To send WhatsApp messages to a customer properly, there are three things: they agreed to receive them (clear consent for a specific purpose), you record that they agreed, and they can leave easily. That is how Europe’s data protection law (the GDPR) sees it, it is what Meta asks of anyone using the API, and it is what best protects your number against bans. This article is practical guidance, not legal advice.
Answering is not the same as sending
| Situation |
Allowed? |
Condition |
| The customer wrote to you and you reply |
Yes |
You answer what they asked. Do not use it to enrol them in campaigns. |
| Updating them on an order they placed |
Usually yes |
Say at the time of purchase that you will update them by WhatsApp, and use the number they gave for it. |
| Sending promotions and news |
Only with specific consent |
Ask separately, with a box they choose to tick. No pre-ticked box. |
| Writing to bought or copied numbers |
No |
It is the quickest way to lose the number: the risks of WhatsApp for business. |
Asking and recording, step by step
| 1 |
Ask where the person gives it: the website form, the cart, the counter or the first chat. One clear sentence is enough: “I want to receive updates about my order on WhatsApp at this number.”
|
|
| 2 |
Separate the purposes. Order updates and promotions are two permissions, not one. Someone who accepts one has not accepted the other.
|
|
| 3 |
Keep the proof: who, when, which text they answered, and where (website, shop, chat). A spreadsheet will do to start; a customer system does it better.
|
|
| 4 |
Give the way out in every message you start: “Reply STOP to stop receiving.” And honour it at once, taking the person off the list.
|
|
| 5 |
Respect requests to erase or to see. Whoever asks what you hold about them, or to be erased, has that right under the GDPR, and chats count as data.
|
|
What to do with chat data
Ask only for what you need. A photo of an ID document for a small order is more risk than benefit. Do not leave everything forever on the phone of whoever answers: what matters moves into the system, the rest is deleted. And tell people, in your privacy policy, that you use WhatsApp, because Meta processes part of the traffic. See personal data protection: what applies to your website.
|
The law that applies depends on where the people you write to are, not on where you are. In Europe it is the GDPR; other countries have laws of their own, with different rules. If in doubt, speak to a lawyer or to the data protection authority of the customers’ country. Beyond the law, Meta has its own consent rules for the API.
|
|
A WhatsApp group exposes everyone’s number. Putting customers in a group shows them to each other. For announcements use a broadcast list or a channel: broadcast lists, groups and channels.
|
|
If the customer said “no”, it is no. One number complaining to WhatsApp costs more than ten people who leave without a fuss. An easy exit protects your account. For more, see WhatsApp, e-mail or SMS: which is for what.
|
Português
English
