How do I prove a WhatsApp consent?

The short answer.

You prove a WhatsApp consent by storing, for each contact, who agreed to which text, when and through which channel. In Article 7 (1), the GDPR requires that the controller can demonstrate that the person concerned has given consent. This is a classification and not legal advice. As of: 02.11.2026.

What you store per contact.

This list is a recommendation derived from the legal text. The law does not list fixed fields.

Sources: Art. 7 GDPR, Art. 4 GDPR, Meta, opt-in, accessed on November 2, 2026.

Do I even have to prove the consent?

Yes, if your data processing relies on consent, you must be able to prove it. Article 7 (1) of the GDPR says exactly that: if processing is based on consent, the controller must be able to demonstrate that the person concerned has consented. In addition there is Article 5 (2), the accountability principle. Under it, you must not only ensure compliance with the GDPR principles but also be able to demonstrate it. Whether WhatsApp advertising additionally needs consent under other laws is clarified on the page Can I send advertising to customers via WhatsApp?.

Sources: Art. 7 GDPR and Art. 5 GDPR, accessed on November 2, 2026.

Why does the exact wording belong in the proof?

The exact wording belongs in it because, under the GDPR, consent must be freely given, specific to the individual case, informed and unambiguous. That is stated in Article 4 (11). A date alone does not prove that. Only the text the contact saw shows whether they knew what they agreed to. Meta additionally requires that you state clearly that the person is signing up for messages from your business, and that you name your business. If you change the text later, store the old version with a date so you can show later which text a contact saw.

Sources: Art. 4 GDPR and Meta, opt-in, accessed on November 2, 2026.

What does a provable entry look like?

A provable entry answers four questions: who agreed, when, where and to what. The following example is made up and only shows the form. The contact fills in a form, you send a confirmation question, and their reply is stored with the date. How the double opt-in works is explained on the page What is double opt-in on WhatsApp?.

How long may you keep the proof?

You may only keep it as long as necessary for the purpose. Article 5 (1) (e) of the GDPR requires storage limitation: data that identifies a person stays stored only as long as the purpose needs. This article does not give a fixed number of years, and we do not give one here. Ask your data protection advisor about the period. Remember the principle: as long as you send to the contact, you need the proof. After that, check how long you still need it.

Source: Art. 5 GDPR, accessed on November 2, 2026.

What belongs in the proof if a contact withdraws consent?

The proof also includes the withdrawal with date, so you can show that you sent nothing after it. Under Article 7 (3), the person concerned may withdraw their consent at any time, and the withdrawal must be as easy as giving it. It does not affect the lawfulness of the processing before the withdrawal. Meta also recommends giving clear instructions for unsubscribing and respecting them.

Sources: Art. 7 GDPR and Meta, opt-in, accessed on November 2, 2026.

What does SmartChat store for this?

SmartChat creates a consent record with date, time and channel for every contact in every plan, even the free one. You can download it as a PDF. For sign-ups via landing page or popup, the contact confirms automatically via double opt-in. Whether that is legally enough for your case, have a specialist check.