WhatsApp and GDPR for businesses: messaging your customers

Note: this guide is general information, not legal advice. Every legal statement links to the law or decision it comes from. For a specific case, ask a lawyer or your data protection officer. The examples come from Spain: its data protection authority, the AEPD, publishes its decisions, and the GDPR it applies is the same across the EU. Each country, though, sets the rules on promotional messages in its own law.

In 30 seconds

• Replying to someone who wrote to you needs no separate permission. Neither does reminding them of their appointment or telling them their order is ready: those are service messages.
• A promotion on WhatsApp needs express consent, unless the person is already your customer and you offer them something similar to what they bought. That is the EU ePrivacy rule, which Spain applies through article 21 of its LSSI law. Spain's data protection authority, the AEPD, treats WhatsApp like email or SMS.
• Every promotion carries a simple, free way to opt out, and an opt-out is always honoured.
• Meta also requires prior permission (opt-in) naming your business, and that you honour every opt-out. This applies to the free app too.
• The AEPD has already fined these mistakes: adding customers to a group (€500 and €3,000), sending promotions after an opt-out (€1,500) and sending customer data to an employee's personal WhatsApp (€2,500).
• Your business is the controller of the data. The platform you use is a processor and signs a data processing agreement with you.

Can I message my customers on WhatsApp?

Yes. For most messages, the reason you have their number is enough. For the law there are two kinds:

• Service messages: you reply to someone who wrote to you, confirm an appointment, give an order update. The GDPR allows processing that is necessary for a contract, or for steps the customer asks for before one (article 6(1)(b)).
• Commercial messages: anything meant to promote, directly or indirectly, the image, goods or services of a business, in the words of Spain's LSSI (annex, letter f). These need prior consent.

The practical rule: if the message sells something, even in one line, treat it as a promotion. Meta does the same: a template that mixes an update with an offer is marketing.

For every message, tell people when you collect their number who you are, what you will use it for and on what legal basis (article 13 GDPR). Meta also requires a published privacy policy. And the 24-hour window is Meta's rule, not the law's: once 24 hours have passed since the customer's last message, the API only lets you write with an approved template, which is paid (what each one costs).

What consent do I need to send promotions on WhatsApp?

You need the person to have asked for them, or expressly agreed, before the first message. The only exception is your own customer, for products similar to what they already bought from you.

The EU basis is the ePrivacy Directive (2002/58/EC). Its article 13 allows direct marketing by "electronic mail" only with prior consent, and it defines that as "any text, voice, sound or image message" stored until the recipient collects it (article 2(h)). Each country applies it through its own law.

In Spain it is article 21 of the LSSI (Law 34/2002). It bans advertising by email or any equivalent electronic means that was not requested or expressly authorised beforehand. The AEPD names SMS and WhatsApp messages as an equivalent means.

The existing-customer exception (article 21(2)) needs all four at once:

1. A prior contractual relationship: they bought or hired something from you.
2. You obtained their contact details lawfully.
3. You offer products or services of your own business, similar to what they bought.
4. You gave them a simple, free way to object when you collected their details, and in every message.

What valid consent looks like. "Freely given, specific, informed and unambiguous", given by a statement or a clear affirmative action (article 4(11) GDPR). In practice:

• Nothing implied. The AEPD says article 21 does not accept implied consent (Report 0164/2018). "If you don't reply, we'll take it as a yes" does not count.
• You must be able to prove it (article 7(1)). Keep the date, the source and the wording the person accepted.
• "It shall be as easy to withdraw as to give consent" (article 7(3)).

Spain's Robinson List. Anyone doing direct marketing must first check the advertising opt-out lists, unless the person has given them consent (article 23(4) of the LOPDGDD, Spain's data protection act).

Each country, its own law. The GDPR is the same across the EU; the rule on electronic promotions changes:

What does Meta require to message customers on WhatsApp Business?

Meta requires prior permission for any message you start, not just promotions. Its WhatsApp Business Messaging Policy covers the free app and the API:

• You may only contact people who gave you their number and their permission to receive your messages.
• The permission states clearly that the person is agreeing to receive messages, and from which business. It can be general, not specific to WhatsApp, as long as you comply with the law. It can be collected on a website, by SMS, by phone, in person or on paper.
• Honour every request to block or opt out, whether it comes on WhatsApp or anywhere else, and remove that person from your contact list.

Your customers have tools of their own. A WhatsApp setting lets them stop your marketing: if you send them a marketing template afterwards, Meta does not deliver it (error 131050). They can block or report you, and with enough negative feedback Meta can limit your sending or remove your access.

How do I handle WhatsApp opt-outs?

An opt-out applies from the moment the person asks, for the whole team, and they do not have to use any particular word.

• Saying so is enough. Spain's LSSI lets people withdraw consent simply by telling the sender (article 22(1)). And under the GDPR, once they object, "the personal data shall no longer be processed" for marketing (article 21(3)).
• Offer it in every promotion (article 21(2) LSSI). On WhatsApp the simplest way is a quick-reply button in the template, such as "Stop promotions"; Meta cites it as a common use.
• Tell "no more promotions" apart from "stop messaging me". Someone who drops the offers can still get their appointment reminder.
• Make it visible to the whole team. An opt-out noted on one person's phone never reaches the campaign someone else is preparing.

A team inbox such as BlueMarlin keeps on each customer's record whether they gave consent, when and through which channel. An opt-out takes them out of campaigns for the whole team, whether it comes from the template's button, from a message asking for it or from Meta's notice.

What WhatsApp mistakes has the AEPD already fined?

These four Spanish decisions punish everyday practices in any business:

Groups that show your customers' numbers

In a group, everyone sees everyone's number: "when you are added to a group, all members of the group will see your phone number", says WhatsApp's help centre. The AEPD ordered the workshop to put measures in place against creating groups without consent that reveal the participants' personal data. Having dealt with the workshop before, over a set of wheel rims, was not enough.

With a broadcast list in the app, each customer gets the message in their own chat and their reply reaches only you. It only reaches people who have saved your number, though, and it is still advertising: it needs the same consent.

Customer data on an employee's personal phone

On an employee's own phone, the business cannot guarantee confidentiality: people outside the organisation may have access to it, and the business does not know how it is secured. That was the AEPD's reasoning, and it also rejected the argument that this was the custom: economy, custom or speed do not justify breaking the rules. The fix is a business number the whole team uses.

Messages to someone who opted out

The customer asked on WhatsApp to stop, the company told him it had deleted his data, and the advertising kept coming: he pointed out it was the fourth time. The AEPD added that the messages were not covered by a prior contractual relationship, because the person had only asked for a price.

Who is responsible for my customers' data on WhatsApp?

Your business. The GDPR calls the one who decides why and how data is processed the controller, and the one who processes it on their behalf the processor (article 4, points 7 and 8). The platform you use for WhatsApp is a processor.

• You need a data processing agreement (DPA). It sets the subject matter, duration, purpose and type of data, and binds the processor to follow your instructions (article 28(3)).
• Meta has its own: the WhatsApp Data Processing Terms, last updated on 22 August 2025, which apply where WhatsApp processes your customers' data as your processor.
• BlueMarlin publishes its own at /dpa: BlueMarlin is the processor, Meta is listed as a sub-processor for transmitting messages, and the agreement is accepted when you create your account.
• What you cannot hand over: the legal basis, informing your customers, consent and opt-outs stay with you. No tool collects consent for you.

Frequently asked questions

Can I add my customers to a WhatsApp group?

Not without their consent. In a group everyone sees everyone's number, and Spain's AEPD has fined a workshop €3,000 and a caterer €500 for adding customers to groups. To reach many people, use a broadcast list or a campaign, which reach each person separately, and only those who agreed to receive them.

Do I need permission to send appointment reminders on WhatsApp?

No separate consent is needed: a reminder promotes nothing and rests on the appointment the customer booked. Tell them you will use WhatsApp when you collect their number. If you add an offer to the reminder, it becomes advertising, for the law and for Meta.

Does someone who asked for a quote count as a customer?

Not necessarily. In case PS/00323/2020 the person had only asked for a price, and the AEPD found that the promotions that followed were not covered by a prior contractual relationship. The exception requires that they bought or hired something from you.

Do I have to check Spain's Robinson List before a WhatsApp campaign?

Not if the person gave you consent. Otherwise yes: the LOPDGDD requires anyone doing direct marketing to check the opt-out lists first (article 23(4)). The AEPD points out that being on the list does not stop advertising from a business you are a customer of.

Can my team serve customers from their personal WhatsApp?

It is risky. The AEPD fined a company €2,500 for sending customer data to an employee's personal WhatsApp, because on that phone it could not guarantee confidentiality. The safe option is a shared business number, so the customer stays with the business when someone leaves.

What can the AEPD fine for WhatsApp advertising without permission?

Under the LSSI, which the AEPD enforces on this point, up to €30,000 for a minor infringement, and €30,001 to €150,000 when the sending is massive or persistent (articles 38, 39 and 43). Under the GDPR, up to €20 million or 4% of annual worldwide turnover (article 83(5)). In the four cases in this guide, the fines ranged from €500 to €5,000.

Sources

Everything above was checked on 30 September 2026 against the laws and official sources:

• General Data Protection Regulation (EU) 2016/679, EUR-Lex: definitions (article 4), legal bases (6), consent (7), information (13), objection to direct marketing (21), processing agreement (28) and fines (83).
• Directive 2002/58/EC (ePrivacy), consolidated version, EUR-Lex: definition of electronic mail (article 2(h)) and unsolicited communications (13).
• Law 34/2002 (LSSI), Spain's Official Gazette (BOE), in Spanish: consent and the existing-customer exception (article 21), withdrawal (22), infringements and fines (38 and 39), the AEPD's powers (43) and the definition of commercial communication (annex, letter f).
• Organic Law 3/2018 (LOPDGDD), BOE, in Spanish: advertising opt-out systems (article 23).
• AEPD: Unwanted advertising, in Spanish: WhatsApp as an equivalent means, no implied consent and opt-out lists.
• AEPD: Report 0164/2018, in Spanish: article 21 LSSI does not accept implied consent.
• AEPD decisions PS/00323/2020, PS/00298/2023, PS/00261/2024 and PS/00505/2023, in Spanish: the four cases in the table.
• WhatsApp Business Messaging Policy: prior permission, opt-outs, templates, the 24-hour window, the privacy policy and Meta's enforcement.
• Get opt-in for WhatsApp: requirements and methods of opt-in.
• Marketing templates: user preferences: the setting to stop marketing and error 131050.
• Template categorization: a template mixing an update and an offer is marketing.
• Template components: the quick-reply opt-out button.
• WhatsApp: Privacy at a Glance: in a group, everyone sees your number.
• WhatsApp: How to use broadcast lists: each recipient gets it as an individual message, and only if they saved your number.
• WhatsApp Data Processing Terms: Meta as processor.
• Country table: § 7 UWG (Germany); CNIL, la prospection commerciale par courrier électronique (France); Codice privacy, article 130 and the Garante's guidelines of 4 July 2013 (Italy).
• BlueMarlin's data processing agreement: the roles of BlueMarlin and Meta.

Change history

• 30 September 2026: first version.