WhatsApp consent: what Meta and the GDPR require

Two consents not to confuse

A customer who leaves their number to be called back agrees to be contacted. That does not mean they agree to your promotions. The Spanish data protection authority (AEPD) made this point when it fined a business for advertising sent on WhatsApp to someone who had only asked for information.

What Meta requires

• The customer gave you their number and agreed to receive your messages or calls.
• The request clearly names your business and says they agree to receive its messages.
• Accepted methods: SMS, a website form, an IVR phone flow, in person or on paper.
• Meta accepts general consent, not specific to WhatsApp, where local law allows. In France and Spain, naming WhatsApp is safer.
• A request to stop must be honoured, whether it arrives on WhatsApp or elsewhere.
• To call a customer on WhatsApp, Meta advises separate consent: agreeing to messages does not cover WhatsApp calls.

The message that confirms consent collected elsewhere can be a “utility” template, cheaper than a marketing one: €0.0248 per delivered message in France, €0.0166 in Spain. On one condition: no offer in the text. A template mixed with promotion is classed as marketing, and Meta can re-categorise a template that was already approved.

What the law requires in France

• Offers to consumers: prior consent, through a dedicated tick box that is never pre-ticked. Accepting terms and conditions is not enough.
• Offers to professionals, on a subject linked to their work: inform them and let them object simply and for free.
• One consent per purpose: the CNIL does not accept bundled consent.
• Every message shows who is writing and offers a simple way to stop.
• You must be able to demonstrate consent at any time.

What the law requires in Spain

• Law 34/2002 (LSSI), article 21: an electronic commercial communication must have been requested or expressly authorised. The text does not distinguish consumers from businesses.
• Article 21.2 exception: an existing customer, for products similar to those they bought, with the option to object in every message.
• Article 22: consent is withdrawn by simply notifying that wish.
• Organic Law 3/2018 (LOPDGDD): a contract cannot depend on consent to offers.
• The AEPD requires consents to be documented, recorded and kept.

In the UK, the UK GDPR and PECR apply, with guidance from the ICO. This guide does not cover them.

The proof to keep

The AEPD has ruled that a screenshot proves nothing. Proof is a dated record, made when consent is given, that you can export:

• the exact text shown, with its version (if it changes, the old version stays linked to earlier consents);
• the date and time, and the page where the form was placed;
• the name, the number, the channel choice and the offers box as submitted;
• the confirmation on WhatsApp, with the IDs of the message sent and of the reply;
• every withdrawal: STOP, “It’s not me”, a request made to the team.

A one-tap confirmation on WhatsApp proves that the number belongs to that person. Without it, anyone can type someone else’s number.

Ready-to-copy wording

This wording is the one used by the WYP.chat WhatsApp consent form. Replace the brackets and keep the question, the two choices and the box separate. STOP and BAJA are the recognised opt-out words.

In English

In French

In Spanish (Spain, informal)

The Spanish wording has not yet been reviewed by a lawyer: have it checked before you use it. This wording is not legal advice.

The confirmation on WhatsApp

After the form, a utility template, with no offer or link, asks the customer to confirm with one tap. Offers are only recorded after “Yes, it’s me”.

E Emma WhatsApp

Today

Hello Emma, you asked Martin Bakery to get back to you on WhatsApp. Is this you? 10:02

Yes, it’s meIt’s not me

Yes, it’s me 10:03

Thank you, that’s noted. To stop, reply STOP. 10:03

Type a message

Edge cases: STOP, withdrawal, minors

STOP

The customer stops both offers and contact on WhatsApp. A new form filled in with their number never lifts this: only the customer, by writing to you, can start again.

“It’s not me”

Someone typed another person’s number. No more messages on your initiative, and this refusal is kept even if the record is deleted.

Withdrawal made another way

An email, a call, a request in the shop: it counts as much as STOP. Note it on the record.

Phone only

No WhatsApp message on your initiative. If the customer writes to you, you can reply within the 24-hour window.

Minors

To consent on their own, the age is 15 in France and 14 in Spain. If your customers are young, take advice.

Existing customers

Meta asks for consent to be contacted on WhatsApp: a purchase on its own is not consent. The legal exceptions for existing customers are narrow: if in doubt, ask.

Doing it with WYP.chat

The WhatsApp consent form is created in Settings, Entry points, and goes on your website as a frame you copy, with no script. It does what this guide describes:

• name, number, a required choice of “WhatsApp and phone” or “Phone only”, and a separate, unticked offers box;
• question, choices, box and notice fixed and versioned: they are the proof;
• a two-button confirmation on WhatsApp, with no WYP.chat credits; Meta charges for the delivered message;
• offers recorded only after “Yes, it’s me”, dropped with no tap within 30 days;
• proof exportable as JSON or text from the contact record, with no IP address;
• a form never lifts a STOP; “Phone only” blocks every WhatsApp template.

What it does not do: it does not cover WhatsApp calls, and it does not decide the existing-customer exception for you.

• Price of a utility or marketing message, country by country →
• Create a WhatsApp link and its QR code →
• Reply as a team from one WhatsApp number →
• WhatsApp campaigns with consent and STOP →

How to do it in WYP.chat

Help centre articles that walk through each setting, screen by screen.

• WhatsApp consent form on your website
• WhatsApp links and QR codes: entry points
• Import your contacts and their permission for offers
• Send a WhatsApp campaign