WhatsApp Marketing Consent Rules for Stores: Opt-In and Frequency

WhatsApp marketing consent rules come down to one principle: no promotional message reaches a customer who did not explicitly agree to receive it, and the customer can stop it at any time. Everything else is implementation: where you collect consent, how often you send, and which connection method you use. This article explains what WhatsApp’s business policy requires, how to apply it in a Shopify store, what the blocking risks are, and gives an overview of data protection laws in the region. It is written for awareness, not as legal advice; consult a professional in your country before building a large marketing database.

Transactional messages versus marketing messages

The first distinction to make:

Type	Examples	Marketing consent needed?
Transactional	Order confirmation, tracking link, delivery notice, replies to a customer’s enquiry	Tied to an order or a contact the customer initiated; mention them in your privacy policy
Marketing	Cart recovery, offers, back-in-stock alerts, repeat-purchase offers, seasonal greetings with a link	Yes, explicit and recorded

The common mistake is assuming that one purchase means consent to everything. A purchase justifies messages about that order only. Cart recovery and offers need separate consent, and that is how WhatsApp Pilot already behaves: recovery and offer messages go only to customers who agreed to WhatsApp marketing in the store, while order confirmations and tracking links are sent as transactional messages.

What WhatsApp’s business policy requires

According to Meta’s published policies, businesses must obtain opt-in before sending business-initiated messages on WhatsApp, and the opt-in must be clear enough that the user knows they will receive messages from that business name on WhatsApp specifically. The policy also prohibits unwanted messages and misleading content, and gives users the ability to block and report a number, which directly affects the number’s quality rating and survival.

Complying in practice means:

• Consent wording that names WhatsApp explicitly, not a generic “I agree to receive marketing”.
• An unticked checkbox, so the customer actively chooses.
• A clear way to stop in every message.
• No purchased lists and no messaging of numbers collected for another purpose.

Where to collect consent in a Shopify store

Three placements work well and can be combined:

1. Checkout. A checkbox next to the phone field with wording such as “I would like to receive order updates and store offers on WhatsApp”. This is the richest source of consent because the customer is at peak interest.
2. A sign-up pop-up on the store. In exchange for a first-order discount or free shipping, naming WhatsApp explicitly.
3. The conversation itself. When a customer messages you through the WhatsApp button, you can ask whether they want to receive offers and record the answer on their profile.

In every case, save the consent on the customer record inside Shopify with its date and source, so the app checks it before each send and you can prove it when needed. Connecting the app to the store is covered in our guide to connecting WhatsApp to a Shopify store.

How many messages, and when?

The policy sets no number, but customers set one with their behaviour. The principles we work by:

• Transactional messages: as needed; they are always welcome.
• Cart recovery: a short sequence of three messages over two to three days that stops as soon as the purchase completes. Details in WhatsApp abandoned cart recovery for Shopify.
• Offers: one or two messages a month is enough for most stores, rising slightly in seasons such as Ramadan and White Friday with advance notice to customers.
• Timing: daytime in the customer’s time zone, avoiding prayer times and suhoor, and sending after iftar during Ramadan.

After every campaign watch three indicators: negative replies or stop requests, block rate, and sales tied to the message. If blocks rise with a campaign, the problem is the content or frequency, not the channel.

Blocking risks: how to protect your number

Bans come from two sources: customers who block and report your number, then the platform detecting a sending pattern that resembles spam. Practices that reduce the risk:

• Consent first; it is the root cause of most complaints.
• Spread bulk sends over time instead of pushing thousands of identical messages in minutes.
• Personalise with name and product; identical messages are reported more often.
• Reply to customer replies; a number that receives and handles responses looks like a normal conversation.
• Use a dedicated store number with the WhatsApp Business app and a complete profile with store name and location.
• Avoid anonymous shortened links; use your store’s clear URLs.

If you lose the number, you lose the chat history and the trust of customers who saved it. Treat the number as a store asset.

Linked device or WhatsApp Business API?

This question comes up constantly, and the answer depends on volume:

Criterion	Linked device (QR)	WhatsApp Business API
Connection	Scan a QR code from WhatsApp on your phone	An account through an approved provider and business verification
Business-initiated messages	From your ordinary number	Require templates pre-approved by Meta
Cost	The app subscription only	A per-conversation cost plus the provider
Best for	Small and mid-size stores wanting fast automation	Very high volumes and multiple service teams
Phone dependency	The phone needs periodic internet connectivity	Independent of the phone

Apps such as WhatsApp Pilot work the first way, with automation starting minutes after scanning the code; details at whatsapppilot.esafqa.com. The same consent rules apply to both methods; the difference is technical and operational, not legal.

A regional overview of the law

In recent years most countries in the region have enacted personal data protection laws: Saudi Arabia, the UAE, Qatar, Bahrain, Oman, Jordan and Egypt have legislation governing the collection of personal data and its use for marketing, differing in the details of consent, penalties and the supervising authority. What they share is that a phone number is personal data, that using it for marketing needs a legal basis of which consent is the clearest, and that the customer has the right to object and stop. If you sell to more than one country, apply the highest standard to everyone rather than differentiating by market. Because details change, consult a legal professional in each of your main markets.

From our experience

In the stores we build and manage, we place WhatsApp and email consent checkboxes at checkout from day one, because adding them later means thousands of early customers never enter the marketing base. Toolmart in Iraq, with more than 35,000 products and a customer base of businesses and individuals, is an example of a store where the contact base accumulates over years and cannot be rebuilt if it was collected the wrong way. Read the Toolmart case study, and see how checkout and tracking are set up within our Shopify store development service.

Conclusion

WhatsApp marketing consent rules are not an obstacle but the guarantee that the channel keeps working: explicit consent at checkout, a clear separation between transactional and marketing messages, reasonable frequency, and an easy stop. With these rules your number stays healthy and your messages stay welcome. If you are comparing channels, read email marketing for Shopify stores in the Gulf and WhatsApp commerce in the Gulf as well. Message us on WhatsApp for a free audit of the consent and automation settings in your store.