Verifiable consent

Provable consent is the explicit permission that a person gives to a company to receive messages on WhatsApp, and which the company can demonstrate if Meta requests it. In the WhatsApp Business API ecosystem, it is not enough for someone to have given you their number: you need proof that that person accepted that you write to them. Meta can ask you for that evidence at any time, and if you do not have it, your number can be blocked or restricted.

Why it matters to an SME

If you use WhatsApp to sell or serve customers, provable consent is not a bureaucratic procedure: it is what protects you from having your account cut off. Meta is increasingly strict about spam and reports. If a customer reports you or Meta detects that you write without permission, your number can be in the spotlight. Having documented consent allows you to defend yourself and keep operating without scares.

Concrete example

Imagine you have a clothing store and someone writes to you on Instagram asking about a pair of jeans. You reply and at the end you say: 'Can I send you news and offers on WhatsApp?' If the person replies 'yes', that message is your consent. Save it (you can use the Wando inbox, which integrates Instagram and WhatsApp, or export the conversation). If Meta later asks you for proof, you show that 'yes' and that's it.

Common mistakes

• Assuming that having the number in your database is enough: it is not, you need the explicit OK.
• Not saving evidence: if the client gave consent over the phone or in person, write it down and record date and time.
• Using forms with pre-checked boxes: consent must be active, not something the user unchecks without reading.
• Not renewing consent: if a lot of time has passed, the ideal is to reconfirm that the person is still interested in receiving messages.

How it works in practice

In a real business, verifiable consent is managed day to day, not as a special procedure. Take the case of a beauty salon that serves customers via WhatsApp: when a customer writes first, there's already a conversation start, but that's not enough to send her promotions later. The salon sends her a specific message: 'Shall we send you appointment reminders and offers via WhatsApp?' and waits for an explicit 'yes'. That message stays in the Wando inbox, which integrates WhatsApp, Instagram, and Messenger, and can tag the customer as 'consent OK'.

Later, if Meta asks for proof, the salon exports the conversation or shows the tag with the date. It's that simple: consent becomes verifiable because it was recorded at the exact moment it was given, without relying on anyone's memory.

• Always ask on the channel where the person contacted you.
• Save the response as is, with date and time.
• Use tags to separate who gave OK and who didn't.

What it's confused with and how it differs

Verifiable consent is confused with two things: having the number in the database and email marketing opt-in. Having the number is not enough: the person may have left it in a form for a specific inquiry, not to receive offers from you. And email opt-in is not the same: WhatsApp rules are stricter than email rules, because WhatsApp is a more personal channel.

It's also confused with double opt-in in email, where the user confirms via a second message. In WhatsApp that's not necessary: a clear, voluntary 'yes' is enough. The key difference is that verifiable consent is specific to the channel and the purpose: if the person agreed to receive offers, you can't use that OK to send them surveys.

What happens if you ignore it

If you don't have verifiable consent, the most direct consequence is that Meta can restrict your number. That means your messages stop getting through, or the number gets blocked without prior notice. For an SMB that lives by serving customers on WhatsApp, it's like losing the company phone overnight.

Also, user reports pile up: if someone marks you as spam, your sender reputation drops and more and more messages land in the 'requests' folder or simply don't get delivered. Recovering a restricted number is slow and sometimes impossible. That's why consent isn't a legal detail: it's operational protection.

Relationship with Meta's official API

Meta's official WhatsApp API (WhatsApp Cloud API) requires you to have user opt-in before sending messages. It's not a recommendation: it's a condition of service. If you don't comply, Meta can limit your API usage or suspend access.

In practice, the API gives you tools to manage consent: you can use labels to mark who accepted, and you can configure templates (HSM) that are only sent to those who gave their OK. But the API doesn't do it for you: the responsibility to obtain and store the proof is yours. Wando, which uses the official API, makes management easier with its inbox and labels, but it doesn't replace the obligation to ask for permission.

When it does NOT apply or isn't advisable

Verifiable consent doesn't apply when the person writes to you first and the conversation is a direct response. In that case, initiating contact already implies permission to reply. But be careful: that permission doesn't extend to sending them campaigns later.

Nor is it advisable to ask for consent in every interaction: it would be annoying and drive customers away. The practical rule is to ask once, when it makes sense (at the end of a purchase or inquiry), and record it. If your business is high-volume and you can't manage manual registration, then it's worth using a tool like Wando that centralizes and labels. But if you handle few messages, you can do it with a simple spreadsheet.

Common mistakes of those who just understand it

The most common mistake is believing that a form with a pre-checked box is valid consent. It is not: Meta requires a clear and voluntary action from the user. Another mistake is not recording the consent given over the phone or in person: if you don't document it, it's not verifiable.

There's also the mistake of not renewing consent over time. If months or years have passed, the ideal is to reconfirm that the person is still interested. And the most serious of all: using consent for a purpose different from what was requested. If the person agreed to receive offers, don't send them surveys or billing messages with that same OK.