WhatsApp automation mistakes that get a number flagged

Numbers are rarely flagged for technical reasons. They are flagged because recipients blocked or reported the messages, and recipients do that in response to specific and recognisable things: a message they did not agree to, from a business they half-remember, about something they did not ask about, at a time they did not want it.

These are content and audience mistakes rather than engineering ones, which is why a technically correct implementation gets flagged while a simpler one does not.

What we'll cover

• The mistakes are about consent and content
• Opt-in that does not hold
• The list problems
• Building it with CodeWords
• Template category misuse
• Message patterns that produce blocks
• Identity and the half-remembered business
• Opt-out handled badly
• Getting opt-in that actually works
• Making it survive
• Limits worth knowing about
• What to fix first
• Frequently asked questions

The mistakes are about consent and content

Blocks drive the rating, and blocks are a human reaction to a specific message.

Nothing technical causes them. A correctly formatted message to somebody who did not want it is the problem.

The channel is personal in a way email is not, which raises the reaction to an unwanted message considerably.

Recipients treat it as intrusion rather than as marketing they can ignore.

So the fixes are editorial and operational, not architectural.

A simpler implementation sending wanted messages outperforms a sophisticated one sending unwanted ones, reliably.

Opt-in that does not hold

Consent must be for WhatsApp specifically, not a general marketing tick.

It must be for this kind of message. Agreeing to order updates is not agreeing to promotions.

A pre-ticked box is not consent and is invalid in several jurisdictions.

Buried in terms is not consent, practically or legally.

Record the wording and the date, since demonstrating consent means showing what was on the screen.

Consent ages. Somebody who opted in three years ago and has not interacted since is a block waiting to happen, whatever the record says.

The list problems

Purchased lists are the single fastest route to a restriction, without exception.

Scraped numbers from directories, groups or public listings, which people did not give you.

Your CRM's phone field is not an opt-in list, and treating it as one is common.

Old lists where the business relationship has ended.

Numbers from a different brand or a different market, which recipients do not connect to you.

Import from another channel — email subscribers, app users — is not consent for this one.

Building it with CodeWords

CodeWords connects to more than 3,000 integrations, and the connection is made once and reused.

1. Open CodeWords and start a new automation.
2. Describe what should happen in plain language to Cody, the automation builder: who is eligible, what is sent, and what stops a send.
3. Authorize the connections to your WhatsApp Business Platform account and to wherever consent is recorded.
4. Describe the exceptions: no recorded opt-in, an opt-out, consent older than your threshold, a segment that has never engaged.
5. Run it against your list and look at how many recipients are excluded before sending anything.

You describe the outcome; Cody builds it, connects it, and deploys it. The free plan covers light use, with Pro at $39 per month and Business at $100 per month as usage grows; details are on the pricing page.

Template category misuse

Categories are enforced and the content must match the one you submitted under.

Promotional content in a utility template is a common finding and a deliberate-looking one.

A "your order is ready" template carrying an offer is the classic example.

Authentication templates are narrow and using them for anything else is clearly visible.

Rejection is the better outcome here, since an approved template misused is worse than one that was refused.

Submit honestly, because the category also determines pricing and misuse looks like avoiding a cost as well as a rule.

Message patterns that produce blocks

Frequency above what the relationship supports, which is lower than most marketers assume on this channel.

Sending at unsocial hours in the recipient's timezone, which reads as intrusive rather than as automated.

Generic openings that could be from anybody, which is what prompts "who is this".

No clear reason for the message, particularly a first outbound one.

Long messages, which suit the channel badly and are frequently dismissed unread.

Repetition — the same message again because the first was not answered — which is the pattern that most reliably produces a block.

Identity and the half-remembered business

Recipients need to know who you are within the first line.

An unfamiliar number is treated as spam by default, which is the rational response.

Reference the relationship: the order, the booking, the enquiry, the thing that connects you.

A verified display name helps and is not enough on its own.

Newer relationships need more context, and a customer from two years ago needs more still.

If you have to explain why you have their number, that is a signal about whether you should be messaging them.

Opt-out handled badly

Every message needs a route out, clearly stated rather than implied.

Honour it immediately and across every automation, not just the one that sent the message.

A reply saying stop is an opt-out, however it is phrased, and requiring an exact keyword is both hostile and ineffective.

Do not confirm repeatedly or ask them to reconsider, which is the thing that converts an opt-out into a block.

Suppress permanently rather than for a period.

Report opt-outs by source, since a list or a form producing them is telling you where the consent problem is.

Getting opt-in that actually works

The teams with healthy ratings are usually not the ones with the best filtering. They are the ones whose opt-in produces people who wanted the messages.

Ask at a moment of intent — at checkout, at booking, when somebody asks a question — rather than in a general preferences screen.

Say what they will receive and roughly how often, since an unmet expectation is what produces the block rather than the message itself.

Let them choose the type. Order updates and promotions are different subscriptions and offering both separately keeps more people on at least one.

Confirm in the channel itself, which both validates the number and gives them an immediate way out.

Make the first message useful, because it sets the expectation for everything after it.

Do not incentivise the opt-in with a discount, which produces subscribers who wanted the discount and will block the next message.

Making it survive

Check consent at send time, not at import time, since consent can be withdrawn between the two.

Fail closed. If consent cannot be verified, do not send.

Suppress opt-outs globally and immediately.

Cap frequency across every automation contacting one person.

Report the outcome: eligible, excluded and why, sent, opted out, and blocks where visible.

Limits worth knowing about

You see the rating, not the blocks, in most cases, so the feedback is aggregate and delayed.

Consent requirements differ by jurisdiction, and some are stricter than Meta's own rules.

A provider does not validate your consent, and having one does not transfer the obligation.

Recovering a rating takes longer than damaging it, by a wide margin.

The channel punishes volume, which is the opposite of the instinct most marketing teams bring to it.

What to fix first

Run your intended audience against your consent records and look at how many are excluded. In most organisations doing this for the first time the answer is a large proportion, and that number is both the problem and the reason the restriction was going to happen.

Two habits make the difference. Check consent at send time rather than at import, since somebody who opted out last week is still in a list exported last month. And treat "would I want this message" as a real check rather than a rhetorical one, because it predicts the block rate better than anything else available and it is the question most easily skipped.

Frequently asked questions

Why do numbers actually get flagged?

Because recipients blocked or reported the messages. Nothing technical causes it — a correctly formatted message to somebody who did not want it is the problem, which is why the fixes are editorial and operational rather than architectural.

What counts as valid opt-in?

Consent for WhatsApp specifically and for that kind of message, actively given rather than pre-ticked or buried in terms, with the wording and date recorded. Consent also ages — somebody who opted in years ago and never interacted is a block waiting to happen.

Is my CRM's phone field an opt-in list?

No, and treating it as one is a common route to a restriction. Neither are email subscribers, app users, scraped numbers, or contacts from a different brand.

What is template category misuse?

Sending content that does not match the category you submitted under — promotional content in a utility template is the classic case. It affects pricing as well as policy, so it looks like avoiding a cost as well as a rule.

Which message pattern most reliably produces blocks?

Repetition — sending again because the first message was not answered. After that, unsocial hours in the recipient's timezone, generic openings that could be from anybody, and frequency above what the relationship supports.

How should opt-outs be handled?

Immediately, globally across every automation, permanently, and accepting any phrasing rather than requiring a keyword. Do not confirm repeatedly or ask them to reconsider, which converts an opt-out into a block.

Why does identity matter so much?

Because an unfamiliar number is treated as spam by default, which is a rational response. Reference the specific relationship — the order, the booking, the enquiry — within the first line.

When should consent be checked?

At send time rather than at import. Somebody who opted out last week is still present in a list exported last month, and that gap is a recurring source of complaints.

How often is too often on this channel?

Lower than most marketing teams assume. The channel is personal in a way email is not, so the tolerance for an unwanted message is much smaller and the reaction is a block rather than a deleted email.

Does a provider check my consent for me?

No. A Business Solution Provider routes your messages; it does not validate that you had permission to send them, and having one does not transfer the obligation.

How do I get opt-in that produces engaged recipients?

Ask at a moment of intent rather than in a preferences screen, say what they will receive and roughly how often, let them choose the message type, and make the first message useful since it sets the expectation for everything after.

Should I offer a discount for opting in?

It produces subscribers who wanted the discount rather than the messages, and they block the next one. The opt-in rate looks better and the quality rating does not.

Related reading

• The WhatsApp anti-ban playbook
• Why WhatsApp bots get banned
• WhatsApp data privacy for bot builders