A customer who types STOP expects to be left alone, and from that moment the only thing deciding whether they are is your own sending system. The word carries no authority of its own: if nothing in your stack is listening for it, the reply lands in a shared inbox as ordinary text while the next campaign goes out on schedule. An opt-out is a state you have to store on the contact and check before every send. Treating it as a courtesy rather than a control is how a shop ends up with an annoyed customer and a damaged sender number on the same afternoon.
- One field, every send. In Keaz, being subscribed is the contact's opt-in level, and a flow's starting point can require a minimum level — so a single state decides who receives what.
- Two costs, not one. Ignoring an opt-out is a consent problem and a deliverability problem: Meta's documentation states that a business number whose quality rating has been Flagged for the last seven days has its messaging limit decreased by one level, immediately (Meta, WhatsApp Business Platform documentation, retrieved 24 August 2026).
- Three spellings, one meaning. STOP, Stopp and abmelden all say the same thing to a German-speaking customer, and your process has to read them the same way.
What does a customer mean when they send STOP?
They mean: stop sending me things. They are not distinguishing between the campaign that annoyed them and the shipping notification they still want, and they are not thinking about consent categories. The word is a blunt instrument because it is the only one the channel hands them.
That ambiguity is yours to resolve, and the safe reading is the broad one. Treat STOP as a withdrawal of marketing consent straight away, then ask once, in plain language, whether order updates should continue. Narrowing an opt-out on the customer's behalf without asking is the move that produces the complaint you were trying to avoid.
Where does an opt-out actually get recorded?
On the contact, or nowhere. A reply sitting unread in a shared inbox is not an opt-out; it is a message about one. Until the state changes on the contact record, every automation still considers that person eligible, because automations read the record and not the conversation.
This is the part shops get wrong when they move from a phone to a platform. On a handset, honouring STOP meant remembering not to message someone. On the WhatsApp Business Platform, flows fire on Shopify events with nobody watching, so the only thing standing between an opt-out and the next send is a field the flow checks. Our overview of the flows and growth tools a Shopify shop actually runs shows where that check sits in practice.
How does opting out work in Keaz?
There is no separate subscriber list to remove anyone from. Subscription status is the contact's opt-in level — a state stored on the contact and shown as a coloured badge in the contact details panel. Lower the level and the contact stops qualifying for anything that needs more consent than they now have.
A flow's starting point can require a minimum opt-in level as a filter, so only contacts at or above that level ever enter. Set it on every marketing flow rather than only the obvious ones — it is the single check that keeps sends clean as the contact base grows. How opt-in levels control subscribing and unsubscribing sets out what each level allows, and the Audience overview shows where opt-in status sits among everything else recorded on a contact.
Because consent is graded rather than binary, an opt-out does not have to be all or nothing. A customer who no longer wants campaigns can still sit at a level that permits the order confirmation they are waiting for — which is usually what they meant in the first place.
Why does ignoring an opt-out cost more than a complaint?
Because the people you annoy report you, and the platform keeps score. WhatsApp assigns your business number a quality rating, and Meta's documentation states that if a business phone number's quality rating has been set to Flagged for the last seven days, WhatsApp will decrease its messaging limit by one level, immediately (Meta, WhatsApp Business Platform documentation, retrieved 24 August 2026).
It escalates from there. Meta's policy-enforcement documentation states that repeated violations lead to messaging restrictions that gradually increase in duration, with review requests going through Business Support Home (retrieved 24 August 2026). So the real price of messaging people who asked you to stop is not counted in unsubscribes — it is counted in how many of your remaining customers you are still allowed to reach. What a restricted account means and what to do about it covers the end of that road. Platform limits and rules change without announcement, so our reference page on Meta's platform rules, dated and sourced, is where the current numbers live.
What does the GDPR expect when someone withdraws consent?
The principle is short: withdrawing consent must be as easy as giving it. If joining took one tap, leaving cannot take an email to support and a three-day wait. That sits in the General Data Protection Regulation itself (Regulation (EU) 2016/679, EUR-Lex, 2016, retrieved 27 October 2026).
Two practical consequences follow. The withdrawal has to take effect without the customer having to justify it, and you have to be able to show when it happened — the same record you keep for the opt-in, read backwards. Our guide to collecting WhatsApp opt-ins the GDPR-compliant way covers the collection side; the opt-out is that same record with an end date on it. These are principles — how they apply to your shop is a question for your own counsel.
How do you set this up so it keeps working?
- Decide what STOP means for your shop before anyone sends it: which level the contact drops to, and whether transactional messages continue.
- Write the exit into the message. Every marketing template should say how to stop, in the language the customer is reading.
- Plan for the variants. STOP, Stopp, abmelden, unsubscribe and a plain "please no more" all arrive; anything that recognises only one of them will miss most of them.
- Put the opt-in filter on every marketing flow's starting point, not just the newsletter. A forgotten flow is how an opted-out contact gets messaged six weeks later.
- Check the record, not the inbox. Once a month, confirm that the contacts who asked to leave actually sit below your marketing threshold.
Common mistakes
- Reading STOP as feedback. It is an instruction, and the clock starts when it arrives, not when somebody gets round to the inbox.
- Honouring it in the conversation but never on the contact. The flow reads the contact.
- Handling only the English word on a German-speaking list.
- Asking the customer to confirm twice. A confirmation step on the way out, when joining took one tap, is exactly the asymmetry the GDPR principle is about.
- Silently cutting order updates too. Someone who stopped the campaigns still wants to know where their parcel is.
- Treating a falling quality rating as a platform glitch. It is usually the list telling you something about how you are sending.
An opt-out is a state, not a gesture. Store it on the contact, check it at the starting point of every flow, and make leaving as cheap as joining was — then the customer who typed STOP stops being a risk to the number you reach everybody else with.
See what WhatsApp would be worth for your shop before you build the opt-in and opt-out design around it — the size of the prize decides how much effort that design deserves.
This is a summary rather than legal advice. Have your own counsel review how it applies to your shop.
Frequently asked questions
Does replying STOP automatically unsubscribe someone on WhatsApp?
Should an opt-out stop order updates as well?
What happens if we keep sending after an opt-out?
How fast does an opt-out have to take effect?
Where do I see whether a contact is still subscribed?
Nils Spölgen
Founder at Keaz. Serial founder in chat marketing — built a local agency into Keaz, the WhatsApp marketing platform for Shopify. Bootstrapped the MVP, raised funding, and scaled to 200+ merchants in DACH. Writes about flows, opt-in & GDPR, Klaviyo, and realistic revenue benchmarks — prefers conservative math over impressive claims. View profile
