What is a suppression list?
A suppression list is a business's register of phone numbers (or business-scoped user IDs) that must not receive some or all of its WhatsApp messages. Before any outbound send — a Broadcast, a journey step, a CRM-triggered template — the recipient is checked against the list, and a match stops the message. It is the enforcement half of consent: an Opt-out is what the customer does, and the suppression list is how every system you run remembers it.
Entries come from several sources: STOP replies and opt-out buttons; the User Preferences Webhook, which reports people who stopped your marketing inside WhatsApp (marketing to them then fails with error 131050); numbers that keep failing as undeliverable; people who exercised the Right to Erasure; and legal or policy restrictions, such as children without verified parental consent or +1 US numbers, to which WhatsApp does not deliver marketing.
A good suppression list is scoped and reasoned. Each entry records the number in E.164 form, the scope (all messages, marketing only, one brand or product line), the reason, the source and the time, so a customer who declines promotions still receives the OTP and delivery update they asked for. It differs from the Block Users API, which blocks an abusive user on WhatsApp itself, and from Frequency Capping, which limits how often people who have consented hear from you.
Key takeaways
- A suppression list is the do-not-message register every outbound send is checked against, whichever tool sends it.
- It holds opt-outs, users who stopped your marketing inside WhatsApp (error 131050), invalid numbers, erased contacts and legal restrictions.
- An opt-out is the customer's action; the suppression list is the system that makes every sending tool honour it.
- Scope each entry: a marketing stop blocks campaigns, not the OTPs and order updates the customer still needs.
- Check at send time as well as when the audience is built, so an opt-out received an hour ago still wins.
Why the difference matters
Why does a suppression list matter?
Most opt-out failures are not bad intent but plumbing: the STOP landed in the helpdesk while the campaign tool used last month's CSV. Each message to someone who said stop invites a block or a report, which pushes up your Block Rate and drags down quality, and it breaks Meta's rule to respect every opt-out request, on or off WhatsApp. One suppression service that every sender must call turns consent from a per-tool setting into a single source of truth — and it saves money, because messages to numbers that will never deliver or never convert are pure cost.
How does a suppression list work?
- Step 1
Collect every source
Feed the list from STOP keywords, opt-out buttons,
user_preferencesstop events, agent notes, email and web unsubscribes, erasure requests and legal holds. Normalise every number to E.164 before storing it. - Step 2
Store scope and reason
Record a scope (
all,marketing, a brand), the reason, the source and a timestamp. A marketing stop must not silence order updates; an erasure or legal hold silences everything. - Step 3
Check at send time
Filter the audience when a campaign is built and again in the sending worker just before each API call, so opt-outs that arrive between scheduling and sending still win.
- Step 4
Learn from failures
Add numbers that fail with 131050 at once. Count 131026 (message undeliverable) failures and suppress after a few, with an expiry so the number is rechecked later. Never suppress on 131049.
- Step 5
Lift entries only on fresh consent
Remove a marketing entry only on a new, recorded opt-in or a
user_preferencesresume event, and keep the full history in the Consent Record.
A suppression list in code
// Every sender calls this: broadcasts, journeys, CRM triggers, agentsexport async function canSend(waId, category) {const { rows } = await db.query(`SELECT scope FROM suppressionWHERE wa_id = $1 AND (expires_at IS NULL OR expires_at > now())`,[waId],);// 'all' blocks everything; 'marketing' blocks marketing templates onlyreturn !rows.some((r) => r.scope === "all" || r.scope === category);}export async function sendTemplate(waId, template) {if (!(await canSend(waId, template.category))) {await log.skip(waId, template.name, "suppressed");return { skipped: true };}const res = await fetch(`https://graph.facebook.com/v26.0/${process.env.PHONE_NUMBER_ID}/messages`,{method: "POST",headers: {Authorization: `Bearer ${process.env.ACCESS_TOKEN}`,"Content-Type": "application/json",},body: JSON.stringify({messaging_product: "whatsapp",to: waId,type: "template",template: { name: template.name, language: { code: template.lang } },}),},);return res.json();}
Check in the worker that makes the API call, not only when the audience is built.
Common mix-ups
Common mistakes with a suppression list
One list per tool
If the broadcast tool, the CRM and the helpdesk each keep their own list, an opt-out reaches one of them. Run one suppression service that every sender must call.
Suppressing everything for a marketing stop
Blocking OTPs and order updates for a customer who only declined promotions hurts them and your support team. Scope entries by message category.
Suppressing on 131049
The per-user marketing limit is temporary and set by Meta across all businesses. Retry after at least 24 hours instead of treating the person as opted out.
Checking only when the list is built
A campaign built at 9 and sent at 11 misses the opt-outs from the two hours in between. Check again in the sending worker.
Mismatched number formats
09812345678,+91 98123 45678and919812345678are one person. Normalise to E.164 on the way in, or lookups will miss.
Example: A Jaipur spice brand's festive send
A Jaipur spice brand sends WhatsApp messages from three tools: a broadcast tool, a cart-recovery app and a helpdesk. Before Diwali, its 42,000-contact audience is filtered through one suppression service: 1,180 marketing opt-outs from STOP replies and the opt-out button, 310 people who stopped its marketing inside WhatsApp, 95 numbers that failed as undeliverable three times, and 12 erased contacts held only as keyed hashes. On send day a customer replies STOP to an order update at 10:02; the 10:30 campaign worker checks the list again and skips her. Her delivery updates, sent as utility templates, keep arriving, because her entry is scoped to marketing only.
A suppression list: key facts and limits
- Typical scopes
- All messages · marketing only · one brand or product line
- Stopped marketing in WhatsApp
- Error 131050 — suppress, never retry
- Per-user marketing limit
- Error 131049 — retry after 24 hours, do not suppress
- Undeliverable
- Error 131026 — suppress after repeated failures, with an expiry
- Key format
- E.164 digits (wa_id); keyed hash for erased contacts
- When to check
- At audience build and again just before each API call
Suppression List FAQs
What is the difference between an opt-out and a suppression list?+
Should I remove someone from my suppression list if they message me again?+
Does WhatsApp keep its own suppression list for my business?+
How long should numbers stay on a suppression list?+
Rules of thumb
Best practices for a suppression list
- Make suppression a service with one API, not a spreadsheet exported weekly.
- Log every skipped send with its reason, so an audit can show the list working.
- Recheck expiring undeliverable entries instead of keeping them forever.
- Show agents a contact's suppression scope in the inbox before they send a template.