How to Create a WhatsApp Customer List with Permission: Step by Step
What seems like the easiest way to grow a list—namely, finding numbers from somewhere—is usually the most expensive option: it leads to complaints, yields no responses, and puts your account at risk. A permission-based list grows more slowly, but every entry on it is someone who has agreed to receive messages from you. In this article, we’ll walk you through the steps for collecting consent, how to maintain your records, and how to manage your list using the WapFlow guide.
This article is for general informational purposes only. For rules regarding commercial communications and personal data, consult an expert based on your specific situation. We’ve summarized the framework in our article on the IYS and KVKK.
What Does “Opt-In List” Mean?
In practice, a permission-based list is one where you can answer the following four questions for each person:
- Did this person agree to receive messages via WhatsApp?
- When and where did they consent?
- What type of messages did they consent to: campaigns, reminders, newsletters?
- Do they know what to do if they want to opt out?
If you cannot answer any of these questions, clarify the situation before adding that person to your campaign list. The fact that you have their phone number does not answer any of these questions.
Who Should Not Be on the List
- Purchased or acquired lists.
- Numbers collected from the internet, maps, or groups.
- Numbers collected for another purpose, such as a phone number requested solely for shipping.
- “Consents” obtained via pre-checked boxes.
- Consents given for another channel. Email consent may not cover WhatsApp.
Step 1: Identify Your Consent Points
Every place where a customer interacts with you can be a permission point. You don’t have to open them all at once. Start with the two busiest points.
| Point | How to obtain it? | What’s recorded? |
|---|---|---|
| Website form | A standalone WhatsApp permission box (unchecked) | Form submission, date, text as it appeared that day |
| Payment page | Optional checkbox, independent of the purchase | Order record and checkbox status |
| Store checkout | A message sent by the person via WhatsApp or a signed form | Incoming message or form |
| WhatsApp chat | Open-ended question at the end of the chat, the person’s written response | Response in the chat |
| Event and trade show | A registration form with a clear purpose | Form, event name, and date |
Work with your consultant to tailor the checkbox and text examples to your specific business needs. The basic rule is this: the person grants consent themselves—that is, they check the box or write the message themselves.
Step 2: Ask for Permission in the Chat
The most natural point to ask for permission is during a conversation with a customer you’re already speaking with. After they’ve answered your question, ask in a single sentence—don’t pressure them.
We’re glad if we could be of help. We share our campaigns and new products via WhatsApp once or twice a month. If you’d like to receive them, simply type “YES”; if not, there’s no need to reply.
If you receive a “YES,” add the person to your list. If there’s no response, don’t ask the same question again. Don’t assume silence means consent. This is a sample text; add your business name and message type—it does not serve as legal counsel.
This question must be personalized. Sending the same message in bulk to people without their permission may be considered promotional messaging, even if they say “I want permission.”
Step 3: Set Up the Registration Table
Keeping proof of consent is just as important as obtaining it. WapFlow does not have a separate consent section, and the dashboard does not verify consent status on your behalf. Therefore, keep your own records. A simple Excel spreadsheet is sufficient:
| Number | Name | Permission Date | Source | Message Type | Text version |
|---|---|---|---|---|---|
| 90 5XX XXX XX XX | Sample Person | November 2, 2026 | Web form | Campaign | Form v2 |
| 90 5XX XXX XX XX | Sample Person | November 2, 2026 | WhatsApp Chat | Campaign | Chat Text v1 |
The "Text Version" column may seem like a minor detail, but it lets you know who has accepted what when you change the consent text. Keep access to the file restricted and do not leave it open in a shared folder.
Step 4: Regularly Transfer the List to the Address Book
- Select the authorized contacts from your registration table and prepare them as an Excel file. Enter the numbers with the country code.
- Open the import window from the "Contacts" page in WapFlow and map the columns.
- Use the “Add imported contacts to a group” option to place the contacts in a separate group, such as “Authorized – November 2026.”
- When adding contacts one by one using "Add Contact," enter the permission source in the "Notes" field.
- Use the number validator to filter out those who are not on WhatsApp.
Do not mix "Approved" and "Permission Unclear" contacts in the same group. Selecting only "Approved" groups in the campaign window reduces the risk of accidental sends. Details on file preparation are available in the Excel import guide.
Step 5: Implement the Opt-Out Process
A permission list isn’t just a growing list—it’s a list that removes those who don’t want to be included. Include an opt-out option in every marketing message:
If you no longer wish to receive these messages, simply type “STOP.”
Under Settings > Delivery and Security, enable the “Automatically block ‘STOP’/‘STOP’ entries” option. This setting is turned off by default. Also mark the person who has opted out in your contact list. Otherwise, the number may be added back to the contact list during the next Excel upload. The block list is still checked during delivery, but ensuring consistency between the two records prevents confusion.
The block list in WapFlow does not serve as an official opt-out record and is not linked to the IYS. This process is the responsibility of your business.
If You Have an Old List
You may have accumulated customer numbers over the years. Consider their consent status in three groups:
- Those with a record: Those with a known permission date and source. They remain on the list.
- Those who have only made purchases: Marketing consent may not be automatic. Ask your consultant how to proceed.
- Those with unknown sources: Do not add them to the campaign list.
During their next purchase, at the checkout, or via live chat, you can ask these individuals for permission again. Cleaning up the old list will reduce the number of contacts, but the remaining audience consists of the people you truly want to reach.
Weekly Checklist
- How many sign-ups came from each permission source this week?
- Have the new records been added to the database and the contact list?
- Have the people marked “STOP” been flagged in the table as well?
- Was a bulk import with uncertain consent status made to the contact list?
- If the permission text has changed, was a new version number assigned?
Brief Instructions for Staff
Permission points work if the person speaking with the customer knows what to do. Give the following four-sentence instruction to the cashier and support team:
- Tell the customer in one sentence what they’re buying.
- Leave the decision up to them; don’t ask a second time.
- Do not check boxes or fill out forms on the customer’s behalf.
- Record only those who clearly say “yes” in the log.
It’s also important not to make the number of sign-ups a staff target. When a numerical target is set, opt-ins easily turn into forced opt-ins.
Frequently Asked Questions
Is there a legitimate way to grow the list quickly?
There are no shortcuts. The fastest growth comes from making the opt-in visible at points where customers are already present. The checkout, website, and chat are the starting points for most businesses.
Does WapFlow obtain consent?
No. The dashboard manages contacts and sends messages. Obtaining and verifying consent is the business’s responsibility.
How long does it take for a list to become outdated?
It’s hard to give an exact timeframe. Instead of continuing to message people who haven’t responded in a long time, reduce the frequency or remove them from your mailing list.
If your list is ready, you can refer to the bulk messaging guide for your first send. Check the pricing page for package and guide capacities.
