SMS and WhatsApp Opt-in Consent Generator

What SMS opt-in language must include

Regulators, mobile operators and Meta all look for the same core: the person knows who will message them, on which channel, about what, roughly how often, and how to stop. The consent has to be a clear action by the person, such as ticking an empty box or replying YES. A pre-ticked box, a line hidden in your terms or silence does not count.

The generator writes each piece separately, because each sits in a different place: the checkbox label next to the phone field, the small-print disclosure under it, the double opt-in message, the welcome message and the replies to HELP and STOP.

• Brand name and channel: "from Acme by SMS and WhatsApp".
• Type of messages: offers and news, order updates or verification codes.
• Frequency: "Up to 4 msgs/month" or "Msg frequency varies".
• How to stop: "Reply STOP to opt out", plus HELP for help.
• Links to your privacy policy and messaging terms.
• For the US: "Msg & data rates may apply" and "Consent is not a condition of purchase".

Why marketing needs its own consent

Most laws treat marketing differently from service messages. Saudi Arabia's PDPL requires prior consent before advertising is sent to personal contact details. The EU ePrivacy rules require prior consent for marketing by SMS and other electronic messages, with a narrow exception for existing customers. Oman's law asks for written consent before marketing material is sent. US rules require prior express written consent for automated marketing texts.

A single bundled box ("I accept the terms and want to receive messages") is the most common reason consent fails an audit. Ask for marketing separately, per channel where needed, and keep service messages such as order updates and OTPs free of promotions so they stay transactional.

WhatsApp opt-in: what Meta asks for

WhatsApp's Business Messaging Policy lets a business message people only if they gave it their number and opted in to receive messages from it, and it must respect every request to stop, on or off WhatsApp. Meta's opt-in guidance asks businesses to state clearly that the person is opting in to receive messages from the business, to name the business, and to follow applicable law.

Meta no longer requires the opt-in to mention WhatsApp by name, but naming it is still best practice, and some local laws expect consent per channel. Outside the 24-hour customer service window, the double opt-in message must be an approved template; the generator writes a draft with Yes and No buttons that you can check in our WhatsApp template preview tool.

Opt-out keywords in Arabic and other languages

People reply in their own language. In the Gulf, customers send ايقاف, إلغاء or توقف as often as STOP, and in Spain BAJA, in Brazil SAIR. Your system should treat all of them as an opt-out on every number that receives replies, ignoring case, accents, punctuation and the different ways of writing hamza. US rules list STOP, QUIT, END, REVOKE, OPT OUT, CANCEL and UNSUBSCRIBE as valid ways to revoke consent, and other clear requests count too.

After an opt-out, send one short confirmation and nothing else, then add the number to a single suppression list used by every campaign, sender ID and tool.

Consent records that stand up to an audit

Several laws put the burden of proof on the business. The GDPR and Brazil's LGPD say the controller must be able to show that consent was given, Egypt's law requires electronic proof of consent to be kept for three years from the last message, and CTIA recommends recording the time, the wording shown, the campaign and the IP address. The record tab lists the fields to store for your collection point, with a CSV header you can paste into your CRM.

This tool summarises public rules we reviewed on the date shown in the kit. It is not legal advice: laws and operator policies change, so have your counsel review the final wording for each market.