WhatsApp and GDPR: What Businesses Need to Check

A business can use WhatsApp under the GDPR, but the GDPR applies to the business, not to the app: you need a lawful basis for each use, clear opt-in for marketing, an easy way to object, limits on what you keep and for how long, and contracts with everyone who handles the data. On the WhatsApp Business Platform (API), Meta says it acts as a data processor for the business, which makes this easier to set up properly than chatting to customers from staff phones.

This is a practical checklist, not legal advice. Rules differ between countries and cases, so check your own setup with a data protection adviser or your regulator.

Does the GDPR apply to your WhatsApp chats?

Under Article 3, the GDPR applies to businesses established in the EU, and to businesses elsewhere that offer goods or services to people in the EU. A customer’s phone number, name and chat messages are personal data, so a business that chats with EU customers on WhatsApp is usually covered.

Article 2 excludes processing “by a natural person in the course of a purely personal or household activity”. That covers chatting with friends, not customer chats, even when they happen on someone’s personal phone.

If you also serve customers in the UK, India or elsewhere, their local laws apply as well. The checklist below is a good start in most places, but it isn’t a substitute for local advice.

Lawful basis and consent for WhatsApp marketing

Article 6 says processing is lawful only if at least one of six bases applies. Three come up most often for WhatsApp:

Recital 47 says direct marketing “may be regarded” as a legitimate interest. But marketing by electronic message is also covered by the ePrivacy Directive. Its Article 13 requires prior consent for direct marketing by electronic mail, which the Directive defines broadly as any text, voice, sound or image message sent over a public communications network, with a narrow exception for your own similar products to existing customers who were given a free, easy way to object when their details were collected and in every message. How this applies to WhatsApp depends on national law, so check locally.

In practice, WhatsApp makes the choice simpler. Meta’s Business Messaging Policy says you may message people only if they gave you their number and you received opt-in permission confirming they want to receive messages from you. If you rely on consent under the GDPR, it must be:

• Freely given, specific, informed and unambiguous, by a statement or a clear affirmative action (Article 4). Recital 32 adds that a pre-ticked box doesn’t count.
• Provable. Article 7 says you must be able to show that the person consented, so record when, where and what they agreed to.
• Clearly distinguishable from other matters (Article 7), in clear and plain language.
• As easy to withdraw as to give. Article 7 says this in so many words.

Opt-out and the right to object

Article 21 gives people the right to object to direct marketing at any time, and once they do, their data may no longer be used for it. It also says you must bring this right to their attention clearly, at the latest in your first communication. The EDPB’s guide for small businesses adds that an objection to direct marketing must end that processing immediately, with no reason needed.

Meta’s policy matches: you must respect every request to block, stop or opt out, whether it’s made on WhatsApp or elsewhere, and Meta recommends clear instructions on how to opt out of specific kinds of messages. A simple pattern for a marketing template:

• Honour requests from every channel: chat, email, phone or in person.
• Keep one opt-out list and check it before every campaign.
• Treat a block as an opt-out and review why it happened.

In Automate AI, a customer who types STOP or UNSUBSCRIBE as their whole message is marked as opted out automatically: campaigns skip them and any drip sequences they’re in stop. Owners and managers can add their own opt-out words in Settings › General. A tap on a “Stop promotions” button isn’t treated as an opt-out, so ask people to type STOP, or mark button tappers as opted out yourself. Full detail in WhatsApp opt-outs and unsubscribe requests.

Why the personal app and contact uploads are risky for businesses

Chatting to customers from a staff member’s personal WhatsApp creates problems the GDPR cares about:

• Contact uploads. WhatsApp’s EEA terms describe users providing the phone numbers in their address book “if permitted by applicable laws”, and its privacy policy says it requires users to have lawful rights to share that information. If customer numbers sit in a staff phone’s address book, your business has to be sure that sharing is lawful.
• No central record. Chats spread across personal phones are hard to find when a customer asks for a copy or for deletion within a month.
• No control over retention. When a staff member leaves, customer chats can leave with them.
• Opt-outs get lost, because there’s no shared list for the team to check.

With the API, Meta states that it acts as a data processor on behalf of the business for the Cloud API, and a provider gives your team one shared inbox. If you already use the WhatsApp Business app, coexistence lets you keep the app and add the API on the same number.

WhatsApp groups and GDPR

Adding a customer to a group puts them in a shared space with your other customers, which needs a lawful basis of its own and often surprises people. Meta’s policy also says you may not forward or share information from a customer chat with another customer.

Never add people to a group for marketing. More on the options in WhatsApp Channels vs Communities vs groups.

Data minimisation and retention

Article 5 says personal data must be limited to what is necessary (data minimisation) and kept no longer than necessary (storage limitation). On WhatsApp that means:

• Ask only for what you need. A booking needs a name and a time, not a date of birth.
• Never ask for sensitive identifiers. Meta’s policy bans asking for full payment card numbers, financial account numbers or personal ID numbers in a chat.
• Set a retention period for chats and contacts, write it in your privacy policy, and delete on schedule.
• Limit who can see chats inside your team.

Meta’s own storage on the Cloud API is short. Its data privacy page says messages have a maximum retention period of 30 days, and user identifiers are deleted within 30 days of a message’s last status update (sent, delivered, read), unless otherwise directed. Your provider’s copy is the one to plan around.

Automate AI’s privacy policy says customer data is kept while the business’s account is active, then deleted on request. Inside the app, deleting a contact permanently removes it together with its chats, campaign history, follow-ups and saved AI chat summaries.

Handling data subject requests

Article 12 says you must act on a request without undue delay and within one month, extendable by two more months for complex cases if you tell the person why within the first month. The EDPB adds that you can’t charge for it, except for manifestly unfounded or excessive requests, and that you may ask for more information if you have reasonable doubts about who is asking.

Remember the other copies: chats in the WhatsApp Business app on a phone, exported spreadsheets, and any tool you send data to by webhook. Automate AI’s privacy policy tells a business’s customers to contact that business first, because the business decides how their data is used.

Processors and where WhatsApp data goes

Article 28 says a controller may use only processors that can show they will protect the data properly, and under a contract. Map each link in your chain:

1. Your business collects the number and the consent.
2. Your API provider stores contacts and chats. Automate AI’s privacy policy says it processes customer data only to provide the service to that business and on its instructions. Ask any provider for its data processing terms and a list of the services it uses.
3. WhatsApp (Meta) carries the messages. Its Business Data Processing Terms name you as controller and WhatsApp as processor, cover sub-processors, which may be in other countries, including the EEA or the United States, promise help with data subject requests, and say WhatsApp will tell you about a breach without undue delay.
4. Transfers outside the EU. The terms point to WhatsApp’s data transfer addenda, and Meta’s Cloud API page says Meta and WhatsApp rely on GDPR-compliant transfer mechanisms. Meta also offers a local storage option that keeps message data at rest in a chosen country.

Your WhatsApp GDPR checklist

1. Write down each purpose (support, orders, marketing) and its lawful basis.
2. Collect clear opt-in for WhatsApp marketing, naming your business, and record when and where.
3. Explain how to opt out in your first marketing message, and honour every request.
4. Keep one opt-out list and check it before each campaign.
5. Move customer chats off personal phones into a shared business inbox.
6. Don’t add customers to groups without their agreement.
7. Ask only for the details you need, never card, account or ID numbers.
8. Set and publish a retention period, and delete on schedule.
9. Have a process to answer access, correction, erasure and objection requests within a month.
10. Check the processor terms of Meta and your provider, and update your privacy policy.

Then run your WhatsApp campaigns on the official API, with opt-outs handled.