when.

Key takeaways

  • Double opt-in confirms a sign-up with a second explicit action, such as tapping 'Yes, send offers' on WhatsApp, before any marketing.
  • Neither Meta nor the DPDP Act requires it, but it gives the strongest proof that the person, and the owner of the number, agreed.
  • It loses some sign-ups at the confirmation step and usually buys a cleaner list with fewer blocks and reports.
  • Record both steps: the sign-up and the confirmation, with timestamps, the wording shown and the confirming message's ID.

04 · In code

Double opt-in in code

# Sent as a reply inside the open service window (the customer messaged first).
curl -X POST "https://graph.facebook.com/v26.0/{PHONE_NUMBER_ID}/messages" \
  -H "Authorization: Bearer {ACCESS_TOKEN}" \
  -H "Content-Type: application/json" \
  -d '{
    "messaging_product": "whatsapp",
    "recipient_type": "individual",
    "to": "919812345678",
    "type": "interactive",
    "interactive": {
      "type": "button",
      "body": {
        "text": "Confirm you would like festive offers from us on WhatsApp, about twice a month. Reply STOP any time to end them."
      },
      "action": {
        "buttons": [
          { "type": "reply", "reply": { "id": "doi_confirm", "title": "Yes, send offers" } },
          { "type": "reply", "reply": { "id": "doi_decline", "title": "No thanks" } }
        ]
      }
    }
  }'

Reply-button messages allow up to 3 buttons with titles of up to 20 characters.

05Example: A Jaipur jeweller's festive list

A Jaipur jewellery shop prints a QR code on its counter cards: scanning opens WhatsApp with 'Join festive offers' already typed. When the customer sends it, the shop replies with two buttons, 'Yes, send offers' and 'No thanks', and a line saying it messages about twice a month and that STOP ends it. Of 4,200 scans in October, 3,700 sent the message and 3,050 tapped Yes. Its Dhanteras broadcast to those 3,050 drew far fewer blocks than its old imported list, and each contact carries a timestamped record of the tap.

06 · Why it matters

Why does double opt-in matter?

A WhatsApp list built on unconfirmed numbers is a fast route to a falling quality rating: mistyped digits reach strangers, impulse sign-ups block the first broadcast, and every block counts against the number. Confirming each sign-up costs a fraction of the list but removes most of those failures before they reach a campaign, and it gives marketing and compliance one clean piece of evidence per contact when a complaint or an audit arrives.

07 · Key facts

Double opt-in: key facts and limits

Steps
Sign-up, then an explicit confirmation from that number
Required by Meta?
No: opt-in is required, the second step is optional
Required by the DPDP Act?
No: it requires free, specific, informed consent
Reply buttons per message
Up to 3, titles up to 20 characters
In-window confirmation (India)
₹0.145 per message since 1 October 2026
Proof to store
Both timestamps, wording, source, purpose, wamid

08 · Mistakes to avoid

Common mistakes with double opt-in

  • Putting an offer in the confirmation

    A confirmation that sells is marketing sent before consent, and Meta categorises promotional content as marketing. Keep it to what they will receive, how often, how to stop and a yes/no choice.

  • Counting silence as consent

    Only an explicit action counts. Expire unconfirmed sign-ups after a few days instead of messaging them anyway.

  • Recording only the second step

    The confirmation proves the number; the sign-up proves the notice and the purpose. Keep both, linked, in the consent record.

  • Re-asking people who already confirmed

    Repeated confirmation requests annoy subscribers and raise blocks. Confirm once per purpose and rely on the stored record afterwards.

09 · Pro tips

Best practices for double opt-in

  • Let customers start the chat from a QR code or click-to-chat link, so the confirmation can be an in-window reply rather than a template.
  • Put the frequency in the confirmation ('about twice a month'): it sets expectations and reduces blocks later.
  • Track the confirmation rate per source; a low rate flags a misleading form or a poor lead source.
  • Answer 'No thanks' with a short acknowledgement only, and add the number to your marketing suppression list.

10Double Opt-in FAQs

Is double opt-in mandatory for WhatsApp marketing?+
No. Meta requires opt-in before you message people and the DPDP Act requires valid consent, but neither demands a second confirmation step. Double opt-in is a best practice for stronger proof and a cleaner list.
What is the difference between single and double opt-in?+
Single opt-in treats the first sign-up as permission; double opt-in waits for a second, explicit confirmation from the number itself. Double opt-in loses some sign-ups but removes mistyped and half-hearted ones.
How much drop-off does double opt-in cause?+
It varies by source and wording, so measure it. Flows the customer starts from a QR code or link usually confirm well, while cold web-form sign-ups lose more people at the confirmation step.
Can the confirmation message be a template?+
Yes, when the person has not messaged you first. Keep it non-promotional (what they will get, how often, how to stop, and a yes/no button), because promotional content is categorised as marketing.

See InfiQ pricing

* Per-message rates for India, ex-GST: marketing, utility and authentication effective 1 July 2026; service messages ₹0.145 since 1 October 2026 (they were ₹0 until 30 September 2026). Volume commitments earn discounts — final rate is confirmed on your account; applicable GST extra. Rates for other countries differ (see the international rate table on /pricing).

From definition to your first message

InfiQ is an official Meta Business Partner. Start a 7-day free trial — no card needed — and see this running on your own number.

Start free trialBrowse all 550 terms