# PDPA notice on WhatsApp

> Send your own first-contact notice (a PDPA notice, say) once to every WhatsApp number that writes to your agent, and read the consent record it leaves with /v1/contacts.

Some businesses must tell a person how their data is used the first time
they make contact: a clinic's PDPA notice, say. An AI agent can send your
notice on WhatsApp, once per number, word for word, and Omni Octo keeps a
record of what each number was shown and when.

**Omni Octo records; it does not advise.** The notice is your text, and
whether it is enough under the PDPA (or any other law) is for you and your
advisers to decide. "Consent deemed given" below is a record of what
happened, not a legal finding.

**You need:** an [API key](/getting-started/api-keys/) to read the record.
Every field: [Contacts reference](/platform-api/reference/contacts/).

## Switch the notice on

In the dashboard, open the agent and find **WhatsApp first-contact
notice**, or ask Octo ("send this PDPA notice to everyone who messages the
clinic on WhatsApp: …"). Write the notice in your own words, up to 1,000
characters; there is no default text. Then choose:

- **How it is sent:** as its own message just before the agent's first
  reply (the default), or at the start of that reply, so one message goes
  out instead of two.
- **When consent is deemed given:** when the person writes again after the
  notice (the default), or as soon as the notice is sent.

A number gets the notice the first time it writes to that agent after you
switch it on, including people who wrote before. It is sent once: two
messages arriving together still get one notice. It is never sent to a
number that opted out, in reply to STOP or START, or for history imported
from the WhatsApp Business App. When a person in your team has taken the
conversation over, the agent does not answer, and no notice goes out either.

Changing the text starts a new version. People who already saw an earlier
version are not sent the new one, and each record keeps the exact text that
person was shown.

## Read the record

The contact carries its latest consent event, and the history is one call
away:

```bash
curl https://api.omniocto.com/v1/contacts/ct-00000000a1/consent-events \
  -H "Authorization: Bearer $OMNI_OCTO_API_KEY"
```

```json
{ "object": "list", "has_more": false, "next_cursor": null,
  "data": [
    { "id": "00000000-0000-4000-8000-000000000042", "object": "consent_event",
      "channel": "whatsapp", "address": "+6591234567",
      "kind": "deemed_given", "basis": "first_contact_notice", "status": "deemed_given",
      "delivery_status": null, "agent": "ag-00000000b2", "notice_version": 2,
      "notice_text": "Clinic X collects your name and number to answer you, under the PDPA. Reply to continue, or STOP to opt out.",
      "notice_sha256": "4f1c…", "note": null, "source": "webhook",
      "occurred_at": "2026-10-31T09:01:12.000Z" },
    { "id": "00000000-0000-4000-8000-000000000041", "object": "consent_event",
      "channel": "whatsapp", "address": "+6591234567",
      "kind": "notice_shown", "basis": "first_contact_notice", "status": "notice_shown",
      "delivery_status": "sent", "agent": "ag-00000000b2", "notice_version": 2,
      "notice_text": "Clinic X collects your name and number to answer you, under the PDPA. Reply to continue, or STOP to opt out.",
      "notice_sha256": "4f1c…", "note": null, "source": "webhook",
      "occurred_at": "2026-10-31T09:00:03.000Z" }
  ] }
```

`GET /v1/contacts/{id}` has `consent` (the latest event across the contact's
numbers and emails, or `null`) and `consents` (the latest of each). The
statuses:

| `status` | Means |
| --- | --- |
| `notice_shown` | The notice went out. |
| `notice_unconfirmed` | WhatsApp did not confirm the send. It is never sent again on its own. |
| `deemed_given` | The person wrote again after the notice (or the notice went out, if you chose that). |
| `withdrawn` | The person sent STOP, or someone recorded a withdrawal. |
| `restored` | The person sent START after a STOP. |
| `recorded` | Someone recorded consent by hand. |

The contacts CSV export has the same latest event in `consent_status`,
`consent_at` and `consent_notice_version`.

## Record consent by hand

Consent from elsewhere (a signed form, a phone call) can be added to the
record:

```bash
curl -X POST https://api.omniocto.com/v1/contacts/ct-00000000a1/consent-events \
  -H "Authorization: Bearer $OMNI_OCTO_API_KEY" -H "Content-Type: application/json" \
  -d '{ "kind": "recorded_by_operator", "channel": "whatsapp", "note": "Signed the clinic paper form" }'
```

`kind` is `recorded_by_operator` or `withdrawn`. A withdrawal recorded here
also opts the contact out of that channel, the same as
`POST /v1/contacts/{id}/dnc` (every number, or every email, of the contact;
see [Opt-outs](/platform-api/contacts/#opt-outs)), and both are saved
together or not at all. Opting back in stays a separate step: a person's own
STOP is cleared only by their START.

## Consent is not a send rule

Opt-outs decide what may be sent, as before. A STOP opts the number out and
adds `withdrawn` to its record; a START opts it back in and adds `restored`.
A number with no consent record can still be messaged within WhatsApp's own
rules.