Short answer
Yes. WhatsApp's Business Messaging Policy lets a business contact people only if they gave it their number and opted in to receive messages. Meta's opt-in guidance requires businesses to state clearly that the person is opting in to receive messages and to name the business. Applicable law, such as Saudi Arabia's PDPL, can add further consent requirements.
What Meta requires
- The person has given you their mobile number or username.
- You have opt-in permission confirming they want to receive messages from you.
- Your opt-in clearly states that the person is opting in to receive communication from the business.
- Your opt-in clearly names the business the person will receive messages from.
- You comply with applicable law.
- You respect every request to block, discontinue or opt out, on or off WhatsApp.
How to collect opt-in that holds up
Example: "☐ Yes, send me offers from Acme on WhatsApp. I can tap Stop promotions at any time."
- Add an unticked checkbox or a clear button at the point of capture, such as checkout or a sign-up form.
- Name the brand and the channel: "Send me offers from Acme on WhatsApp."
- Say what kind of messages to expect and how to stop them.
- Store the phone number, the exact wording shown, the date and time, and where consent was captured.
- Keep marketing consent separate from consent for service messages where the law or channel distinguishes them.
Consent rules in GCC markets
These records come from SMS rules, but regulators and data-protection laws apply to the personal data you use on any channel, so treat WhatsApp the same way.
| Market | Consent expectation for promotional messaging |
|---|---|
| UAE | Verifiable opt-in with source, timestamp and channel logged; TDRA can request the audit trail |
| Saudi Arabia | Consent aligned with the PDPL, with source, timestamp, channel and lawful basis recorded |
| Qatar | Explicit opt-in language and retained consent evidence |
Common mistakes
- Messaging a purchased or scraped list.
- Reusing consent given for SMS or email as WhatsApp consent without saying so at capture.
- Losing the consent evidence when data moves between CRM and messaging tools.
- Ignoring an opt-out sent by email or phone instead of in the chat.