WhatsApp Business API Compliance Guide 2025: GDPR, PDPA, Opt-In Rules

Meta's WhatsApp Business Policy: The Foundation

Before considering local data laws, every business using the WhatsApp Business API must comply with Meta's own Business Policy and Commerce Policy. These are the rules that govern your account's existence on the platform — and Meta can enforce them independently of any national regulator.

The core Meta requirements for WhatsApp Business API usage are:

• Only message users who have opted in to receive messages from your business
• Only send business-relevant messages (no spam, no illegal content)
• Only use Meta-approved message templates for proactive (business-initiated) conversations
• Honour opt-out requests immediately and do not re-message opted-out users
• Maintain a low block rate and spam complaint rate
• Not resell access to the WhatsApp platform

Opt-In Requirements: What Counts as Valid Consent

The single most important compliance requirement is proper opt-in. Meta is explicit: you must obtain opt-in outside of WhatsApp before sending any proactive messages. This means a contact being in your phone book or having messaged you years ago is NOT sufficient.

What Counts as Valid Opt-In

• Website sign-up form: Checkbox stating "I agree to receive WhatsApp messages from [Business Name]" — must be unchecked by default
• In-store sign-up: Physical form with explicit WhatsApp consent checkbox
• SMS opt-in: Customer replies "YES" to an SMS requesting WhatsApp consent
• QR code: Customer scans a QR code that opens a WhatsApp conversation — the act of initiating contact is implicit consent for that conversation
• Click-to-WhatsApp ads: Customer clicks your ad and initiates a WhatsApp conversation — initiating the conversation is implicit consent
• Checkout opt-in: Tick box during purchase process (must be separate from T&C acceptance)

What Does NOT Count as Valid Opt-In

• Having someone's phone number in your contacts
• A customer emailing you or filling a general contact form
• Pre-ticked opt-in boxes
• Purchasing a contact list
• Assuming consent because someone is an existing customer (unless they explicitly opted in to WhatsApp communications)

Opt-In Documentation Best Practice

Store: the opt-in date, the opt-in source (website form, in-store, etc.), the exact language shown, and the contact's identifier. This documentation protects you if Meta audits your account or a regulator requests evidence. In ChatDaddy, you can add custom fields to store opt-in source per contact.

Message Template Rules and Categories

Any proactive message you send via the API (business-initiating a conversation) must use a pre-approved message template. Templates are submitted to Meta for review and must pass both automated and human review before use.

Template Categories

Template Rejection Reasons

Templates are commonly rejected for:

• Making misleading or exaggerated claims ("GUARANTEED results in 24 hours")
• Content that could be considered threatening, abusive, or harassing
• Requesting personal information without clear purpose
• Mismatched category (marketing content submitted as utility)
• Missing opt-out instructions for marketing templates
• Containing prohibited content (weapons, adult content, etc.)

Responding to User-Initiated Messages

When a user sends you a message first, a 24-hour service window opens. Within this window, you can send free-form messages without using a template — no pre-approval needed. This is why prompting users to message you first (via click-to-WhatsApp ads, QR codes, website widgets) is so valuable: it opens the window for natural conversation.

Regional Data Protection Laws

Data Handling and Retention

What Data You're Processing via WhatsApp

When you use the WhatsApp Business API, you process: phone numbers, message content, read receipts, media files shared, contact names, and conversation metadata. All of this is personal data under most privacy laws and must be handled accordingly.

Data Minimisation

Only collect and store data you actually need for your stated purpose. If you're using WhatsApp for appointment reminders, you don't need to store the full conversation history indefinitely — archive or delete after the relevant service period.

Cross-Border Data Transfers

WhatsApp (Meta) infrastructure processes messages through global data centres. Most local laws permit this when Meta has appropriate safeguards (Standard Contractual Clauses for EU, adequacy assessments for other regions). Your obligation is to document this transfer in your privacy policy and data processing agreements.

Retention Periods

• Marketing opt-in records: retain for the duration of the relationship plus 3 years (for dispute resolution)
• Conversation history: 12–24 months typical; longer if required for contractual purposes
• Transaction records: follow your accounting/legal requirements (often 7 years)
• Opt-out records: retain permanently (to prove you honoured the opt-out)

Protecting Your Account Health

Meta rates each WhatsApp Business phone number based on quality signals from user feedback. A high block rate or spam complaint rate moves your number from Green (good) to Yellow (at risk) to Red (restricted). Red-rated numbers face reduced messaging limits and risk permanent suspension.

Maintain Green Quality Rating

• Only message opted-in contacts
• Keep message frequency reasonable — don't message the same contact multiple times per day
• Provide value in every message; avoid pure promotional blasts
• Make it easy to opt out ("Reply STOP to unsubscribe")
• Segment carefully — send relevant messages to relevant audiences
• Monitor your quality dashboard in Meta Business Manager regularly

Responding to Quality Issues

If your rating drops, immediately pause new campaigns and audit your opt-in sources, message content, and send frequency. Do not simply reduce send volume and wait for the rating to recover — investigate the root cause. Review your re-engagement campaign strategy to ensure dormant contacts have been properly segmented out.

WhatsApp Compliance Checklist

Use this checklist before launching any WhatsApp marketing campaign:

• All contacts have explicitly opted in to receive WhatsApp messages
• Opt-in records include: date, source, exact opt-in language
• All outbound templates are Meta-approved
• Every marketing template includes an opt-out instruction
• Opt-out requests are processed within 24 hours
• Privacy policy updated to include WhatsApp data processing
• Data retention policy documented and being followed
• Cross-border data transfer mechanisms in place (if applicable)
• Quality rating is Green in Meta Business Manager
• Team trained on not sending unsolicited messages
• Local data protection law requirements identified and addressed

For businesses using ChatDaddy across multiple markets, the Indonesia compliance requirements (UU PDP) and Saudi Arabia PDPL requirements differ significantly from Malaysian PDPA — ensure your opt-in workflows and privacy policies are jurisdiction-aware.