Opt-out and consent on WhatsApp: the rules for businesses, and how an AI agent keeps you inside them

Two things get business numbers restricted and businesses fined: messaging people who did not ask to hear from you, and ignoring the ones who ask you to stop. Both are easy to avoid if the rule is built into how you message rather than left to memory. Here is what the rules require and how an agent enforces them for you.

By Ritchie, ReplyKit · Published 5 September 2026 · 6 min read

Quick answer

Only message people who contacted you or clearly agreed to hear from you. Treat any STOP or equivalent as final and stop immediately. Never upload a contact list to start conversations. Keep a record of consent. WhatsApp's business policy and data protection laws such as Malaysia's PDPA and Singapore's PDPA both point the same way. ReplyKit replies to people who message you, honours STOP instantly and sends broadcasts only to contacts with an opt-in record through approved templates, so the rules are enforced by design.

What the rules say Why replying is different from broadcasting How STOP must work Keep the record FAQ

What the rules say

WhatsApp Business Messaging Policy. Businesses must have opt-in before initiating messages, must provide a way to opt out, and must honour it. Spam and unsolicited messaging are grounds for restriction. Read the policy.
Data protection law. Malaysia's PDPA 2010 and Singapore's PDPA require a lawful basis for using personal data, including phone numbers, and give people the right to withdraw consent. Singapore's Do Not Call Registry applies to marketing messages to Singapore numbers.
Consumer protection and spam rules in most countries treat unsolicited commercial messages as an offence.

Why replying is different from broadcasting

A customer who messages your business has started the conversation. Replying to them, answering their question, offering a booking, reminding them of the appointment they made, is service, and they expect it. Sending a promotion to a list of numbers you collected somewhere is marketing, and it needs consent that most lists do not have. An agent that only ever replies to inbound messages cannot spam by construction. That is why ReplyKit does not offer broadcasts, and why it is the right tool for answering and the wrong tool for campaigns; see the official platform explained for the campaign route.

How STOP must work

Any message that says STOP, or a clear equivalent in any language ("berhenti", "unsubscribe", "do not message me"), ends automated messaging to that contact immediately.
No confirmation question, no "are you sure". One acknowledgement at most, then silence.
The contact stays opted out until they message again and ask to resume. ReplyKit honours START for that.
The opt-out is recorded on the contact so nobody on the team messages them by mistake.

Keep the record

Consent is only useful if you can show it. Keep the conversation history, keep the opt-out flag, and keep a written note of where each contact came from. ReplyKit stores the conversation, marks opted-out contacts, and lets you export everything as CSV. If a regulator or Meta asks, the answer is in the export. Our Acceptable Use Policy forbids list imports and unsolicited messaging on the platform, which protects every customer's number reputation, not just yours.

Frequently asked questions

Do I need consent to reply to a customer on WhatsApp?

A customer who messaged you has started the conversation; replying to their enquiry and confirming what they asked for is expected service. Marketing to them later needs clear consent.

Can I upload my customer list and message everyone?

Not without consent from each person, and not through ReplyKit at all. Bulk messaging needs the official API and consent records.

How fast must I honour STOP?

Immediately. No confirmation question. ReplyKit ends automated messaging to that contact on the spot.

Does Singapore's Do Not Call Registry apply?

It applies to marketing messages to Singapore numbers. Replying to an enquiry is not a marketing message, but any promotional outreach must be checked or consented.

What records should I keep?

The conversation, the opt-out status, and where the contact came from. ReplyKit stores these and exports to CSV.

Compliance by design, not by memory

Inbound only, STOP honoured instantly, no list imports. 7-day free trial.

Start free

Written by Ritchie, ReplyKitPart of the small team in Malaysia that builds and runs ReplyKit. Writes about WhatsApp automation, AI customer service and small business lead response.

How we know this. ReplyKit replies to inbound messages only, treats STOP as absolute and never imports contact lists. Those are product decisions made to keep customers inside the rules described here, and our Acceptable Use Policy makes them binding. Product figures in this article (limits, prices, per-reply costs) are taken from ReplyKit as it runs today and are re-checked when we update the page. Where we cite outside research, the source is linked below. We sell ReplyKit, so read our product claims with that in mind; we say where a different tool or no tool is the better choice. About ReplyKit.

Sources and further reading

WhatsApp Business Messaging Policy · opt-in, opt-out and prohibited-use rules every business must follow
Personal Data Protection Department, Malaysia (PDPA 2010)
Personal Data Protection Commission, Singapore
Singapore Do Not Call Registry
ReplyKit Acceptable Use Policy · what we refuse to automate

ReplyKit is an independent product and is not affiliated with or endorsed by Meta or WhatsApp. This article is general guidance, not legal advice. Consent and messaging laws differ by country; check the rules that apply to you.