How to message customers on WhatsApp within the rules: a business compliance checklist

By the SheetMind AI team. Last reviewed 20 October 2026 against WhatsApp's and Meta's own help pages.

Most WhatsApp restrictions on business numbers trace back to the same few things: messaging people who never opted in, surprising them, ignoring requests to stop, and tools that send in ways WhatsApp doesn't allow. This guide turns WhatsApp's Business Messaging Policy and Meta's opt-in guidance into a checklist you can run before each campaign. It explains the rules; it can't promise that following them will keep an account from being restricted.

SheetMind AI is an independent company and is not affiliated with WhatsApp or Meta. This is general information, not legal advice, and it can't lift a ban or restriction: only WhatsApp (and, for the Business Platform, Meta) can do that. Rules change, so check the linked official pages for the latest.

The rules in one table

Source: WhatsApp Business Messaging Policy. WhatsApp can update it without notice.

Collecting opt-in

Meta's guidance says an opt-in can be general rather than specific to WhatsApp, as long as it complies with local law. To count, it must:

• clearly state that the person is opting in to receive messages or calls from your business,
• clearly state your business name, and
• comply with applicable law.

You choose the method: Meta's examples are SMS, your website, an interactive voice response phone flow, and a signed paper or in-person form. Meta also recommends getting opt-in that covers the kinds of messages you will send, or a separate opt-in for each, setting expectations about what people will receive, explaining the value, and making opt-out instructions clear. Meta's page doesn't require you to keep proof of consent, but our general advice is to keep a record of when and how each person opted in: it helps if you ever have to appeal (see How to appeal a WhatsApp ban: the official steps). Local laws about consent are your responsibility.

Numbers you bought, scraped or collected without permission don't count. WhatsApp's "How to use WhatsApp responsibly" page lists contact lists that aren't yours among the practices that can get accounts banned.

Templates and the 24-hour window

When a customer messages you, a 24-hour customer service window opens, and you can reply freely within it. Outside the window, or to start a conversation, you need an approved message template. Putting a template in the wrong category (for example marketing content in a utility template) is one of the problems Meta's enforcement guide lists, so choose the category that matches what the message really is.

Watching quality

Meta rates each business phone number on how customers have received its messages over the past seven days, using feedback such as blocks and reports. The rating shows as Green (high), Yellow (medium) or Red (low) in WhatsApp Manager. People who block you can give reasons such as "Didn't sign up" or "Spam", which tells you what to fix. Sustained low quality can bring limits: see WhatsApp Business account restricted: app vs Business Platform for how quality ratings and messaging limits work.

Pre-send checklist

1. Every recipient has opted in, and you can say when and how.
2. The opt-in named your business and said what kinds of messages to expect.
3. The conversation starts with an approved template, or is a reply inside the 24-hour window.
4. The template category matches the message: marketing is marketing.
5. The message explains who you are and why you are writing. Nothing misleading, nothing surprising.
6. Marketing messages explain how to stop receiving them, and opt-outs are honoured straight away.
7. You are not promoting anything on the policy's prohibited list.
8. Your business profile and support contact details are accurate.
9. Automated replies have a route to a person.
10. You have looked at your quality rating, and you will pause if it is falling.
11. No unofficial app, bulk-sender or scraping tool touches the number.
12. Someone watches Business Support Home or the account_update notices, so you learn about a violation straight away.

Automation and teams

Automation is allowed: the policy asks that people can reach a human. The risk is in how things are sent. WhatsApp says not to bulk message, auto-message or auto-dial, and not to use modified versions of WhatsApp. If several people send from the same number, a shared inbox on the official platform avoids the phone-juggling and linked-device workarounds that lead people to unofficial tools. See WhatsApp Business app vs Business Platform (API) and WhatsApp "temporarily banned": what it means and how to fix it.

What compliance doesn't guarantee

Following the rules lowers the risk, but it doesn't remove it. WhatsApp's systems use machine learning and user reports, and a WhatsApp spokesperson was reported in August 2026 as acknowledging they sometimes get it wrong (Gulf News report). If a business account is restricted despite following the rules, use the official appeal route in How to appeal a WhatsApp ban: the official steps.

Where SheetMind AI fits

SheetMind AI is built to make parts of this checklist easier to follow: it connects numbers through Meta's official WhatsApp Business Platform, lets replies go out freely only while the 24-hour window is open, uses approved templates outside it, and holds back a second marketing template when Meta reports its per-person marketing limit. Your team works from one shared inbox. It does not collect opt-in for you or decide what you may send: that remains your responsibility, and no tool can promise an account won't be restricted. See how it works.

Questions people ask

Do I need opt-in if the customer messaged me first?

When a customer messages you, a 24-hour window opens and you can reply within it without a template. Contacting people outside that, or starting conversations, needs opt-in and an approved template.

Can I message a list of phone numbers I bought?

No. The policy requires opt-in permission, and WhatsApp lists using contact lists that aren't yours among the practices that can get an account banned.

Do I have to keep proof of opt-in?

Meta's opt-in page doesn't say you must, and local law may differ. Keeping a record of how and when people opted in is our general advice, because it is the evidence you would need in an appeal.

How many messages can I send per day?

For conversations you start outside a customer service window, your messaging limit decides it. Meta sets limits at the business portfolio level. See WhatsApp Business account restricted: app vs Business Platform.

Will following this checklist stop my account being restricted?

It reduces the risk but can't guarantee it. WhatsApp can still restrict an account, and it has said its systems sometimes get it wrong.