WhatsApp opt-in rules for UAE businesses

Valid WhatsApp opt-in means the person actively consented to receive messages from your business on WhatsApp. A checked web-form box that says so, a click-to-chat entry point, a scanned QR code, and an inbound first message all qualify. A number collected for a contract or a scraped list does not, and marketing it is the fastest route to a ban

What counts as valid WhatsApp opt-in?

Meta's opt-in guidance is specific: the person must have actively agreed to receive messages from your business on WhatsApp. The agreement is not implied by them giving you a phone number for another purpose. Four paths satisfy Meta:

1. A web-form checkbox where the text names WhatsApp and asks for contact on it
2. A click-to-chat button or ad that takes the person into a WhatsApp conversation with you
3. A QR code shown on a counter, listing, or flyer that the person scans to start a chat
4. An inbound first message: the customer writes to you, which is consent to reply within the customer service window

Each path also records evidence automatically. A checkbox leaves a timestamp and the form's consent text. A click-to-chat leaves the entry-point source. An inbound message is visible in the thread itself. That provenance is what you show if a rating drops or Meta asks where a segment came from

The same guidance draws the line directly: buying lists, scraper datasets, and harvested contact lists violate policy and are not a basis to message anyone (Meta: getting opt-in). We treat any list whose source we cannot name on the spot as unmessagable.

Does a checkbox or a QR code on its own prove opt-in?

It proves opt-in only if the wording connects the contact to WhatsApp. A form that collects an email and a phone number for "news and offers" but never mentions WhatsApp does not consent the person to WhatsApp marketing. The record has to show two things: the person agreed, and the agreement named WhatsApp

We write the consent line explicitly and date-stamped: "By submitting, you agree to receive WhatsApp messages from [business] about your enquiry." A plain "submit" button next to a phone field is a complaint waiting to happen, because the recipient never agreed to be messaged on the channel that generates the least tolerance for spam

QR codes are the same test. A code on a property listing that opens a chat and immediately sends a brochure is fine: the scan is the choice. A counter QR that silently subscribes the scanner to a monthly broadcast without saying so is not. The scan is evidence either way, but the expectation the scan set decides whether the broadcast is welcome

Can I message customers who gave me their number for another reason?

Only if the consent covered WhatsApp messaging. A phone number captured for a contract, an Ejari registration, a service callout, or an invoice is not marketing consent. Message that segment about a new launch and you are messaging outside the consent you actually hold

This is the split that trips real UAE teams. A broker captures a landlord's number to chase a signed SPA, then uses the same list for an off-plan VIP launch. The first use is legitimate; the second reuses consent that never existed. The fix is to ask for messaging consent separately at intake, with its own checkbox and its own record, so the transactional purpose and the marketing purpose never share one capture event. In a property-management platform, the property management app we built, every tenant conversation starts from a tenant-initiated chat, and the AI handles around 60% of those chats without a person stepping in; the consent is inherent in who opened the thread and what the thread says (a property-management platform case)

The UAE Personal Data Protection Law adds a separate layer here. Chat logs tying a name and phone number to a conversation are personal data under Federal Decree-Law No. 45 of 2021, and consent is one lawful basis for processing it. Keeping the consent record is not only a Meta requirement; it is the PDPL record of why you hold the contact at all. We cover the data-flow side in PDPL-compliant AI CRM in the UAE.

What happens if I message people without opt-in?

Non-consensual messaging feeds the enforcement ladder, and the steps escalate. The first visible signal is the quality rating: a live score per phone number computed from how many recipients block or report you. High complaint volume drops it to "low", which first restricts your messaging tier and template approvals, then risks suspension (WhatsApp Business Messaging Policy).

The ladder after the rating sits across layers. Blocks and reports pull the rating down. A low rating throttles how many people you can reach outside the service window and slows template approvals. Systematic non-consensual outreach, bought lists, and unofficial tooling skip the ladder and go straight to a banned number, with an appeal that only succeeds on a false positive. The worst position for a Dubai business is a number that dies with no appeal path and no named opt-in source, because the replacement starts again at the 250-recipient tier with a cold reputation

The full enforcement mechanics, including the 250-recipient starting tier, live in will WhatsApp automation ban my number. The short version for this article: enforcement escalates from rating drop to tier throttle to template restriction to ban, and provable opt-in is what keeps you on the early side of that curve

The opt-in evidence checklist

This is the record we keep for every audience segment before it receives a single business-initiated message. Every field exists because a missing one turned a recoverable review into a scrolling appeal later

Record	What it must contain	Why it matters
Consent timestamp	Date and time the person agreed, to the minute	Proves the agreement predates the message
Consent source	The exact page, QR, ad, or in-chat point where they agreed	Names where the contact came from
Consent text	The words shown when they agreed, stored verbatim	Proves the wording named WhatsApp
Purpose scope	What the consent covered: enquiries, broadcasts, or both	Stops transactional and marketing consent being merged
Opt-out path	A working "reply STOP" or an equivalent stop mechanism	Unanswered complaints turn into reports
Opt-out log	When and from which list each recipient opted out	Blocks re-messaging an opted-out contact

Two records do the most work. The consent text stored verbatim is your defense in a review: you can show the exact sentence the person read. The opt-out log is the quieter one, because re-messaging someone who already said stop is the fastest way to teach a recipient to hit report

What does a compliant consent flow look like?

The cleanest flow makes the customer initiate contact, which sidesteps the consent question entirely and costs no tier quota. This is the intake pattern we build for portal leads in WhatsApp bots for Property Finder and Bayut leads

1. A Property Finder, Bayut, or Dubizzle enquiry, a click-to-chat ad, or a listing QR opens a WhatsApp thread that the customer started
2. The bot greets them and confirms the purpose: "You asked about the Marina one-bedroom. This thread is for that enquiry"
3. The bot qualifies budget, area, and timeline, which is the person actively participating, recorded in the thread
4. The bot writes the conversation to the CRM with the source attached, then hands off to an agent on any high-value or low-confidence case (human handoff)
5. Only for broadcast segments, the flow requires an explicit checkbox at subscription time that names WhatsApp, plus a visible opt-out in every broadcast

For business-initiated outbound, the flow is narrow by design: an explicit opt-in record for each recipient, a utility or authentication template for the transaction, and a separate marketing opt-in before any broadcast. The per-message pricing differences between those categories are worth knowing before you plan the outbound side (WhatsApp Business API costs)

In our a property-management platform build, about 60% of tenant chats are handled by the AI without a person stepping in, and every one of those conversations began with the tenant messaging us first, which is the cleanest opt-in you can record because the thread itself is the evidence

Why do bought lists get numbers banned?

A bought list fails every check at once. It has no consent timestamp, no source you can name, and no consent text, because none ever existed. The recipients never agreed to hear from you, so the first broadcast produces blocks and reports, the quality rating drops, and the enforcement ladder does the rest. Meta's opt-in guidance states the rule plainly: buying lists is prohibited and is not a basis to message anyone

The economics still tempt businesses, because a list is cheap and a broadcast is one click. The cost appears later as the number itself: in Dubai the WhatsApp number often sits on business cards, portal listings, and a Google Business Profile for years. Losing it means losing the channel, not just the list. A scraped list might deliver a handful of replies on day one and a banned number by day thirty, and the replacement restarts at the 250-recipient tier with none of the history

For any agency, the BSP fee and the discipline of real opt-in are a few hundred to a couple of thousand AED a month. A banned number costs the entire channel and a cold restart. We priced that trade-off explicitly in the ban-rules article, and the compliance side always wins on expected cost

The takeaway

Opt-in is three records you can produce on demand: a timestamp, the source, and the consent text that named WhatsApp. Capture messaging consent separately from transactional contact, keep the opt-out path working, and let customers start conversations whenever the flow allows. Buying a list skips the records and spends the number instead. On the official platform, provable opt-in is what keeps a rating healthy and a number in service

Book the free audit and we will map your current WhatsApp lists against Meta's opt-in tests before you send another broadcast