Indonesia PDP Law Consent Wording for Forms, WhatsApp, Checkout

In almost every marketing database audit we ran this year, one question had no answer: when, and on which page, did this customer agree to receive broadcasts? Article 24 of Indonesia’s PDP Law requires the controller to show that proof. Without it, for practical purposes you have no consent. That gap is where most Indonesia PDP Law consent problems start.

October 17 marks two years since the transition period of Law No. 27 of 2022 on Personal Data Protection (Indonesia’s PDP Law, or UU PDP) ended (Article 74).¹ Three months later, on January 16, 2027, its implementing regulation, Government Regulation (PP) No. 33 of 2026, takes effect.² On the ground, the pattern hasn’t changed: consent copy lifted from a foreign template, a pre-ticked marketing box, and no evidence log at all.

Below is wording your product and CRM teams can ship for forms, WhatsApp and checkout, plus a consent log schema, the board-level math and a checklist for legal.

Important: this is not legal advice. We are marketing practitioners, not lawyers. The article references come from the text of Law No. 27 of 2022, but how they apply to your business needs review by counsel, especially if you process health, financial or children’s data.

---

Quick Summary

• Marketing consent has to be explicit, separate from the terms of the transaction, and provable (Articles 20, 22 and 24). PP 33/2026 sets the standard: freely given, informed, specific and unambiguous.
• Order data needs no checkbox, because the lawful basis is performance of a contract (Article 20(2)(b)). Promotions, profiling and sharing beyond the order need consent.
• WhatsApp opt-in carries two layers of obligation: UU PDP and the WhatsApp Business Messaging Policy.
• Consent withdrawal must be executed within 3 x 24 hours (Article 40).
• The administrative fine ceiling is 2% of annual revenue (Article 57(3)). For a brand doing Rp36 billion a year, the reference point is Rp720 million. The actual amount depends on the variables set in PP 33/2026.

---

The Three Lawful Bases Teams Mix Up Most

Article 20(2) lists six lawful bases for processing. Three are relevant to marketing:

Activity	Sensible lawful basis	Checkbox needed?
Name, address and phone number to ship the order	Performance of a contract (point b)	No, a privacy notice is enough
WhatsApp promo broadcasts, email newsletter	Explicit consent (point a)	Yes, separate and unticked
Uploading your customer list to Meta Custom Audiences or Google Customer Match	Explicit consent (point a)	Yes, and name it specifically
Keeping transaction logs for tax	Legal obligation (point c)	No

The third row is the one that gets missed. Matching your customer database against ad platform data counts as combining data sets, a high-risk processing criterion that triggers an impact assessment (Article 34(2)). If your performance team uploads CSVs of phone numbers to Ads Manager, your consent wording has to say so.

Article 21(1) sets the minimum content of a consent request, including the lawful basis, purpose, data type, retention period and the data subject’s rights. The templates below are built from that list, and your Privacy Policy covers the rest. On a bilingual site, provide a Bahasa Indonesia version and make it the reference text. Article 22(4) of the PDP Law asks for plain, clear language, and for agreements, Article 31 of Law No. 24 of 2009 requires Bahasa Indonesia.³ Treat the English below as companion copy.

---

Template 1: Indonesia PDP Law Consent Wording for Website Forms

One notice paragraph for the primary purpose, then a separate checkbox for each additional purpose (Article 22(4)).

[Text under the Submit button]
We use the details you enter (name, WhatsApp number, email and message)
to respond to this request, and we keep them for no longer than 12 months.
PT [Company Name] is the controller of this data. Read our Privacy Policy
for your rights, including access, correction and deletion.

[ ] I agree to receive product news, promotions and content from
    [Brand Name] via WhatsApp and email, at most 4 messages a month.
    This data is kept for promotions while I am subscribed, and for no
    more than 24 months after my last interaction. I can stop at any
    time by replying STOP or clicking "unsubscribe".

[ ] I agree that my phone number and email may be converted to a hash
    (a scrambled code) and matched against user data at Meta and Google
    to show me more relevant ads. This consent lasts until I withdraw
    it, and I can withdraw it at any time.

Both boxes are empty by default, and the form submits with neither ticked. A form that won’t submit until the marketing box is ticked no longer offers a free choice, and that consent is hard to defend.

---

Template 2: WhatsApp Opt-in

WhatsApp has its own rulebook. The WhatsApp Business Messaging Policy only lets you contact people who gave you their number and opted in, and it requires a clear way to stop.⁴ Meta’s documentation adds that the opt-in must state clearly that the person agrees to receive messages from your business, and must name your business.⁵

a. Checkbox on the website before the “Chat on WhatsApp” button

[ ] I agree to receive product news and promotions from [Brand Name] on
    WhatsApp at my number, at most 4 messages a month. My number is kept
    for promotions while I am subscribed, and for no more than 24 months
    after my last interaction. Reply STOP at any time to opt out.

We will still send order updates to this WhatsApp number while your order
is in progress.

Order updates don’t need this box because they are part of the transaction. Folding them into the promo checkbox is the bundling Article 22(4) rules out.

b. First confirmation message (double opt-in) for contacts from click-to-WhatsApp ads or in-store QR codes

Hi [Name], thanks for reaching out to [Brand Name].

May we send you new product news and customer-only promos on this
WhatsApp chat, at most 4 messages a month?

Reply YES to agree.
Reply NO if you only want an answer to this question.

We handle your data in line with our Privacy Policy: [short link]

What you send after the YES can borrow the pattern in our welcome email sequence for online stores.

c. Auto-reply when a customer withdraws consent

Got it. We've removed this number from [Brand Name]'s promo list, so you
won't get any more promotions from us. You'll still get messages about
any order in progress. Changed your mind? Just reply START.

Technically, don’t delete the number. Move it to a suppression list and write a withdrawn row in the log, so the next CSV import doesn’t add it back.

Article 21 doesn’t require a 4-a-month cap. We add it anyway: it narrows the scope of consent, makes it easier to defend, and keeps block rates down. Meta tracks a quality rating from block and report signals, and poor quality can lead to restrictions.⁶⁴ Labels and segmentation are covered in our WhatsApp Business CRM guide, broadcast content in our guide to broadcast marketing on WhatsApp.

---

Template 3: Checkout

Checkout is the most effective place to collect new consent, and the place where purposes get blended most often.

[Notice block above the Pay button]
By continuing, your data (name, address, phone number, email and order
details) will be processed to fulfill this order, including sharing it
with the payment partner and courier shown. We keep transaction data as
required by tax regulations. Details in our Privacy Policy.

[ ] Send me promotions and product picks from [Brand Name] via WhatsApp
    and email, at most 4 a month. Data for promotions is kept while I am
    subscribed, and for no more than 24 months after my last interaction.
    (Optional. Reply STOP on WhatsApp or click unsubscribe in any email.)

[ ] Save my details for faster checkout next time.
    (Optional. Delete anytime from the Account page.)

For beauty brands, watch the “skin type and concerns” quiz before checkout. Skin conditions tied to medical complaints can count as health data, which is specific personal data (Article 4(2)).¹ Give it its own checkbox:

[ ] I agree that the skin condition information I provide may be used to
    recommend products and stored in my account for 24 months.

Article 25 requires parental or guardian consent for children’s data. The PDP Law does not set an age, and common practice follows the Child Protection Law (under 18).⁷ If your customers may be minors, ask for age first and hide the marketing checkbox from anyone under 18. You lose the teen segment from your promo list. The alternative, a parental consent flow, costs more and is harder to prove.

---

Consent Evidence Log: Minimum Schema

When a regulator asks or a customer complains, what they want to see is the log, not the wording. Article 22(1) requires consent to be written or recorded, and Article 24 requires you to demonstrate it. The schema we ask developers to build:

Column	Example value	Why it matters
contact_id	hash of the phone number	Links to the CRM without storing raw numbers in the log
purpose	marketing, ads_matching, skin_profile	One row per purpose, not one row per person
channels	wa,email	The promo channels named in the wording the customer agreed to
status	granted / withdrawn	Keep the history, never overwrite
source	consultation_form, checkout, wa_double_optin	Proves the entry point
wording_version	consent-v3-2026-10	Wording changes, so the proof must point to the version the customer saw
timestamp	ISO 8601 with time zone	The clock for the 3 x 24 hour deadline
evidence	form submission ID, ID of the WA “YES” message	Retrievable proof when someone asks

wording_version is the column teams forget. Article 21(2) requires changes to be communicated before they take effect, and without a version you cannot prove which customer agreed to which wording.

Consent status also needs to reach your GA4 and Ads tags through Consent Mode,⁸ and how that feeds attribution reporting is covered in our GA4, UTM and attribution guide.

---

Worked Example: A Premium Skincare Brand in South Jakarta

This illustration is built from patterns we have seen, with simplified numbers. A direct-to-consumer skincare brand with Rp36 billion in annual revenue, about Rp1.8 billion of it from WhatsApp broadcasts, at a 60% contribution margin (an assumption; use your own).

Their WhatsApp database holds 85,000 numbers, collected over four years from Instagram giveaways, marketplace buyer exports and reseller lists. After matching against form logs and chat history, only 22,000 numbers have proof of opt-in.

Step 1: fine exposure

Administrative fine ceiling = 2% x annual revenue
                            = 2% x Rp36,000,000,000
                            = Rp720,000,000

This is the ceiling, the number to set against the cost of the fix in a board discussion. How a fine below that ceiling is calculated is now set out in PP No. 33 of 2026 (effective January 16, 2027), using variables such as impact, duration, number of data subjects affected, business scale and whether the controller cooperated during inspection. A fine can even be reduced to Rp0.² A clean evidence log puts you in a much better position on every one of those variables.

Step 2: operational exposure

Meta usually gets there before a regulator does: an account restricted over heavy blocks means a Rp1.8 billion channel goes quiet. On the other side, voucher code attribution showed the 63,000 unproven numbers brought in only about Rp160 million a year.

WA margin per day              = Rp1,800,000,000 x 60% / 365 = Rp2,958,904
14-day account restriction     = about Rp41,400,000 margin per incident
                                 (illustrative assumption)
Margin from unproven contacts  = Rp160,000,000 x 60% = Rp96,000,000 a year
Remediation cost (forms, log, double opt-in, legal review)
                               = est. Rp45,000,000–70,000,000

Step 3: rebuild the list through checkout, then compare

Of 30,000 buyers in the past 12 months, assume 35% tick the box at checkout (measure your own rate after two weeks): about 10,500 opt-ins, of which only 3,000 are not already among the 22,000 proven contacts.

Gross first-year cost     = Rp96,000,000 + max. Rp70,000,000
                          = Rp166,000,000
New-contact contribution  = 3,000 x Rp74,545 a year per proven contact
                            ((Rp1.8B - Rp160M) / 22,000)
                            x 50% (active for half the year on average)
                            x 60% margin = about Rp67,100,000
Net first-year cost       = about Rp98,900,000

(a) Likely case: break-even
    Rp98,900,000 / Rp2,958,904 = about 33.4 days of the channel
    offline per year

(b) Worst case (tail, do not add to a):
    fine of up to Rp720,000,000 (actual amount set by the PP 33/2026
    variables)
    + number permanently banned: up to Rp1,080,000,000 margin a year

A single 14-day restriction already covers about 42% of the net cost. If you expect the current list to keep the channel offline for more than 33 days a year, the fix pays for itself on operations alone. A permanent ban or an administrative sanction makes the comparison lopsided.

This math breaks if your unproven contacts are still buying actively. Then run a re-permission campaign through legitimate channels (a QR card in the parcel, transactional email) before you cut the list.

---

Risk Checklist for Your Legal Review

#	Check	Reference	Risk level
1	Marketing checkbox is empty by default and not mandatory (best practice)	Article 20(2)(a) in conjunction with Article 22(1) (interpretation: explicit consent)	High
2	Marketing consent is separate from transaction terms	Article 22(4), Article 23	High
3	Each purpose has its own consent, with promo channels named explicitly	Article 21(1)	High
4	Evidence log per purpose, with wording version and timestamp	Article 22(1), Article 24	High
5	STOP and unsubscribe reach the suppression list in under 3 x 24 hours	Article 9, Article 40	High
6	No numbers from marketplace exports or bought lists in broadcasts	Article 16(2), WhatsApp policy	High
7	Health data and children’s data have a dedicated consent flow	Article 4(2), Article 25	High
8	Impact assessment before large-scale ad matching and health data processing	Article 34(2)(b) and (e)	Medium (High if specific data is involved)
9	Retention is stated in the consent wording and actually enforced	Article 21(1)(d)	Medium
10	A 3 x 24 hour breach notification procedure exists and has an owner	Article 46	Medium
11	Changes to consent wording are communicated before they take effect	Article 21(2)	Medium
12	Access to the WA database and CRM is restricted by role (see also why security is non-negotiable)	Article 35, Article 39	Medium

PP 33/2026 takes effect on January 16, 2027, and the PDP Agency may add technical detail. Ask counsel to map this checklist to that regulation.

---

If You Want the Audit Done for You

Writing the wording takes an afternoon. Mapping the data collection points piled up over the years (old forms, forgotten landing pages, third-party WhatsApp widgets, CSVs on team laptops) takes longer. Eranya Digital maps those points, deploys auditable consent forms and logs without breaking GA4 attribution, and hands you a document ready for your legal team before January 16, 2027: book a consent audit session.

---

References

---

<script type="application/ld+json">
[
  {
    "@context": "https://schema.org",
    "@type": "Article",
    "headline": "Indonesia PDP Law Consent Wording for Forms, WhatsApp, Checkout",
    "description": "Copy-paste Indonesia PDP Law consent wording for web forms, WhatsApp opt-in and checkout, plus a consent evidence log, fine math and a risk checklist for legal.",
    "image": "https://eranya.digital/images/blog/ssl-https-security.webp",
    "author": {"@type": "Organization", "name": "Eranya Digital", "url": "https://eranya.digital"},
    "publisher": {"@type": "Organization", "name": "PT Eranya Digital Nusantara", "logo": {"@type": "ImageObject", "url": "https://eranya.digital/images/logo.png"}},
    "datePublished": "2026-10-15",
    "dateModified": "2026-10-15",
    "mainEntityOfPage": {"@type": "WebPage", "@id": "https://eranya.digital/blog/customer-consent-pdp-law/"},
    "inLanguage": "en-US",
    "keywords": ["indonesia pdp law consent", "pdp law consent", "indonesia pdp law consent wording", "pdp law consent wording example", "whatsapp opt-in indonesia", "marketing consent checkbox", "proof of consent law 27 2022"],
    "articleSection": "Strategi"
  },
  {
    "@context": "https://schema.org",
    "@type": "FAQPage",
    "mainEntity": [
      {"@type": "Question", "name": "What does PDP Law-compliant consent wording look like?", "acceptedAnswer": {"@type": "Answer", "text": "An example for a promotions checkbox: 'I agree to receive product news, promotions and content from [Brand Name] via WhatsApp and email, at most 4 messages a month. This data is kept for promotions while I am subscribed, and for no more than 24 months after my last interaction. I can stop at any time by replying STOP or clicking unsubscribe.' Pair it with a separate notice stating the data collected, retention period, controller name and the customer's rights. Together they cover most of the minimum content of Article 21(1) of Law No. 27 of 2022, and your Privacy Policy fills in the lawful basis and remaining detail. The box must be empty by default, separate from the transaction terms, and every tick recorded in an evidence log as Article 24 requires."}},
      {"@type": "Question", "name": "Can I send WhatsApp broadcasts to buyers whose numbers came from a marketplace?", "acceptedAnswer": {"@type": "Answer", "text": "This is a high-risk area. Those numbers were collected by the marketplace to deliver an order, so using them for your own promotions collides with the purpose limitation principle in Article 16(2). WhatsApp's Business Messaging Policy also requires opt-in from the recipient before you message them. Re-collect consent through your own channels, such as a QR card inside the parcel."}},
      {"@type": "Question", "name": "What is the maximum fine for a company under Indonesia's PDP Law?", "acceptedAnswer": {"@type": "Answer", "text": "Article 57(3) sets the administrative fine at a maximum of 2 percent of annual revenue or receipts, measured against the violation variable. Government Regulation (PP) No. 33 of 2026, effective January 16, 2027, sets out how the amount is calculated, weighing factors such as impact, duration, number of data subjects affected, business scale and the controller's cooperation during inspection. Other administrative sanctions include written warnings, temporary suspension of processing and deletion of data. For specific criminal offenses, Article 67 provides for imprisonment and fines of up to billions of rupiah, and Article 70 allows corporate fines of up to 10 times the individual amount."}},
      {"@type": "Question", "name": "How fast must you stop processing after a customer withdraws consent?", "acceptedAnswer": {"@type": "Answer", "text": "Article 40 requires the controller to stop processing no later than 3 x 24 hours after receiving the withdrawal request. In practice, a STOP reply on WhatsApp or an unsubscribe click in email has to hit your suppression list the same day. The CRM team's monthly clean-up is too slow."}}
    ]
  }
]
</script>

Footnotes

1. Republic of Indonesia. Law No. 27 of 2022 on Personal Data Protection (Undang-Undang Nomor 27 Tahun 2022 tentang Pelindungan Data Pribadi). peraturan.bpk.go.id. Full text, including Articles 4, 9, 16, 20–25, 34, 35, 39, 40, 46, 57, 67, 70 and 74. ↩ ↩²

2. Republic of Indonesia. Government Regulation No. 33 of 2026 on the Implementation of Law No. 27 of 2022 on Personal Data Protection (Peraturan Pemerintah Nomor 33 Tahun 2026). Enacted and promulgated July 16, 2026 (State Gazette 2026 No. 88), effective six months after promulgation (Article 225). hukumonline.com. Covers, among other things, the consent standard, impact assessments and the procedure for administrative sanctions, including the fine calculation variables. ↩ ↩²

3. Republic of Indonesia. Law No. 24 of 2009 on the National Flag, Language, Emblem and Anthem (Undang-Undang Nomor 24 Tahun 2009 tentang Bendera, Bahasa, dan Lambang Negara, serta Lagu Kebangsaan). peraturan.bpk.go.id. Article 31 on the use of Bahasa Indonesia in memoranda of understanding and agreements. ↩

4. WhatsApp. WhatsApp Business Messaging Policy. whatsappbusiness.com/policy. Opt-in requirements, opt-out and rules for business messaging. ↩ ↩²

5. Meta for Developers. Get opt-in for WhatsApp. developers.facebook.com/docs/whatsapp/overview/getting-opt-in. What an opt-in must contain on the WhatsApp Business Platform, including naming the business. ↩

6. Meta for Developers. Messaging limits and quality rating. developers.facebook.com/docs/whatsapp/messaging-limits. How Meta rates business phone numbers and what poor quality means for the account. ↩

7. Republic of Indonesia. Law No. 23 of 2002 on Child Protection, as amended by Law No. 35 of 2014 (Undang-Undang Nomor 23 Tahun 2002 tentang Perlindungan Anak sebagaimana diubah dengan Undang-Undang Nomor 35 Tahun 2014). peraturan.bpk.go.id. Article 1(1) defines a child as a person under 18; the amendments did not change this definition. ↩

8. Google for Developers. Consent mode overview. developers.google.com/tag-platform/security/concepts/consent-mode. How Google tags adjust behavior based on user consent status. ↩