The requirement, in Meta’s words
The rule is deliberately short, and it is about disclosure rather than about mechanism. Meta does not care whether the checkbox was on a website or a paper form; it cares that the person knew what they were agreeing to and who from.
- You have their phone number, given by them.
- The opt-in said they would receive messages.
- The opt-in named the business those messages come from.
- The collection complies with applicable law — which in India means the DPDP Act, not only Meta’s policy.
“Businesses must clearly communicate that a person is opting in to receive communication from the business, and the business’s name that a person is opting in to receive messages from.”
Where it can be collected
Any channel is acceptable. Meta explicitly permits opt-in gathered over SMS, on a website, through an interactive voice response flow, and on paper signed in person.
What matters is that the record survives the moment. An opt-in you cannot produce six months later is, for the purposes of an appeal, an opt-in you do not have.
Why this is the root cause of most restrictions
Enforcement is driven by how recipients react, and the single strongest predictor of a bad reaction is a message somebody did not ask for. A list bought, scraped or inherited produces blocks and reports at a rate no wording can rescue, and blocks and reports are what move a quality rating to red and an account into restriction.
This is why "we have their number" and "we have their consent" are different claims, and only the second one holds up.
Opting out has to work too
Consent is revocable, and Meta gives people a first-class way to revoke it. In this product that signal is honoured end to end: Meta’s own opt-out notification updates the contact, and the campaign worker skips anyone marked opted out — so an opt-out is not a note somebody has to remember, it is a state the sending path reads.
Auto-replies can act on opt-out language too, so a customer who replies STOP is recorded rather than argued with.