You have 40,000 email subscribers, a phone number for a third of them, and a new WhatsApp channel that people actually read. The temptation is obvious. The answer is no — and the reason that matters most is not the legal one.
Legally, the problem is one word from Article 4(11) of the GDPR: consent has to be specific. Someone who agreed to a newsletter agreed to a newsletter. The prevailing reading among supervisory authorities is that the channel forms part of the purpose you asked about, rather than an implementation detail you get to change later.
The ePrivacy Directive treats messenger advertising the way it treats email — electronic mail requiring prior consent. What differs is the reaction. People block a phone number faster than they unsubscribe from a newsletter.
Meta’s own rules say the same from the other direction. The Business Messaging Policy states that you may only contact people who gave you their number and gave opt-in permission to receive messages from you. An imported list has neither.
The practical reason is worse
Suppose you decide the legal risk is acceptable. Here is what actually happens.
Email punishes bad sends slowly. A spam complaint rate creeps up, your deliverability degrades over weeks, and you can repair it by cleaning the list and warming a new domain. WhatsApp does not work like that.
Recipients block. Some report. Meta’s quality rating for your number reacts inside its rolling seven-day window, your messaging limit is cut, and a number that keeps accumulating reports can be restricted. That number is the one printed on your website, your invoices and your shop window. You do not warm up a new one; you tell customers your business changed its phone number.
The asymmetry is stark. A bad email campaign costs you a percentage point of open rate. A bad WhatsApp campaign can cost you the channel.
What “technically possible” actually covers
To be precise about the technical part, because the confusion is real:
| Action | Possible? | Advisable? |
|---|---|---|
| Store phone numbers from your CRM in a WhatsApp platform tool | Yes | Yes, as a contact record |
| Check which of them are on WhatsApp | No — no Cloud API endpoint does this | — |
| Send a template to a number that never opted in | Yes | No — policy breach and quality risk |
| Send a template to a number that opted in on WhatsApp | Yes | Yes, that is the product |
The middle row deserves a note. There is no number-check endpoint on the Cloud API; the old On-Premises contacts endpoint died with that API on 23 October 2025. The consumer WhatsApp Business app does sync your address book, which is exactly why it is unsuitable for European business marketing. The official Business Platform does not, and that is a feature rather than a limitation.
What to do with the list instead
The list is not worthless. It is a channel you already have permission on, which makes it the best place to ask for permission on a second one.
1. Send one honest email. Not a “we’re excited to announce” email. Tell people what they would get on WhatsApp and how it differs from what they get by mail. Concrete beats enthusiastic: “Order updates and appointment reminders on WhatsApp, roughly two messages a month, reply STOP any time.”
2. Make the action one tap. Two options work.
A click-to-chat link — wa.me/<your number> with a prefilled message — means the person taps, WhatsApp opens, and they send you a message. That inbound message is the affirmative action, it comes from the device that owns the number, and it opens a 24-hour service window in which you can confirm what they signed up for. Store the message and its timestamp as the consent record. Budget for that confirmation from October: free replies inside the window end on 1 October 2026, when Meta begins charging per message for service and utility messages (Meta, non-template message pricing, retrieved 1 August 2026).
A web form with a separate, unticked consent checkbox works too, and gives you a cleaner record of the exact wording. It converts a little worse because it is one more screen.
3. Store the record properly. Number, the consent wording as displayed, timestamp, source. The details are here, and they are the difference between a list you own and a list you hope nobody asks about.
4. Expect a small number, and be glad. Only a fraction of an email list will move, and that is the point rather than the problem. The people who take a deliberate action to add a second channel are the ones who wanted it. A thousand people who chose WhatsApp are worth more than forty thousand who were moved onto it — and unlike the forty thousand, they will not cost you the number.
Other places the same permission exists
The email list is the obvious one, but it is rarely the best-converting.
Checkout. A consent checkbox next to the phone field at checkout converts far better than a standalone campaign, because the person is already handing over the number and there is an obvious benefit — delivery updates.
Existing conversations. Anyone who has ever messaged your business is in the strongest position of all. They chose the channel already. Ask them once, in the chat, whether they want offers too, and store the reply.
Physical touchpoints. A QR code at the till, on the packaging, on the invoice. Scanning is a deliberate act by the person holding the phone, which is precisely the evidence you want.
Click-to-WhatsApp ads. New audiences who start the conversation themselves. Reply within 24 hours and you open a 72-hour free entry point window — the one free window Meta keeps after 1 October 2026.
None of these need a list you already have. All of them produce a cleaner one.
The one edge case
Some EU member states implement a narrow existing-customer exception from the ePrivacy Directive: you may market similar products to someone who bought from you, provided they were offered an opt-out at collection and in every message. Whether it stretches to a messenger channel is contested, the implementation differs country by country, and the safe reading is that it does not stretch far. If you think your case fits, that is a conversation with a lawyer who knows your jurisdiction — not a decision to make from a blog post.
What this means for you
Leave the list where it is. Use it once, to ask. Build the WhatsApp audience from people who chose it, and accept that it will be smaller and better for years rather than large and fragile for a month.
Nybero is built for that path: opt-in capture on your forms, click-to-chat links and QR codes that record the inbound message as consent, and automatic STOP handling so the list stays clean once it exists. Our GDPR and WhatsApp overview covers the rest of the compliance picture.
Updated 1 August 2026. Reflects the GDPR and the ePrivacy Directive, plus Meta’s Business Messaging Policy, all retrieved 1 August 2026. An earlier version quoted engagement figures without a source and described a checkout opt-in Nybero does not offer; both have been removed. Orientation, not legal advice.
