Opt-in and double opt-in: how to ask for permission well (and be able to prove it) in Panama
Permission is the basis of every legal send, but capturing it badly is the number-one cause of bans and fines. Single vs double opt-in, what makes consent valid, how to ask for it per channel and how to keep the proof.
Our Law 81 guide explains why you need permission before sending: the law requires prior, informed, unambiguous and, above all, traceable consent. This guide explains the how: where and in what way to capture that permission so it’s valid and so that, the day someone questions it, you can prove it. Because most WhatsApp bans and deliverability problems don’t come from sending a lot: they come from sending to someone who never gave clean permission.
This is general information, not legal advice. For your specific case, consult a professional.
Single vs double opt-in
There are two ways to capture permission:
- Single opt-in: the person leaves their details in a form and is subscribed immediately. It converts better and grows faster, but it opens the door to mistyped numbers, bots and people who barely remember signing up.
- Double opt-in: after leaving their details, the person confirms through a second step — a click in a confirmation email, or a “YES” by message. Only then do they join your list.
Double opt-in adds friction, yes, but it gives you the most valuable thing: a dated, timestamped record that this person really asked to hear from you. It’s the cleanest proof there is.
When double opt-in is worth it
Double opt-in isn’t legally mandatory in most cases (not even Meta requires it for WhatsApp). It’s a best practice. But there are situations where it more than pays off:
- When you capture at scale or from cold sources: lead-gen forms, contests, downloads in exchange for the email.
- When your capture point is ambiguous — for example, a single box that mixes email, SMS and WhatsApp.
- And, key in Panama: when you want your consent to be traceable as Law 81 requires. The confirmation email or message is, literally, your proof, sealed with a date.
What makes a permission valid
Whatever the channel: a permission is valid when it meets these.
- It’s an affirmative action. The person does something active — ticks a box, replies to a message. A pre-ticked box or silence doesn’t count.
- It names you. It’s clear the permission is for your company, by name.
- It says what they’ll receive and where. “Offers and news by WhatsApp”, not a generic “I accept communications”.
- It sets frequency expectations. “Up to 4 messages a month” lowers opt-outs and complaints.
- It links your privacy policy and makes clear how to unsubscribe from the very start.
One permission per channel (not one for all)
The most expensive mistake: thinking one permission covers all three channels. No. An email opt-in is not an SMS opt-in, and neither is a WhatsApp opt-in. Someone receiving your newsletter doesn’t authorise you to write to their phone.
The right way is separate boxes (not a single one that groups everything), one per channel, each with its own affirmative action. That way, too, you respect the person’s right to choose where they want — or don’t want — to hear from you.
How to ask on each channel
Email. In short, the person is subscribed when they submit the form. In double opt-in, they get a “Confirm your subscription” email with a button; the link should expire in 24-48 hours, and anyone who doesn’t confirm within 30-60 days, you remove (you can’t send to them anyway).
WhatsApp. Here Meta is strict and the burden of proof falls entirely on you. You need a valid opt-in: an active action, that names you and that clearly says they’ll receive WhatsApp messages from you. Good news: you can capture it anywhere — your site, the checkout, the physical store, a QR code, an SMS — it doesn’t have to be inside WhatsApp. And a point almost everyone misreads: a customer writing to you first (or clicking an ad) opens a conversation, but isn’t marketing permission. The channel details are in our bulk WhatsApp guide.
SMS. You need consent before the first message. In double opt-in, the person replies “YES” to a confirmation message. There’s implied consent only when the customer writes to you first, and only to reply to that — not to send them promotions. Transactional messages (a confirmation, a code) are another matter; marketing always needs explicit permission. More on the channel in the bulk SMS guide.
Keep it: no proof, no permission
Capturing the permission is half; the other half is being able to demonstrate it. For each contact, store with date and time: where the permission came from (the source), how it was obtained (the method), the exact text they accepted and the confirmation. That’s what makes your consent “traceable”, and what saves you if someone questions it or if the ANTAI asks. A good consent record is as important as the permission itself.
Mistakes that cost dearly
- A pre-ticked box or “default” consent: not valid.
- A single box for email, SMS and WhatsApp at once.
- Treating an incoming message or an ad click as marketing permission.
- Assuming your email subscribers are already SMS or WhatsApp ones.
- Buying lists: they have no permission or interest, and burn your domain in a single send (we cover it in why not to buy databases).
And remember: a good opt-in also saves you cleaning later. A double opt-in filters out fake emails and bots up front, so your list is born healthy — it’s the first step of list hygiene.
In Panama: how we solve it
Setting up forms with per-channel boxes, double opt-in where it makes sense, well-written consent texts and, above all, the traceable record Law 81 requires is part of what we leave sorted. We don’t just hand you the sending: we leave the permission well asked for and well kept, so you grow your list without piling up risk.
Not sure your current permissions would hold up to a review? Start with the free check: we review how you capture and store consent, and what to adjust to send with peace of mind.