Skip to content
Omni Octo Docs

PDPA notice on WhatsApp

Download .md

Some businesses must tell a person how their data is used the first time they make contact: a clinic’s PDPA notice, say. An AI agent can send your notice on WhatsApp, once per number, word for word, and Omni Octo keeps a record of what each number was shown and when.

Omni Octo records; it does not advise. The notice is your text, and whether it is enough under the PDPA (or any other law) is for you and your advisers to decide. “Consent deemed given” below is a record of what happened, not a legal finding.

You need: an API key to read the record. Every field: Contacts reference.

Switch the notice on

Section titled “Switch the notice on”

In the dashboard, open the agent and find WhatsApp first-contact notice, or ask Octo (“send this PDPA notice to everyone who messages the clinic on WhatsApp: …”). Write the notice in your own words, up to 1,000 characters; there is no default text. Then choose:

  • How it is sent: as its own message just before the agent’s first reply (the default), or at the start of that reply, so one message goes out instead of two.
  • When consent is deemed given: when the person writes again after the notice (the default), or as soon as the notice is sent.

A number gets the notice the first time it writes to that agent after you switch it on, including people who wrote before. It is sent once: two messages arriving together still get one notice. It is never sent to a number that opted out, in reply to STOP or START, or for history imported from the WhatsApp Business App. When a person in your team has taken the conversation over, the agent does not answer, and no notice goes out either.

Changing the text starts a new version. People who already saw an earlier version are not sent the new one, and each record keeps the exact text that person was shown.

Read the record

Section titled “Read the record”

The contact carries its latest consent event, and the history is one call away:

Terminal window
curl https://api.omniocto.com/v1/contacts/ct-00000000a1/consent-events \
  -H "Authorization: Bearer $OMNI_OCTO_API_KEY"
{ "object": "list", "has_more": false, "next_cursor": null,
  "data": [
    { "id": "00000000-0000-4000-8000-000000000042", "object": "consent_event",
      "channel": "whatsapp", "address": "+6591234567",
      "kind": "deemed_given", "basis": "first_contact_notice", "status": "deemed_given",
      "delivery_status": null, "agent": "ag-00000000b2", "notice_version": 2,
      "notice_text": "Clinic X collects your name and number to answer you, under the PDPA. Reply to continue, or STOP to opt out.",
      "notice_sha256": "4f1c…", "note": null, "source": "webhook",
      "occurred_at": "2026-10-31T09:01:12.000Z" },
    { "id": "00000000-0000-4000-8000-000000000041", "object": "consent_event",
      "channel": "whatsapp", "address": "+6591234567",
      "kind": "notice_shown", "basis": "first_contact_notice", "status": "notice_shown",
      "delivery_status": "sent", "agent": "ag-00000000b2", "notice_version": 2,
      "notice_text": "Clinic X collects your name and number to answer you, under the PDPA. Reply to continue, or STOP to opt out.",
      "notice_sha256": "4f1c…", "note": null, "source": "webhook",
      "occurred_at": "2026-10-31T09:00:03.000Z" }
  ] }

GET /v1/contacts/{id} has consent (the latest event across the contact’s numbers and emails, or null) and consents (the latest of each). The statuses:

statusMeans
notice_shownThe notice went out.
notice_unconfirmedWhatsApp did not confirm the send. It is never sent again on its own.
deemed_givenThe person wrote again after the notice (or the notice went out, if you chose that).
withdrawnThe person sent STOP, or someone recorded a withdrawal.
restoredThe person sent START after a STOP.
recordedSomeone recorded consent by hand.

The contacts CSV export has the same latest event in consent_status, consent_at and consent_notice_version.

Section titled “Record consent by hand”

Consent from elsewhere (a signed form, a phone call) can be added to the record:

Terminal window
curl -X POST https://api.omniocto.com/v1/contacts/ct-00000000a1/consent-events \
  -H "Authorization: Bearer $OMNI_OCTO_API_KEY" -H "Content-Type: application/json" \
  -d '{ "kind": "recorded_by_operator", "channel": "whatsapp", "note": "Signed the clinic paper form" }'

kind is recorded_by_operator or withdrawn. A withdrawal recorded here also opts the contact out of that channel, the same as POST /v1/contacts/{id}/dnc (every number, or every email, of the contact; see Opt-outs), and both are saved together or not at all. Opting back in stays a separate step: a person’s own STOP is cleared only by their START.

Section titled “Consent is not a send rule”

Opt-outs decide what may be sent, as before. A STOP opts the number out and adds withdrawn to its record; a START opts it back in and adds restored. A number with no consent record can still be messaged within WhatsApp’s own rules.