SMS and WhatsApp Marketing for Startups: When It Works, How to Get Consent, and What to Send

1. Blog
2. Demand & Channels

By Saroj Jha · October 24, 2026 · 30 min read

Text messages and WhatsApp messages go to a customer’s phone number, the consent and opt-out rules are strict, and one reply word such as STOP can withdraw the consent you rely on. Use them for messages a customer asked for, collect and record a clear yes before you send, register your sender and templates before launch, and hold out a group so you can tell what the messages caused.

I wrote this for Seed to Series B founders and marketers adding SMS or WhatsApp, mainly consumer apps, plus B2B teams who want reminders and onboarding nudges. It has eight steps, a cost model, a launch sequence and two fictional cases: an India app on WhatsApp and a US app on SMS. For email, see the Customer Onboarding & Retention Playbook and the Lifecycle Email Audit.

Running case: Example Co. Fictional

Two seed-stage companies share the name. Example Co. India is a Bengaluru EdTech app preparing working professionals (all adults) for a cloud-certification exam. Its 40,000 learners already message support on WhatsApp, and it wants WhatsApp for class reminders, mock-test results and a few offers before exam season. Example Co. US is a meal-planning app with a 14-day free trial and about 20,000 trial starts a quarter. It wants SMS for trial-ending reminders and two promotional texts a month. Both companies and all their numbers are fictional.

Step 1: Decide whether SMS or WhatsApp fits your business

Meta and the regulators sort messages by what they are for, so decide that first. Meta describes utility templates as “typically triggered by a user action or request” and non-promotional^[1]; TRAI defines a service message as one that provides information about a product or service the customer uses^[2]. Three questions follow from those definitions:

1. Is it tied to something the customer is doing? A class, a trial, a delivery or an appointment the customer already has with you. If it is there mainly to sell, Meta and TRAI put it in the marketing or promotional category.
2. Do you hold a recorded yes that matches it? Meta advises asking for consent separately for each message type^[3], so a yes to reminders is not a yes to offers.
3. Does the reader need it now? If it can wait, ask whether email or an in-product message would do the same job without the per-message fee and sender registration that texting needs (Steps 3 to 5).

If all three answers are no, there is little reason to take on the consent record, registration and per-message fee that texting needs; use email or the product instead.

Transactional and marketing messages are different jobs

The rules and platform policies turn on one distinction: is the message about something the customer is already doing (an order, a login, an appointment), or is it trying to sell something? The labels differ by source: Meta uses utility and marketing^[1], TRAI uses transactional, service and promotional^[2], and the FCC’s new rule separates informational messages from those containing an advertisement^[4].

Examples by business type

• B2C apps and subscriptions: trial-ending and renewal reminders, back-in-stock and cart reminders, and offers (which are marketing).
• B2B: same-day event and webinar reminders, nudges for a named user who has stalled, meeting confirmations. The Webinar Run-of-Show & Follow-Up Planner covers the event timeline.
• WhatsApp: where customers already message you there, each of their messages opens a 24-hour customer service window in which you can reply with free-form messages (Meta^[5]; Step 5).

Example Co., step 1 Fictional

Example Co. India puts class reminders and mock-test results on WhatsApp as utility messages, because each is tied to the learner’s own class or test, and keeps login passcodes on SMS. Offers are marketing, limited to two a month in the eight weeks before each exam window, for learners who agreed. Example Co. US runs its trial-ending reminder and its promotional texts as separate programs with separate consent.

Do this

List every message you want to send, label each one transactional or marketing, and answer the three questions for it. Drop anything where all three answers are no.

Step 2: Build an opt-in list you can prove

An SMS or WhatsApp list is only worth having if every number on it came with a clear yes that you recorded. CTIA, the US wireless industry association, says message senders “should not use opt-in lists that have been rented, sold, or shared to send messages”, and that a consumer opt-in “should not be transferable or assignable”^[6]. In the US, the FCC’s definition of prior express written consent also needs an agreement in writing that bears the person’s signature, which can be electronic^[7].

Where to collect consent

• At signup or checkout, with a separate box next to the phone field, not bundled into the terms. The FCC’s definition of written consent says the person cannot be required to sign as a condition of purchase^[7].
• In the product, at the moment a message would help: “Want a WhatsApp reminder 30 minutes before class?”
• By keyword, where a customer texts JOIN to your number.
• In a WhatsApp conversation the customer starts.

What to tell people when they opt in

Say what they will get, how often, and how to stop. For recurring-message programs in the US, CTIA’s guidance says the opt-in confirmation message should include “the program name or product description”, “customer care contact information”, “how to opt-out”, “a disclosure that the messages are recurring and the frequency of the messaging”, and “clear and conspicuous language about any associated fees or charges”^[6].

What to record

For each number, keep the proof. For marketing texts sent with an autodialer, the US rule asks for a written agreement with the person’s signature, which may be electronic^[7], so keep the screen, the wording version and the timestamp that show it. Figure 2 lists what to store.

Example Co., step 2 Fictional

Example Co. US adds an optional, unticked box under the phone field on its trial signup form: “Text me meal-plan tips and offers from Example Co. Up to 4 msgs/month. Msg & data rates may apply. Reply STOP to cancel, HELP for help. Consent is not a condition of purchase.” The confirmation text repeats the program name, the frequency and the STOP instruction. The database stores the box wording, its version, the timestamp and the IP address for each number.

Do this

Screenshot every place you collect a phone number and check that each says what people will receive, how often, and how to stop.

This is general information, not legal, financial or medical advice. Check with a qualified professional.

Step 3: Read the US rules on consent, quiet hours and opt-outs

US marketing texts are governed mainly by the Telephone Consumer Protection Act of 1991 and the FCC’s rules that implement it, in 47 CFR 64.1200^[7]. This is orientation, not a statement of what your obligations are.

Prior express written consent

The FCC’s rules require “the prior express written consent of the called party” for advertising or telemarketing calls, using an autodialer or a prerecorded voice, to wireless numbers, with narrow exceptions^[7]. The revocation rule applies to “calls or text messages”^[7]. Prior express written consent means a written agreement, bearing the signature of the person, that clearly authorizes the seller to deliver advertising or telemarketing messages to a stated number, and that says the person is not required to sign it as a condition of purchase. Electronic signatures count if federal or state law recognizes them^[7]. Whether a particular texting platform counts as an autodialer is a legal question to put to your lawyer.

The "one-to-one consent" rule is not in force

The FCC’s 2023 change limiting consent to a single identified seller, often called the one-to-one consent rule, was vacated by the US Court of Appeals for the Eleventh Circuit, whose mandate issued on April 30, 2025. On August 29, 2025 the FCC published a final rule that “reinstates in the Commission’s rules the prior version of Sec. 64.1200(f)(9)”^[8], and the current eCFR definition matches it^[7]. CTIA’s guidance that consent should not be transferable still applies^[6].

Quiet hours

The FCC’s rules bar telephone solicitations to residential subscribers “before the hour of 8 a.m. or after 9 p.m.” local time at the called party’s location^[7]. Some states are stricter. Florida, for example, bars a commercial telephone solicitation phone call “before 8 a.m. or after 8 p.m.” in the called person’s time zone, and limits such calls to three in 24 hours on the same subject^[9]. Florida’s separate Telephone Solicitation Act defines a “telephonic sales call” to include a “text message”^[10]. Check the rules for every state where your customers live, and schedule by the recipient’s time zone, not yours.

Opt-outs and revocation of consent

Since the FCC’s 2024 consent-revocation rules, a person may revoke consent by any reasonable method, and replying “stop”, “quit”, “end”, “revoke”, “opt out”, “cancel” or “unsubscribe” to a text counts as reasonable, and so does any other reply that a reasonable person would understand as a request to stop. A revocation must be honored “within a reasonable time not to exceed ten business days”, and a single confirmation text with no marketing content is permitted^[7]. The dates have moved several times, so Figure 3 sets out the sequence from the FCC’s own documents.

Under FCC 26-67, a sender may make a reply text the exclusive way to revoke; one standard word such as “stop” may be shown, but all the standard words must be honored; a revocation in reply to an informational text may cover only that category; and a revocation in reply to a marketing text covers all future marketing texts from that sender, still within ten business days^[4]. The eCFR text current on October 22, 2026 still says senders may not designate an exclusive means of revocation^[7]. Because the rule also counts other plain-language requests, build the opt-out handling for the listed words and for requests such as “please stop texting me”. Ten business days is the outer limit, not a target.

A2P 10DLC registration

US business texting from an ordinary 10-digit number runs on A2P (application-to-person) 10DLC. The Campaign Registry (TCR), “the centralized hub for the 10DLC ecosystem”, records each business’s brand and each campaign, meaning “the use case of your messaging”^[12]. Your messaging provider registers them for you^[13]. TCR “does not review, approve, or reject campaigns”; others in the chain do, and review times “can range from 1-4 weeks”^[12]. Plan for that, and describe your use case and consent flow accurately.

Example Co., step 3 Fictional

A lawyer reviews Example Co. US’s signup wording. Sends run 10 a.m. to 7 p.m. in each customer’s local time, inside the federal and Florida windows. STOP and its synonyms trigger an automatic opt-out and one confirmation. The provider registers the brand and two campaigns with TCR three weeks before the first send.

This is general information, not legal, financial or medical advice. Check with a qualified professional.

Step 4: Read the UK, EU and India rules before you message there

In the UK and EU the starting rule is prior consent for electronic marketing, with a narrow exception for your own similar products. India runs on DLT registration and a split between transactional, service and promotional messages. Figure 4 puts the four markets side by side; the paragraphs below give the wording.

UK: PECR

In the UK, the Privacy and Electronic Communications Regulations (PECR) cover marketing by “electronic mail”, which the ICO explains includes “messages sent using a short message service”; the ICO lists in-app messages and private direct messages on social media as examples too^[15]. Organisations “normally must have consent before sending unsolicited electronic mail marketing to individual subscribers”^[14]. The exception is the soft opt-in: you obtained the contact details “while selling or negotiating to sell a product or service”, you are “only marketing your similar products and services”, and you gave the person a chance to opt out when you collected the details and “in every subsequent communication”^[14]. The ICO notes that a separate soft opt-in for charitable purposes “commenced on 5 February 2026”^[14].

EU: the ePrivacy Directive

In the EU, Article 13 of the ePrivacy Directive (2002/58/EC) says electronic mail for direct marketing “may be allowed only in respect of subscribers or users who have given their prior consent”, with a similar exception for a company’s own “similar products or services” to existing customers who are given the chance to object “at the time of their collection and on the occasion of each message”^[16]. Article 13(6) refers to “national provisions adopted pursuant to this Article”, so the rule you follow is the law of the country you send to.

India: TRAI’s TCCCPR and DLT registration

In India, commercial SMS and calls are governed by the Telecom Regulatory Authority of India’s Telecom Commercial Communications Customer Preference Regulations, 2018 (TCCCPR), first published on July 19, 2018 and amended by the Second Amendment Regulations dated February 12, 2025^[2]. On September 18, 2026 TRAI announced a Third Amendment, 2026, which among other changes covers “legacy consents” that businesses already hold^[18]. The three points below come from the 2025 text; the 2026 changes follow the list:

• Registration on DLT. A distributed ledger technology (DLT) platform handles “registration of entities and registration of content templates” and consent records, and commercial communication must take place “only using registered headers”^[2]. Headers and templates must be registered before you send.
• Three message types. A transactional message answers a customer-initiated transaction “within thirty minutes”, such as an OTP; a service message informs a customer about something they use, such as a delivery. Both must be “not promotional in nature”. Promotional messages reach only people who have not blocked that category or who consented^[2].
• Consent and opt-out. Promotional messages must include “an opt-out mechanism to the Recipient in the same Message”, and a sender may re-ask someone who revoked consent “only after ninety (90) days”^[2]. A sender’s first violation can bar “outgoing services of all telecom resource of the sender” for 15 days^[17].

The text TRAI posted for the 2026 amendment, marked “to be published in the Gazette”, moves one-time passcodes for app login, password reset and two-factor authentication from transactional to service messages, adds legacy consents obtained through verifiable means once they are registered as TRAI specifies, and limits an inquiry as a basis for messaging to seven days. It takes effect thirty days after Gazette publication, with some parts at sixty or ninety days^[19]. TRAI’s 2026 press release covers SMS and calls and names no messaging app^[18]; WhatsApp’s rules on consent and templates are Meta’s (Step 5). Other countries have their own rules; this guide does not cover them.

This is general information, not legal, financial or medical advice. Check with a qualified professional.

Step 5: Set up WhatsApp the way the platform requires

WhatsApp has two business products and its own rules on consent, message types and pricing, set by Meta rather than by a regulator. Read Meta’s current documentation before you build: its pricing page alone lists rate changes on January 1, April 1, July 1 and October 1, 2026^[20].

WhatsApp Business app or WhatsApp Business Platform

• The WhatsApp Business app is the phone app. WhatsApp introduced it in January 2018 as “a free-to-download Android app for small businesses”^[21]. Check WhatsApp’s current Business app pages for today’s features and limits.
• The WhatsApp Business Platform is what Meta calls its “enterprise-grade APIs for messaging and calling”^[22]. Meta says it “enables businesses to communicate with customers at scale”, and its Cloud API lets you “programmatically message and call on WhatsApp” from your own systems^[23]. Meta also says a business can use the Business app and the API with the same phone number^[22].

Meta describes the Platform as APIs and the Cloud API as the way to message from your own systems; the Business app is the phone app. Meta says a business can use both on the same number^[22].

Opt-in

Meta’s documentation says that “before messaging people on WhatsApp, businesses are required to obtain opt-in permission”. The person must have shared their mobile number, and the opt-in must name the business. Meta says the opt-in can be general rather than specific to WhatsApp, provided the business complies with “all local laws”, and it advises asking for consent separately for each message type and giving easy opt-out instructions^[3]. Treat Meta’s rule as the minimum and add what the law in your market requires (Steps 3 and 4).

Templates, categories and the customer service window

Outside a customer service window you can send only templates. Meta says template messages “are the only type of message that can be sent to WhatsApp users outside of a customer service window”, and templates are reviewed automatically when you create or edit them^[24]. Each template “must be categorized as authentication, marketing, or utility”^[24]. Figure 5 sets out the three categories and the window.

Category matters. Meta can change the category of an approved template that does not meet its guidelines: a utility template that should be marketing is switched to marketing, normally after one day’s notice, and repeated misuse can bring wider restrictions^[1].

Pricing

Meta replaced conversation-based pricing with per-message pricing on July 1, 2025. Businesses are charged only for delivered messages, and rates vary by message category and by the recipient’s country calling code^[20]. The free allowances have since changed. Service messages (free since November 1, 2024) and utility templates sent inside an open customer service window (free since July 1, 2025) are charged again from October 1, 2026, and each business phone number gets 1,000 free service messages a month, with service messages beyond that charged. Rates differ by country, and Meta changed them several times in 2026^[20]. Take rates only from Meta’s official pricing pages, and write down the date you read them.

Quality rating and messaging limits

WhatsApp determines message quality “from how WhatsApp users have received your messages over the past seven days”, using user feedback signals such as blocks, reports, mutes and archives, and WhatsApp Manager shows your number’s quality rating^[5]. Each template also has its own quality rating, and templates rated red are “in danger of being paused or disabled soon”^[25]. Separately, Meta sets a messaging limit: “the maximum number of unique WhatsApp user phone numbers your business can deliver messages to” outside customer service windows in a rolling 24-hour period. The limit is set for your whole business portfolio and shared by all its phone numbers. New portfolios start at 250. Verifying the business, or delivering 2,000 messages to unique numbers within 30 days using high-quality templates, can raise it to 2,000 after Meta reviews quality; above that it rises automatically while quality stays high and you use at least half your current limit^[26]. Because blocks feed the quality rating, and quality bears on whether your limit rises and whether templates stay active, a block costs you more than one customer.

Example Co., step 5 Fictional

Example Co. India moves to the Platform through a provider when reminders must reach 3,000 learners at once. At signup, two separate unticked boxes read “Send me class reminders and test results on WhatsApp” and “Send me course offers on WhatsApp (up to 2 a month before exam season)”. Reminders and results go as utility templates and offers as marketing templates; login codes stay on DLT-registered SMS. A tutor answers any learner who replies. The team rechecks Meta’s India rate card each quarter.

Do this

Write down, for each WhatsApp message you plan, its template category and the opt-in box that covers it. If a message sells anything, put it in a marketing template.

This is general information, not legal, financial or medical advice. Check with a qualified professional.

Step 6: Write messages people are glad to get

A text or WhatsApp message should say who is sending, do one job and let the reader stop. The checklist below comes from the sources in Steps 2 to 5 and from the fictional example messages:

• Say who is sending. CTIA’s opt-in confirmation includes the program name or product description^[6], and the example messages open with the company name.
• One message, one job, one link. Ask your provider how it counts and bills long messages.
• Track the link with UTM parameters (the Tracking Plan and UTM Builder helps).
• Tie it to what the person did: “Your mock test 3 score is ready” follows the learner’s own test, which is how Meta describes utility messages^[1].
• State the frequency at opt-in. CTIA’s opt-in confirmation includes the frequency of the messaging^[6].
• Send at the recipient’s local time, inside the legal windows in Step 3.
• Put the opt-out in every marketing message. TRAI requires it in the same message for promotional messages^[2], and CTIA says senders should state in the message how to opt out^[6].

For example: “Example Co.: your trial ends Thu. Keep your plan at 40% off the first month: example.co/keep Reply STOP to opt out”. It names the sender, does one job, carries one link and includes the opt-out. Figure 6 gives a starting bank of fictional messages for the moments in Step 7. Adapt the wording, and check each one against your recorded consent before it goes out.

Do this

Rewrite your three most-sent messages so each one names you, does one job, and has one link on your own domain.

Step 7: Segment and trigger messages by lifecycle stage

Decide the journey first, then choose which moments deserve a text. The Customer Onboarding & Retention Playbook (Step 5, first-week touchpoints) and the B2C Foundations Playbook (Step 6, three simple email and SMS flows) cover the journey; this guide covers the text. Figure 7 maps example moments to the category to check.

Set a frequency cap and count every program

I know of no primary source that sets a right number of messages, so set the cap yourself and say it where people opt in; CTIA’s opt-in confirmation includes the frequency^[6]. Decide in writing whether the cap counts service and marketing together, apply the same rule to every program, and watch opt-outs per send and, on WhatsApp, blocks and the quality rating. Decide in advance what rise in opt-outs after a send you will treat as a signal to review that send.

Segment by consent (service only, or marketing too), channel, time zone and lifecycle stage; the Customer Segmentation Playbook covers choosing segments. Stop a triggered message once the person has done what it asks.

Example Co., step 7 Fictional

Example Co. US uses three triggers only: a trial-ending reminder two days before the charge, one plan-selection reminder, and a win-back text 45 days after cancellation. Promotions go twice a month, never within three days of a triggered marketing text.

Do this

Map your lifecycle in a table like Figure 7 and mark the two or three moments where a text would change what the customer does.

Step 8: Measure delivery, response, opt-outs and incremental conversions

Counting every sale that follows a text includes customers who would have bought anyway, so attributed sales can overstate what the text did. Measure five numbers:

1. Delivery rate: delivered divided by sent.
2. Click-through rate: unique clicks divided by delivered.
3. Opt-out rate per send: opt-outs divided by delivered (on WhatsApp, also blocks and quality rating).
4. Conversion rate: the action you wanted divided by people messaged.
5. Incremental conversions: extra conversions compared with a holdout group that was eligible but not messaged.

AAJ publishes no benchmarks for these, because I have found no primary source that would apply to your product. Set your baseline from your first month.

A worked holdout test

Example Co., step 8 Fictional

Of 20,000 trial users with text consent in a quarter, Example Co. US randomly holds out 10% (2,000) from the trial-ending text and sends it to the other 18,000. In the messaged group, 1,080 of 18,000 convert to paid, a rate of 6.0%. In the holdout, 90 of 2,000 convert, a rate of 4.5%. The lift is 1.5 percentage points, about 270 extra paid customers (18,000 x 1.5%). The standard error of the difference is about 0.50 points, so the difference is about three standard errors and the 95% interval is roughly 0.5 to 2.5 points. Opt-outs run at 180 of 18,000, or 1.0% per send, which the team tracks as a cost too. All numbers are fictional.

The A/B Test Significance Calculator does this arithmetic. Keep a holdout running on each major trigger so you notice when a message stops working. Incrementality Testing for Startups covers sizing.

Do this

Before your next send, randomly hold out a share of eligible recipients that you can afford to leave unmessaged (Example Co. uses 10%, a fictional choice) and record conversions for both groups. The size of the share sets how precise the read is.

What it costs, and what it has to return

The send fee is only one cost, and the price lists change, so I do not publish rates. Build the cost yourself from five lines, each from a dated source: the per-message fee your provider or Meta charges (multiplied by message parts or by delivered messages), any registration or platform fees on the provider’s price list, number rental, the time of the people who write, review and monitor the messages, and the reach you lose each time someone opts out. Then compare it with what the holdout says the messages added. Figure 9 shows the arithmetic with a placeholder rate.

Two ratios are worth computing alongside the rate. Cost per incremental customer tells you what a conversion costs; the break-even rate tells you how much the price list could rise before the program stops paying. Example Co. India does the same sum for WhatsApp: delivered utility templates in a month (3,000 learners times 8 classes, or 24,000) times the rate on Meta’s India rate card, read on the day, against the attendance gain from holding out one class cohort. It also costs marketing templates separately from reminders, because Meta prices by category and marketing templates carry a quality risk (Step 5).

The Unit Economics Calculator shows whether the extra customers are worth their cost.

A launch sequence for your first program

This sequence is built around the one step that has a published range: sender registration. The Campaign Registry says review times can range from 1 to 4 weeks (Step 3), so start registration first and write the rest of the program while it clears. In India, register headers and templates on DLT before you send (Step 4); on WhatsApp, template review is automatic but a new portfolio starts at a messaging limit of 250 (Step 5).

Before the first send, run the checklist in Figure 11. If any line is a no, the program is not ready.

What mistakes should I avoid?

• Messaging without recorded consent, or from bought, rented or shared lists^[6].
• Hiding marketing in a reminder. A reminder with a sales pitch is a marketing message.
• Sending on your time zone instead of the recipient’s.
• Slow or partial opt-outs. Honor STOP and plain-language requests automatically.
• Launching before registration clears. TCR says 10DLC review can range from 1 to 4 weeks, and DLT headers and templates must be registered before you send.
• Reading clicks as proof. Only a holdout shows what the messages caused.
• Too many WhatsApp marketing templates. Blocks count against your number’s quality rating, not just one campaign^[5].

Method and limits

I opened every legal and platform source on October 24, 2026, and left out any figure I could not confirm on a page I opened. According to the Federal Register pages I read, the FCC’s order FCC 26-67 was filed for public inspection on October 23, 2026, is scheduled for publication on October 26, 2026 and takes effect on November 25, 2026. The India points come from the 2025 amendment text, and the 2026 changes in Step 4 come from the text TRAI posted, which is marked “to be published in the Gazette”, and its press release. The WhatsApp Business app description rests on WhatsApp’s January 2018 launch post, so check its current pages. I have not covered statutory damages, Canada, short codes, RCS, the EU and UK data-protection consent standards, India’s data-protection law, or any country not named above. Prices are placeholders. The message bank, the launch sequence and the Example Co. cases are illustrative and fictional. This is general information, not legal, financial or medical advice.