WhatsApp works for marketing because it feels personal. That is also why unwanted messages land badly: people block, report, and sometimes complain to a regulator. Getting consent right is not paperwork on top of the campaign. It is what keeps your number healthy and your list worth having.
Two sets of rules apply at the same time: Meta's own policies, which decide whether you can keep using WhatsApp, and the law where you and your customers are. This guide covers both, for brands selling in Spain, the rest of the EU and Latin America.
Two layers: Meta's policy and the law
Meta's rules and data protection law overlap, but they are not the same thing:
- Meta's policy sets a minimum for everyone on WhatsApp, in every country. Breaking it can get your messages limited or your account restricted.
- The law decides whether your processing of personal data, and your commercial messages, are lawful. Breaking it can lead to fines and complaints.
Meta's own opt-in guidance says it plainly: businesses must comply with applicable law. Meeting Meta's minimum does not mean you meet the law, and the reverse is also true. You need both.
What Meta requires
Meta's WhatsApp Business Messaging Policy (last updated September 23, 2026) and its developer guidance on opt-in set out the core rules:
- You may only contact people on WhatsApp if they have given you their phone number and you have received their opt-in permission.
- The opt-in must say two things clearly: that the person is opting in to receive messages from you on WhatsApp, and the name of your business.
- You can collect opt-in in any channel: your website, a form, SMS, a phone call, in store or on paper, as long as it meets those requirements and the law.
- You must respect every request to stop, whether the person asks on WhatsApp or anywhere else.
- Quality counts. Meta states that it will rate-limit businesses whose quality stays low for a sustained period. People can block or report you, and that feedback affects what you can send.
Meta also suggests either a broad opt-in that covers the types of message you will send (order updates, offers, recommendations), or separate opt-ins per category, to reduce blocks. For ecommerce, separate opt-ins are usually the cleaner choice, for reasons you will see below.
What users can do inside WhatsApp
Customers do not have to reply "stop" to get rid of you. WhatsApp gives them an Offers and announcements setting to stop, or resume, marketing messages from a business. When they do, your marketing templates to them fail with error code 131050, and you can receive a webhook when their preference changes. On top of that, WhatsApp may cap how many marketing templates a person receives from all businesses when they seem less receptive.
The consequence is practical: a list full of people who never really wanted your messages performs worse and costs more.
Template categories decide what needs marketing consent
Every WhatsApp template is marketing, utility or authentication. The category matters for consent:
- Utility messages follow up on something the customer did or asked for: an order confirmation, a shipping update, a return received. They must contain no promotion.
- Marketing messages aim to sell, create awareness or bring customers back.
- Authentication messages carry one-time codes.
If a template mixes both (a shipping update with a discount code), Meta classifies the whole template as marketing. A customer who accepted order updates has not necessarily accepted promotions. Keep the two apart in your templates and in your consent records.
What the law adds in the EU and Spain
GDPR: what valid consent looks like
Under the GDPR, consent is a freely given, specific, informed and unambiguous indication of the person's wishes, by a statement or a clear affirmative action (Article 4(11)). Recital 32 adds that silence, pre-ticked boxes or inactivity do not count.
Article 7 adds three obligations that shape how you collect it:
- You must be able to demonstrate consent. The burden of proof is on you, not on the customer.
- The request must be clearly distinguishable from other matters, in clear and plain language. A line buried in your terms and conditions is not enough.
- Withdrawing must be as easy as giving it, and people must be told they can withdraw at any time.
Separately, Article 21 gives everyone the right to object to direct marketing at any time. Once they object, you must stop using their data for that purpose, and the right must be brought to their attention explicitly, at the latest in your first communication.
Spain: the LSSI and the AEPD
Spain's e-commerce law (Ley 34/2002, the LSSI) prohibits sending advertising or promotional messages by email or an equivalent electronic means unless the recipient requested or expressly authorized them beforehand (Article 21.1). The Spanish data protection authority, the AEPD, applies this rule to WhatsApp: in resolution PS/00323/2020 it fined a business for sending promotional WhatsApp messages without prior consent.
There is one exception (Article 21.2). If there is a prior contractual relationship, you obtained the contact details lawfully, and you only promote your own products or services similar to what the customer bought, you may send commercial messages without that prior consent. Even then, you must offer a simple, free way to object when you collect the data and in every message.
Article 22.1 adds that people can revoke consent at any time by simply telling you, and that you must offer simple, free ways to do so. For serious breaches, such as mass or insistent sends that do not meet Article 21, the LSSI sets fines of €30,001 to €150,000.
Spain's data protection law (LOPDGDD, Article 23) also covers advertising exclusion systems, such as Robinson-style lists. Before direct marketing you must check the systems that apply to you, unless the person gave you their consent to receive that communication.
Latin America: check each country
There is no single rule for Latin America. Each country has its own data protection law, with its own authority and its own definition of valid consent. A few examples of what the texts say:
- Colombia. Ley 1581 de 2012 defines authorization as the prior, express and informed consent of the data subject, and requires it to be obtained by any means that can be consulted later. In other words: you need a record.
- Argentina. Ley 25.326 requires free, express and informed consent, in writing or by an equivalent means. Its Article 27 lets people ask at any time to be removed from databases used for advertising.
- Chile. Ley 21.719, published in December 2024, reforms the country's data protection framework and comes into force on December 1, 2026.
- Mexico. Private-sector processing is governed by the Ley Federal de Protección de Datos Personales en Posesión de los Particulares.
If you sell across several countries, design for the strictest requirement you face and keep the record per country. Your lawyer can tell you where local rules go further.
How to collect consent that holds up
The pattern that works in every market is the same: an explicit action, a clear text, and a record.
- At checkout: a separate, unticked checkbox for WhatsApp marketing, next to the phone field. Name your business and the kind of messages.
- On a form or landing page: the same text, plus a confirmation step on WhatsApp itself. When the person sends you the first message, you also know the number is really theirs.
- In the chat: a button or keyword ("Yes, send me offers") after a service conversation. Ask, do not assume. A customer who wrote about an order has not opted in to promotions.
- In store: a QR code that opens a chat with a pre-filled message, followed by the consent question.
An example of a clear request:
"I want to receive offers and new arrivals from [Brand] on WhatsApp. I can stop at any time by replying STOP."
How to evidence consent
Article 7(1) of the GDPR and Colombia's "any means that can be consulted later" point to the same thing: keep evidence. For each contact, store:
| What to record | Why |
|---|---|
| The phone number and the person's identifier | Who consented |
| Date and time | When |
| Method and place (checkout, form URL, chat button, keyword, in store) | How |
| The exact text they accepted, including your business name | What they agreed to |
| Which categories (marketing, order updates) | Scope |
| Every later change: opt-out, objection, resumption | Current status |
Keep the old versions of your consent texts. If you change the wording in March, you need to know which version a person accepted in January.
Frequency and opt-out
Consent is not a licence to message as often as you like. A few rules of thumb:
- Make opting out easy in every marketing message, for example with a quick-reply button such as "Stop offers" and a short line that explains it.
- Act on any request to stop, in any wording and in any channel, and sync it to your other tools so an opted-out customer does not come back through another list.
- Listen to the signals: blocks, reports and falling read rates mean you are sending too much or to the wrong people.
- Remove contacts who never engage. They add cost and blocks, and do nothing for your quality.
Checklist
- Separate order updates from marketing, in templates and in consent.
- Use a clear text that names your business and WhatsApp, with an unticked box or an explicit action.
- Store who, when, how, what text and which categories, plus every change.
- Offer a simple, free opt-out in every marketing message and honor it everywhere.
- In Spain, check whether you rely on consent or on the LSSI 21.2 exception, and on exclusion lists.
- In Latin America, confirm the rules country by country.
- Review your setup with a lawyer before your first campaign.
How Kanesh fits
In Kanesh, every opt-in is stored with the exact text the person accepted and how they gave it. You remain responsible for your legal basis; we help you keep the evidence. Get your conversation diagnosis.
Sources
All sources accessed on September 29, 2026.
- WhatsApp Business, WhatsApp Business Messaging Policy (opens in a new tab) (last updated September 23, 2026)
- Meta for Developers, Get opt-in for WhatsApp (opens in a new tab)
- Meta for Developers, Marketing templates (opens in a new tab)
- Meta for Developers, Per-user marketing template message limits (opens in a new tab)
- Meta for Developers, Template categorization (opens in a new tab)
- Regulation (EU) 2016/679 (GDPR), Articles 4(11), 7 and 21 and Recital 32: EUR-Lex (opens in a new tab). EUR-Lex did not load when we checked; we verified the wording on the Official Journal text republished by BOE (opens in a new tab) (in Spanish)
- BOE, Ley 34/2002 de servicios de la sociedad de la información y de comercio electrónico (LSSI) (opens in a new tab), Articles 21, 22, 38 and 39
- BOE, Ley Orgánica 3/2018 de Protección de Datos Personales y garantía de los derechos digitales (LOPDGDD) (opens in a new tab), Article 23
- AEPD, Resolution PS/00323/2020 (opens in a new tab)
- Función Pública (Colombia), Ley 1581 de 2012 (opens in a new tab)
- Argentina.gob.ar, Ley 25.326 de Protección de los Datos Personales (opens in a new tab)
- Biblioteca del Congreso Nacional de Chile, Ley 21.719 (opens in a new tab)
- Cámara de Diputados (Mexico), Ley Federal de Protección de Datos Personales en Posesión de los Particulares (opens in a new tab)