When may you WhatsApp a customer? Opt-in, POPIA and Meta’s rules

Owners usually ask one question: can I WhatsApp this person? The honest answer depends on what the message is for, because South African law and Meta both look at purpose. A reply to a question, an appointment reminder and a promotion are three different things, and the rules for each are different.

This article separates the two rule sets, quotes the section of the Act that matters, and gives you opt-in wording and a record-keeping method. We are not lawyers and this is not legal advice. Where the rules are unclear, we say so.

Which two sets of rules apply to a WhatsApp message?

The first is the law. The Protection of Personal Information Act (POPIA) covers any use of a person’s phone number and details. Section 69 deals specifically with direct marketing by electronic communication. The Information Regulator, which enforces POPIA, can issue administrative fines of up to R10 million under section 109 of the Act.

The second is Meta’s own WhatsApp Business messaging policy. It is a contract condition for using the platform, not a law. Meta’s policy notes that users can block or report businesses and that system limits may apply, whatever the Act says.

The two do not line up neatly. Something can satisfy Meta and still fail POPIA, and the other way round. You need to pass both.

What does POPIA section 69 actually say?

The core sentence in section 69(1) is that processing personal information for direct marketing by “any form of electronic communication, including automatic calling machines, facsimile machines, SMSs or e-mail” “is prohibited unless the data subject” has given consent, or “is, subject to subsection (3), a customer of the responsible party”. The Act’s own list does not name WhatsApp. It defines electronic communication as any text, voice, sound or image message sent over an electronic communications network and stored in the network or the recipient’s device until collected. Whether WhatsApp falls inside that is our reading, not a court ruling that we know of, so treat it as covered.

“Direct marketing” is defined in section 1 as approaching a person “for the direct or indirect purpose of promoting or offering to supply, in the ordinary course of business, any goods or services”. The test is the purpose of the message, not the channel.

The Act defines consent as “any voluntary, specific and informed expression of will” giving permission for the processing. The same section 1 definitions are in the Act. A pre-ticked box or silence is not that.

The existing-customer exception and its three conditions

If the person is already your customer, section 69(3) lets you market to them without fresh consent, but only if all three of these hold:

1. You obtained their contact details “in the context of the sale of a product or service”.
2. The marketing is for “the responsible party’s own similar products or services”.
3. They were given “a reasonable opportunity to object, free of charge and in a manner free of unnecessary formality”, both when you collected the details and on each marketing message, if they had not already refused.

The Information Regulator’s Guidance Note on Direct Marketing gives an example: at a clothing store, similar products include shoes and belts, and a funeral insurance cover is not a similar product. It also says a customer who was never asked at the time “cannot be deemed to have given her consent” because “silence cannot mean consent”.

What if the person has never been my customer?

Then section 69(1)(a) applies: consent first. Under section 69(2) you may approach someone who has not previously withheld consent “only once in order to request the consent”. The Regulator’s note reads that as meaning the first message must be the request for consent, and it points to Form 4, a prescribed consent form, or one “substantially similar” to it. We did not open Form 4 itself, so check it before you copy its layout.

The note is advisory: it says the Act and the Regulations prevail if they conflict with it. It also says registering with the national pre-emptive block registry is not the test, so a person who has not registered a block still needs to have consented. That reading is the Regulator’s, and a court could take a different view.

Section 69(4) adds a practical rule. Every direct marketing message must contain the sender’s identity and “an address or other contact details” to which a request to stop can be sent.

What does Meta require, and how is it different?

Meta’s policy says you may only contact people on WhatsApp if they have given you their mobile number or username and you have “received opt-in permission from the recipient confirming that they wish to receive subsequent messages or calls from you”. It also says “you are solely responsible for determining the method of opt-in”, and that opt-in must be obtained in a manner that complies with the laws that apply to your communications. So Meta hands the legal question back to you. It does not replace POPIA.

Meta’s best practice is to get opt-in that covers the categories of message you will send, and a separate opt-in by category. It adds that you must respect any request, on or off WhatsApp, to block, discontinue or opt out, “including removing that person from your contacts list”. The policy page states all of this.

The platform also has a mechanical rule. On Meta’s pricing documentation, a user’s message opens a 24-hour customer service window, and non-template messages can only be sent while it is open. Outside that window, Meta’s policy says you “may only initiate conversations using an approved Message Template”. Meta’s pricing page describes marketing templates as for promotional objectives and utility templates as for transactional or informational objectives, and the policy says a template may “only be used for its designated purpose”. Meta can review, pause or reject templates at any time.

Reply, service message or marketing: which rules apply?

Mixing is where owners get caught. A reminder that ends with “and book your next facial for 10% off” has a promotional purpose. We would send reminders as reminders and keep offers in a separate, consented message. See our guide to WhatsApp appointment reminders for templates.

What wording can I use to ask for opt-in?

The Regulator’s note says its Form 4 requires you to specify the goods or services you want to market, and the person to specify the method of communication you may use. Meta says to cover the categories you will send. The wording below tries to satisfy both. It is an example, not approved text, so adapt it and have a professional look at it before you rely on it.

Keep the two categories separate. Someone may want a reminder but not offers, and a single combined tick weakens the argument that consent was “specific”.

How do I record consent and honour “stop”?

Under section 11(2), the responsible party carries the burden of proof for consent, and the person can withdraw consent at any time. A spreadsheet is enough if it holds the right columns.

1. Record the proofSave the name, number, date and time, the exact wording shown, which categories were ticked, and where it was collected (website form, front desk, reply to a message). Keep a screenshot of the form version.
2. Keep one do-not-contact listThe Regulator’s note says you must maintain a database of people who withheld consent or objected. One list, checked before every send, covers both.
3. Put the opt-out in every marketing messageInclude your business name and a way to stop, such as “Reply STOP to opt out”. Section 69(4) asks for sender identity and contact details for stop requests.
4. Act on the dayMeta says to respect requests “on or off WhatsApp”. A person who tells the receptionist in person, or by phone, has also opted out. Update the list and confirm once with a short reply.
5. Do not hide the exitThe existing-customer exception requires an objection route that is “free of charge” and “free of unnecessary formality”. Do not make people fill in a form to leave.

If an AI agent sends or drafts your WhatsApp messages, the do-not-contact check has to sit before every send, not after. When we set one up, we start in draft mode, where the agent drafts and you approve, so a person sees what is going out. Our support chatbot and CRM agent pages describe how that works.

What is unsettled, and when should I get advice?

• We know of no court decision on whether WhatsApp is “electronic communication” for section 69. The definition is broad, so assume it is.
• The Regulator’s guidance note does not address appointment reminders or invoices. We read them as outside direct marketing when they only serve the booking or bill, but that is a reading, not a ruling.
• The guidance note is advisory. Where the Act and the note differ, the Act prevails.
• Meta’s rules and its message categories change, so re-read the policy page before you build a flow. The South African per-message rates are covered in our WhatsApp Business API cost guide.
• Whether your particular list qualifies for the customer exception depends on facts we cannot see.

Get advice from a lawyer, or the Information Regulator, before a large send, before buying or renting a list, or if someone complains. For the wider picture, read POPIA and AI agents, and see WhatsApp Business app or API if you are deciding which product to use.