SharpTXT

WhatsApp Consent Notice and Opt-In Wording

Last updated

If you use SharpTXT to message people, you are the data controller for those people and the obligation to obtain consent is yours - see section 7 of our Privacy Policy and Schedule 1 of our Terms of Service. This page gives you wording you can adapt, and explains what a consent record has to contain to be worth anything when a regulator or Meta asks.

Under the Malaysian PDPA, consent must be given voluntarily, for purposes you have notified, and be capable of being recorded and maintained properly by you. It cannot be bundled into a term the person has no real chance to refuse. In practice this means:

  1. Say who is asking. Name the business, not a brand the person will not recognise.
  2. Say what will be sent. "Order updates" and "promotions and offers" are different purposes and should be capable of being agreed to separately.
  3. Say how it will be sent. Name WhatsApp specifically.
  4. Do not pre-tick the box. Silence and inactivity are not consent.
  5. Say how to stop. Give a method that works, and make it free.
  6. Keep the record. Who consented, when, through what, and the exact wording they saw.

Point 6 is what SharpTXT stores for you: a consent record carries a status, a source, a capture timestamp, and an evidence reference, and can also carry the page URL, the wording shown, and a note. Every source except AgentAsserted must have an evidence reference, or SharpTXT will not save it. Record consent at the moment you collect it, not afterwards.

2. What SharpTXT does for you, and what it does not

SharpTXT gives you tools to keep and act on consent records. They help you meet your obligations; they do not meet them for you, and using them does not make your messaging lawful by itself.

Where you record consent

  • Cloud API: on the contact's page, with the source and evidence, for one contact or several at once.
  • WaWeb: by importing a contacts sheet with the consent columns filled in. Importing a number that is already in your contacts updates it, so a one-row sheet is enough to record a single opt-in or opt-out. Imported records are saved with the source Imported.
  • Both: through the SharpTXT API.

What happens once it is recorded

  • Opted out means no messages. SharpTXT refuses to send any campaign, automation, or reply to a contact recorded as opted out. The message fails and shows the reason.
  • The latest decision wins. A contact's status follows the record with the most recent capture time, so a later opt-in (for example, a START reply) replaces an earlier opt-out, and entering an older record does not override a newer one. Every record stays in the contact's history.
  • You are warned about Unknown contacts. Before a campaign starts, SharpTXT tells you how many of its recipients have no consent on file. In the WaWeb inbox you are asked to confirm before replying to a contact with no consent on file.

What SharpTXT does not do

  • It does not act on replies by itself. A STOP (or START) reply is not read or applied automatically. Until you record it, the contact's status does not change and messages to them still send. See section 6.
  • It does not block Unknown contacts. It warns you and leaves the decision to you, because it cannot know about evidence you hold elsewhere. See section 7.
  • It does not certify compliance. SharpTXT is not a PDPA certification, and nothing here is legal advice.

3. Model wording: web form or checkout

Stay updated on WhatsApp

[ ] I agree that [Business Name] may contact me on WhatsApp at the number I have given, about my orders and account.

[ ] I agree that [Business Name] may send me promotions, offers, and marketing on WhatsApp.

You can withdraw your consent at any time by replying STOP to any of our WhatsApp messages, or by emailing [privacy@yourbusiness.com]. See our [Privacy Notice] for how we handle your personal data.

Record it as source WebForm or Checkout, with the submission ID as the evidence reference and the page URL saved alongside it.

When a person starts the conversation, that first inbound message is your strongest evidence - it is their own act, and it carries a message ID. Send this as your first reply:

Hi! Thanks for messaging [Business Name]. We will use WhatsApp to reply to you and keep you updated about your enquiry.

Would you also like offers and promotions from us on WhatsApp? Reply YES to opt in, or STOP at any time to stop hearing from us. Our privacy notice: [link]

Record the service consent as source InboundMessage with the inbound message ID as the evidence reference. Record a YES reply as a separate marketing consent, with that reply's own message ID.

5. Model wording: collected in person or by phone

Before I add you: is it alright if [Business Name] messages you on WhatsApp at this number about [purpose]? You can stop it any time by replying STOP.

Record this as source AgentAsserted, with the agent's name and the date in the note. Be honest about what this is: an attributable claim by your staff, not evidence the person agreed. It is the weakest source you can record and SharpTXT displays it differently for that reason. Follow it up with a written confirmation where the messaging matters.

6. Model wording: opt-out confirmation

SharpTXT does not process a STOP reply for you. When one arrives, record the opt-out straight away. On Cloud API, record it as source InboundMessage with the STOP message's ID as the evidence reference. On WaWeb, import it with that message ID in the evidence column. From that moment SharpTXT refuses to send to the contact. If the person later replies START, record that reply as a new opt-in in the same way.

Act on an opt-out immediately, and confirm it:

You have been unsubscribed from [Business Name] messages on WhatsApp and will not receive further promotional messages from us. If this was a mistake, reply START.

7. Imported contacts

A contact imported from a spreadsheet arrives with consent status Unknown. That is deliberate: a row in a file is not consent, and backfilling one is how businesses end up unable to answer a regulator's question.

Unknown is not a block. SharpTXT refuses to send to a contact recorded as opted out. It does not refuse an Unknown one, because it cannot know whether you hold evidence it was never told about. Before a campaign starts, SharpTXT tells you how many of its recipients have no consent on file, and on Cloud API, building an audience shows how many of its members are not opted in. Treat that number as the count of people you may have no lawful basis to message, and clear it before you send rather than after.

If you hold genuine evidence of consent collected elsewhere, import it: map the consent column, and record the source and evidence reference the original system captured. If you do not hold that evidence, re-permission the list before you message it.

8. What you must always allow

  • A free, simple opt-out in every marketing message, honoured promptly.
  • Withdrawal by any reasonable means, not only the channel you prefer.
  • Access and correction requests, answered within 21 days as the PDPA requires.

9. Questions

This wording is provided as a starting point by SeeSharp Solutions. For questions about how SharpTXT records consent, contact info@seesharpsolutions.com. How we handle personal data is set out in our Privacy Policy; your subscription is governed by our Terms of Service. For advice on whether your consent practice meets the law, consult your own lawyer.