Opt-in is the moment someone actively agrees to hear from you. In chat apps that moment is easy to blur, easy to lose, and expensive to get wrong — here is how to define it, capture it and prove it.
Opt-in is a deliberate action by which a person agrees to receive messages from you, taken at a moment when it was clear what they were agreeing to. Both halves matter. A pre-ticked checkbox is an action nobody took. A username scraped from a public group is a contact, not a consent. A checkout form that quietly collected a phone number gave you an address, not permission.
European data protection law describes valid consent as freely given, specific, informed and unambiguous, and it puts the burden of demonstrating it on you. That last part is the one teams forget: you are not only required to obtain consent, you are required to be able to show, later, that you obtained it. Consent you cannot evidence is, in practice, consent you do not have. (This page is a plain-language explanation for marketers, not legal advice — check your obligations for your market and your vertical.)
The commercial argument is blunter. Messaging platforms hand deliverability to the recipient. Nobody arbitrates whether your send was reasonable; the person either tolerates it or blocks you, and a block is permanent. A list built on weak opt-in decays from the first send onward, and no amount of copywriting reverses it.
Single opt-in grants permission with one action: a form submitted, a box ticked, a Start button pressed. Double opt-in adds a second, separate confirming action after the first. In email that is the classic confirmation link. In a chat app it is a second tap inside the conversation, after a message that states what the subscriber is signing up for.
The honest trade-off: single opt-in produces a bigger list, double opt-in produces a cleaner one. Double opt-in filters out mistyped addresses, people who tapped a link out of curiosity, and anyone who arrived through an incentive they wanted more than they wanted your messages. It also loses genuine subscribers who get distracted between step one and step two, which is why the confirming step should be one tap in the same conversation, not a detour to another app.
Do not settle this argument with opinions. Run both, tag the two entry points as separate sources, and compare the cohorts at 7 and 30 days on the metrics that actually pay: activation, repeat engagement, and how many are still reachable a month later. A double opt-in cohort that is a third smaller and twice as retained is not a smaller list, it is a better one.
Telegram already enforces a hard floor: a bot cannot message a person who has not started a conversation with it. Pressing Start is therefore a real permission event, and it is stronger than anything email gives you, because it cannot be faked by typing someone else's address into a form.
It is also thinner than it looks. A deep link in an ad takes someone from tap to open chat to Start in about three seconds, often with no sentence anywhere explaining what arrives next. Technically they consented. Practically they clicked a button to see a promo code. If the next fourteen days bring daily broadcasts, they will block you and be entirely right to.
So build the consent moment deliberately, on top of Start. Three things make it real:
The onboarding flow mySkua runs gives you natural places to put each of those. A subscriber presses Start, confirms the language the platform detected from their Telegram client, optionally picks a category such as Sport or Casino, optionally passes a channel-subscription gate, and then receives the welcome offer. Every one of those steps is a tap you can make carry meaning, and because the onboarding texts are editable per language with their own media and inline buttons, the promise sentence exists in each language rather than only in English.
One distinction worth keeping straight: a channel-subscription gate is a condition of access, not a consent. Requiring someone to join your channel before they get a promo code tells you nothing about whether they want your drip sequence. Treat those as two separate permissions and ask for the second one separately.
A usable consent record answers five questions: who the subscriber is, when they joined, what action they took, what wording that action appeared under, and where they came from.
The fourth is the one almost everyone skips. Onboarding copy gets edited constantly, and if you only store a boolean you have silently rewritten what every past subscriber agreed to. Version your onboarding text, or at minimum keep dated copies of it, so that a complaint about a send in March can be answered with the wording that was live in March.
The fifth is the one that saves you money. Deep links carry a payload — t.me/yourbot?start=instagram_q3 — and that payload tags the subscriber with a source, which means consent quality becomes measurable per channel rather than per list. When a partner sends you a wave of subscribers who all block within a week, source attribution is the difference between suspecting the partner and knowing.
Alongside the source, keep the choices the subscriber made themselves: the language they confirmed and the category they selected. Those are declared preferences rather than inferred ones, which makes them both the best targeting signal you own and the clearest evidence that the person engaged with the choice rather than being swept into a list.
Chat apps have no List-Unsubscribe header and no polite footer link. The platform-level opt-out is the block button: total, permanent, and available in two taps at any moment. That makes your job the opposite of email. Instead of making unsubscribing easy enough to be legal, you need to make a lighter exit obviously available so that people who want less do not reach for the option that means nothing, ever again.
This is where opt-in policy meets sending infrastructure. The pacing, retry and error-classification rules that keep a large send healthy are covered in our guide to Telegram broadcast limits and safe sending — worth reading before your first list-wide broadcast message.
Weak consent is invisible on the day you collect it and obvious a month later. These are the places it surfaces:
Read those per source rather than in aggregate. A healthy channel and a poisonous one average out to something that looks acceptable, which is exactly how teams keep paying for traffic that is quietly destroying their list. Splitting the same numbers by source, language, category and tag is what audience segmentation is for, and it is also how you keep drips targeted at people who asked for that specific thing.
It is genuine technical permission and it cannot be forged, but on its own it only proves someone opened a chat. Add a stated promise and a confirming tap before you treat it as a subscription.
Rarely as a legal rule, frequently as a good idea. Its real value is evidentiary and commercial: a second deliberate action is easier to defend and produces a list that survives contact with a send schedule.
Not into a bot. Telegram will not let a bot message someone who has not started it, so the only path is a link that person chooses to tap. The platform is enforcing the rule that email only asks you to follow.
As long as the relationship is live. A subscriber who has not opened, clicked or activated anything for months is a candidate for a re-permission message, not for more frequency.
Most of what is described above is plumbing: per-language onboarding text with inline buttons, deep links that tag the source, self-selected categories that drive later targeting, drips that fire on a delay after joining and only to the segment that asked, blocked subscribers dropped automatically, and retention cohorts sitting next to delivery stats so a bad acquisition channel is visible while it is still small.
That is what mySkua does for Telegram lead-generation bots, with each bot keeping its own subscribers, content and team. The platform is currently in invite-only private beta — if you run Telegram funnels and want to try it, join the waitlist and request access, and we will get in touch.
See also: Broadcast message · Telegram broadcast limits · Audience segmentation.
Want this on your own bots?
mySkua is in a closed beta and accounts are opened in small batches. Tell us what you run and we will come back to you.
Request access