A hair salon has had a sign-up sheet by the till for years. “Leave your details and we’ll tell you about our offers”, it says across the top, and plenty of clients have dutifully written down their mobile number. Now the owner finally wants to start a WhatsApp newsletter, and she’s wondering: can I just message these numbers?
Short answer: better not. A number on a sheet of paper is no proof that the person behind it wants marketing on WhatsApp. Maybe a husband wrote down his wife’s number. Maybe the client was picturing the odd text message. Maybe the digits were simply copied down wrong. Double opt-in exists for exactly these cases, and once you understand it you’ll never want to work without it.
What double opt-in actually means
Opt-in means consent. Double means twice. So with double opt-in, a person agrees twice before a single marketing message reaches them.
The first step is the sign-up itself: someone enters their number on your landing page or sends you the start keyword on WhatsApp. The second step is the confirmation. A message goes to that exact number, and the person actively confirms that they really do want to be on the list, for example by sending a short reply. Only after this second confirmation does the consent count, and only then may you send newsletters and offers.
The logic behind it is simple. Only the real owner of the number can complete the second step. Nobody can sign up someone else’s number, and typos filter themselves out.
How the sign-up works in practice
Let’s stay with the salon and walk through a concrete example:
- Emma scans the QR code by the till and lands on the salon’s landing page.
- She enters her first name and mobile number, and sees a short note explaining what her details will be used for.
- Seconds later a WhatsApp message arrives: “Hi Emma, lovely to have you with us! Just confirm your sign-up so we can send you news and offers.”
- Emma taps to confirm, and only then is she officially on the list.
For Emma it feels like a quick, tidy process. For the salon, something far more important has happened in the background: the time, the number and the confirmation are all on record. With SmartChat this whole flow runs automatically, and the AI even builds the landing page straight from your website. You can see what that looks like on the feature page for double opt-in.
Why the second confirmation protects you
GDPR requires provable consent for marketing messages. Provable is the word that matters. If it ever comes to a dispute, you have to be able to show that the person agreed. A sheet of paper by the till cannot do that. A documented double opt-in can.
Double opt-in is not a hurdle for your marketing. It is your evidence if anyone ever asks.
There is a second layer of protection that many people miss. WhatsApp itself pays close attention to how recipients react to your messages. Message people who never agreed and you will pick up blocks and reports, and in the worst case that puts your own number at risk. A list built from confirmed sign-ups is not just legally clean. It also means your messages are welcome, and welcome messages get read. WhatsApp reaches an open rate of 98%.
The most common questions, answered
Does this apply to existing clients too? Yes. Even someone who has been coming to you for years has to give proper consent once for WhatsApp marketing. Actively invite your regulars to sign up. It happens faster than you think, because they already know you and like you.
Is a verbal yes enough? No, because you cannot prove it. Going through the landing page with a confirmation step takes less than a minute, and it lifts the risk off your shoulders entirely.
Can someone opt out again? At any time, and it has to be as easy as signing up was. A short “Stop” is enough, and no more marketing messages go out to that person. A well-kept list of only the people who want to be on it is the more valuable list anyway.
What happens to the old sheet by the till? Use it as an invitation list, not as a mailing list. Speak to those clients in person on their next visit and show them the QR code. That turns a grey area into clean consent. You will find the best ways to put the code to work on the page about the QR code feature.
The bottom line
Double opt-in comes down to this: sign up, confirm, done. That small second step turns a risky pile of phone numbers into a legally safe, engaged contact list. With SmartChat the whole flow is built in and GDPR-compliant, and you are ready to go in under 60 seconds. You will find all the details on the page about double opt-in.