Shopify Adds WhatsApp Consent at Checkout

This is the third WhatsApp release Shopify has shipped in six weeks and the second place a merchant can collect consent for the channel. It is also the highest-intent of the three collection points, because a customer who has just paid is further into a relationship with the brand than one who has typed an email address into a form.

The feature itself is a toggle. The decision behind it is not, and in the UK it is a lawful-basis question before it is a marketing one.

How it works

Shopify's changelog entry runs to three sentences and sets out three things. WhatsApp marketing consent can now be collected at checkout. The opt-in is captured when a customer makes a purchase. The feature is switched on from Checkout settings in the Shopify admin, where the rest of the customer contact information options already live.

What the announcement does not do is describe the mechanism, and that gap matters more than usual here. It does not say how the opt-in is presented to the shopper, whether it sits beside the existing email and SMS marketing opt-ins or stands on its own, how the consent record is stored against the customer, or which markets and plans have it. There is no rollout schedule. Nothing should be assumed from how the Shopify Forms version of the same consent behaves either, because a form and a checkout are different surfaces with different pressures on them. The only reliable check is your own Checkout settings.

The sequence around it is clearer than the detail inside it. Shopify brought WhatsApp marketing into Shopify Messaging on 29 July, added consent collection through Shopify Forms a week later on 6 August, and has now added checkout. We covered the first two when WhatsApp marketing campaigns arrived in Shopify Messaging. Read together, the three releases close a loop: somewhere to send from, a lawful way to build the list, and now the moment a customer is most likely to agree to being on it.

The consent question a UK merchant has to answer

Direct marketing by electronic mail to individuals in the UK is governed by the Privacy and Electronic Communications Regulations, and the ICO's guide to PECR is the reference point. PECR does not name individual apps, so the safe working assumption for a WhatsApp campaign is that it is held to the same standard as an email or a text message. Treating it more loosely than SMS is not a position worth defending to a regulator or to a customer.

Under PECR you need consent, and consent takes its meaning from the UK GDPR: freely given, specific, informed and unambiguous, given by a clear affirmative action. In practice that rules out a pre-ticked box, a permission folded into the terms and conditions a customer accepts in order to pay, and any arrangement where the order cannot be completed without agreeing to marketing. Consent also has to be specific to the channel and to your business. An email opt-in is not a WhatsApp opt-in, and a WhatsApp opt-in collected through Shopify Forms in August does not reach back and cover everyone who bought before it existed.

There is a narrower route that is worth understanding precisely because checkout is where it applies. The soft opt-in in PECR allows electronic mail marketing to someone whose contact details you obtained in the course of a sale or negotiations for a sale, provided you are marketing your own similar products or services, and provided you offer a simple way to refuse both at the point of collection and in every message afterwards. The ICO sets out the conditions in its guidance on electronic mail marketing. Checkout is exactly the context those conditions were written around, but they are conditions rather than a blanket permission, and an explicit opt-in is a stronger record to hold than a soft opt-in argument made after the fact.

The practical consequence is that the wording beside the checkbox is doing real work. It is not decoration and it is not a place to save space. If it does not name WhatsApp, name your business and make clear what the customer will receive, the consent record it produces is weaker than it looks.

Who this suits, and who it does not

A brand with genuine repeat purchase behaviour gets the most from it. Replenishment, restocks, limited drops, order-related prompts a customer actually wants: these are the messages that justify sitting in someone's personal messaging app beside their family and their friends. The permission is worth more than an email address and it is also easier to lose.

A considered purchase with a long gap between orders is a harder case. If a customer buys once every two years, a WhatsApp list built at checkout will be stale by the time you use it, and the first message after eighteen months of silence lands as an intrusion rather than an update. That merchant is better served putting the effort into the email programme it already has.

There is also a cost to the checkout itself. Checkout is the one page on a Shopify store where nothing should compete with completing the order. An extra opt-in is an extra decision, and on a phone it is another element between the customer and the pay button. That trade is defensible for a brand that will use the channel properly and hard to defend for a brand collecting a list it has no plan to send to. WhatsApp Business Platform messaging is priced per message, so a large and loosely targeted list is a cost line rather than an asset. The same principle runs through every digital marketing channel we run: earn the permission, then spend it carefully.

What this means for UK merchants

Start by looking. Open Checkout settings, establish whether WhatsApp marketing consent is available on your store, and read the opt-in exactly as a customer will see it before you switch anything on. If the wording is thin, that is a reason to wait rather than a detail to fix later, because every consent collected under weak wording is a record you may not be able to rely on.

Then keep the channels separate in your data. A customer who agreed to WhatsApp has not agreed to SMS, and the reverse is equally true. Segment on the consent you actually hold, keep a record of when and how each one was given, and make sure the opt-out works in every message you send, not just the first. Shopify holds the consent flags, but the discipline of only messaging the right segment sits with whoever runs the marketing.

Finally, decide the sending plan before you turn the collection on. A subscriber who opts in during an autumn order and hears nothing until a Black Friday blast has been collected, not earned. The channel rewards a small number of well-timed, genuinely useful messages and punishes volume faster than email does, because the reply button is right there and so is the block button. Where the opt-in sits in the checkout flow matters as much as the plan behind it, and that placement is a Shopify web design decision.

Practical considerations

Availability is the first caveat. Shopify published no rollout detail, so the setting being absent from your admin today does not mean it will be absent next week. Re-check rather than concluding the store is out of scope, and do not take a screenshot from another merchant's admin as evidence of what yours will look like.

The second is that Shopify keeps putting decisions of this weight behind a single admin switch. That is efficient, and it is also easy to leave unexamined for months; the same pattern applied when Shopify moved hreflang tag control into admin settings. Someone in the business has to own the toggle and the wording next to it, rather than treating both as a one-off configuration job.

The third is that a consent surface is not a marketing programme. Collecting opt-ins is the cheap part. Having something worth sending, at a cadence a customer would choose, is the part that decides whether this release is worth anything to your store at all.

FAQ