Not legal advice: This article is general information, not legal advice. WhatsApp's policies and privacy law (GDPR, Israel's Amendment 13) change over time and apply differently case by case — verify your specific compliance obligations with a qualified lawyer before you rely on anything here.
WhatsApp marketing compliance comes down to three things Meta actually enforces: real opt-in before you message anyone, the right template category for what you're sending, and honoring every opt-out. Get those right and the rest — pricing, messaging limits, even most privacy law — falls into place. Get them wrong and templates get rejected, your number's quality rating drops, and its sending limits shrink or freeze.
The rules changed meaningfully through 2025. Meta replaced conversation-based billing with per-message pricing, overhauled how messaging limits scale, and — if you sell to Israeli customers — a rewritten Privacy Protection Law now sits alongside WhatsApp's own policy. This guide covers what's required, what changed, and how to build a WhatsApp marketing program that keeps sending instead of getting throttled.
Key takeaways
- Opt-in doesn't have to be WhatsApp-specific, but it must name your business and confirm the person wants to hear from you.
- Every template is Marketing, Utility, or Authentication — mislabeling one as another is the single most common compliance mistake.
- Since July 1, 2025, WhatsApp bills per message delivered, not per 24-hour conversation — check Meta's live pricing page for current rates by category and country.
- Messaging limits are now set per business portfolio and scale from 250 to Unlimited based on quality and volume, not per phone number.
- A full, blanket opt-out must always be honored the moment it's requested. Category-specific opt-in/opt-out (marketing off, order updates on) is possible — WhatsApp's own best practices recommend it — but you have to build it yourself.
- Your business is the data controller under GDPR — and for Israeli customers, Amendment 13 now requires explicit, specific marketing consent, not one bundled opt-in.
What counts as valid opt-in on WhatsApp?
Meta's rule is specific: you may only message someone on WhatsApp if they've given you their mobile number and confirmed they want to hear from your business. The opt-in doesn't have to happen inside WhatsApp itself — a checkbox on your website or a sign-up form works, as long as it's genuinely informed and lawful where you operate.
What makes an opt-in valid is stricter than it sounds. It has to name your business and make clear the person is agreeing to receive messages from you — a generic "sign up for updates" box that never mentions your brand won't hold up if it's ever challenged.
- Collect the phone number plus an affirmative action — a checkbox, a reply, a form submission — never a pre-ticked box or a buried assumption.
- Name your business clearly in the opt-in flow, so consent is unambiguous about who's messaging.
- Keep a record of when and how consent was given — you may need to show it.
- A general marketing opt-in can cover WhatsApp too, provided it satisfies the laws that apply to your customers.
This is the one WhatsApp rule with no workaround: bought lists, scraped numbers, and "they messaged our page once" don't meet the bar, no matter how the templates are categorized.
What are the WhatsApp template categories, and why do they matter?
Every message you send outside an open customer-service window has to go through an approved template, and every template is assigned exactly one of three categories. The category isn't a formality — it decides how strictly the template is reviewed and what you pay to send it.
| Category | What it's for | Example |
|---|---|---|
| Marketing | Promotions, offers, re-engagement, announcements | "Your cart's waiting — 10% off if you check out today" |
| Utility | Tied to a specific transaction or account the customer already has | "Your order #4821 is out for delivery" |
| Authentication | One-time passcodes and identity verification | "482-910 is your verification code" |
Meta enforces the boundary automatically: dress a promotion up as a utility message and it gets re-categorized as marketing — or rejected outright. Pick the category that honestly describes the content, not the one that's cheaper.
How did WhatsApp's pricing change in 2025?
Until mid-2025, WhatsApp billed in 24-hour "conversation" windows — once you opened a conversation with a customer, every message inside that window was covered by one charge. On July 1, 2025, Meta retired that model entirely. The current system charges per template message delivered, not per conversation window, and the old conversation-based pricing documentation is now marked deprecated.
The category taxonomy didn't disappear — marketing, utility and authentication templates are still priced differently — but exact rates vary by destination country and are set by Meta directly. Because those numbers move, check Meta's live WhatsApp Business Platform pricing page for the current rate before you budget a campaign, rather than relying on a figure you saw in a blog post (including this one).
How do WhatsApp's messaging limits work in 2026?
Messaging limits cap how many unique customers you can contact per 24 hours outside an open service window — and since an October 2025 overhaul, the limit applies to your whole business portfolio, not to each phone number individually.
- 1Start at the default 250 unique contacts per 24 hours — every new business portfolio begins here.
- 2Qualify for the 2,000 tier through business verification, or by delivering 2,000 messages to unique numbers inside a 30-day window using high-quality-rated templates.
- 3Past 2,000, tiers scale automatically — one level roughly every 6 hours you hold a high quality rating and use at least half your current limit within 7 days.
- 4Slow down the moment quality drops — a lower rating doesn't just risk a ban, it freezes your climb up the tiers.
A final Unlimited tier follows for consistently high-quality, high-volume senders.
Who has to honor opt-outs, and how?
WhatsApp's baseline rule is broad and unconditional: honor every opt-out request, whether it arrives inside WhatsApp or through another channel entirely, and remove the person from your contact list if that's what they asked for. There's no exception for how the request is worded — a blanket opt-out is a blanket opt-out, full stop.
- Don't require a specific word or format — "stop", "unsubscribe", or a plain "please stop messaging me" all count.
- Act on it immediately, not at the end of a campaign or billing cycle.
- Suppress the contact everywhere it's used — a broadcast list, a segment, an automation — not just in one tool.
WhatsApp's own best practices actually recommend going further than that floor: offering separate opt-in and opt-out by message category, so someone can drop marketing while still getting order updates. The one thing you must always honor is the full, blanket opt-out; a category-level option is something you design and manage yourself, not something WhatsApp sets up for you.
Who's responsible for GDPR when you market on WhatsApp?
Under WhatsApp's own Business Data Processing Terms, your business is the data controller and WhatsApp is the processor — meaning Meta only handles personal data per your instructions. In practice, that puts the actual GDPR obligations — lawful basis, consent records, honoring access and deletion requests — squarely on you, not on Meta.
- Keep your own record of consent — WhatsApp's opt-in confirmation isn't a GDPR consent log by itself.
- Have a lawful basis (almost always consent) before sending marketing templates to anyone in the EU.
- Be ready to honor access, correction and deletion requests through your own systems — WhatsApp won't do this for you.
How does Israel's Amendment 13 affect WhatsApp marketing?
If you market to customers in Israel, WhatsApp's own rules aren't the only ones that apply. Amendment 13 to Israel's Privacy Protection Law took effect on August 14, 2025, rewriting a law that had barely changed since 1981 and pulling it much closer to GDPR.
Two changes matter most for marketers. Consent for anything beyond the original purpose data was collected for — including using a customer's details for marketing — now has to be its own explicit, specific choice, not folded into a general terms-of-service checkbox. And enforcement got real teeth: the Privacy Protection Authority can now impose administrative fines directly, reportedly up to about 5% of annual turnover in the most serious cases, without going to court first.
- Consent for marketing use has to be its own explicit, informed choice — not bundled into a blanket signup checkbox.
- The definition of sensitive data widened considerably, now explicitly naming things like location data, biometric identifiers and financial details — handle these with extra care in any customer profile you build.
- Organizations that process large volumes of sensitive data, or run systematic customer monitoring, must appoint a dedicated privacy protection officer.
- Fines are no longer symbolic — they can now reach a meaningful share of annual turnover, decided by the regulator directly.
None of this replaces WhatsApp's own opt-in rule — it sits on top of it. A valid WhatsApp opt-in and a valid Amendment 13 marketing consent aren't automatically the same thing, so it's worth confirming your sign-up flow covers both explicitly.
Frequently asked questions
- Do I need a WhatsApp-specific opt-in, or does my existing marketing consent cover it?
- A general marketing opt-in can cover WhatsApp, as long as it clearly names your business and confirms the person wants to hear from you — it doesn't have to mention WhatsApp by name. What it can't be is vague: a checkbox that never says who's messaging, or why, won't hold up if it's ever challenged.
- What happens if I submit a promotional message as a utility template?
- Meta checks the content against the category, not just the label. A utility template with promotional language gets automatically re-categorized as marketing — or rejected outright — and repeated mismatches can affect your account standing. Always pick the category that honestly describes the message.
- How much does WhatsApp marketing cost per message in 2026?
- It depends on the message category and the destination country, and Meta sets these rates directly — they've already changed once since the July 2025 shift to per-message pricing. Check Meta's live WhatsApp Business Platform pricing page for current rates before budgeting a campaign, rather than relying on a figure from an older article.
- Can I let customers opt out of marketing messages but keep sending order updates?
- Yes — and WhatsApp's own best practices actually recommend it. The one non-negotiable is the blanket opt-out: if someone asks to stop hearing from you altogether, you have to honor that in full. A "marketing off, order updates on" distinction is something you design and manage yourself, typically in your CRM, sending only the categories you've separately confirmed they still want.
- Does Israel's Amendment 13 apply if my WhatsApp opt-in is already GDPR-compliant?
- Not automatically. GDPR consent and Amendment 13 consent are separate legal requirements that happen to look similar. If you have Israeli customers, confirm your opt-in flow independently meets Amendment 13's requirement for explicit, specific marketing consent — don't assume GDPR compliance covers it.
