You have 40,000 email subscribers, a phone number for a third of them, and a new WhatsApp channel that people actually read. The temptation is obvious. The answer is no — and the reason that matters most is not the legal one.
Legally, the problem is one word from Article 4(11) of the GDPR: consent has to be specific. Someone who agreed to a newsletter agreed to a newsletter. The EDPB’s consent guidelines (05/2020) require consent to be granular per purpose, and the widely held reading is that a new marketing channel is a new purpose you asked about, rather than an implementation detail you get to change later.
The ePrivacy Directive defines electronic mail as any text, voice, sound or image message that is stored until the recipient collects it (Article 2(h)), and requires prior consent for direct marketing by electronic mail (Article 13(1)). The common reading is that messenger advertising falls under the same rule as email. What differs is the reaction. People block a phone number faster than they unsubscribe from a newsletter.
Meta’s own rules say the same from the other direction. The Business Messaging Policy (last updated 23 September 2026) states that you may only contact people who gave you their phone number or username and gave opt-in permission to receive subsequent messages or calls from you. An imported list has neither, and usernames do not help here: as of 1 November 2026 Meta says WhatsApp “will start rolling out usernames gradually in 2026” (Meta, business-scoped user IDs). Meta’s own opt-in guidance adds that the permission “can be general and not specifically for WhatsApp, as long as businesses comply with all local laws” — so the channel-specific part of the test comes from the GDPR, not from Meta.
The practical reason is worse
Suppose you decide the legal risk is acceptable. Here is what actually happens.
Email punishes bad sends slowly. A spam complaint rate creeps up, your deliverability degrades over weeks, and you can repair it by cleaning the list and warming a new domain. WhatsApp does not work like that.
Recipients block. Some report. Meta scores message quality from the past seven days of blocks, reports, mutes and block reasons, weighted by recency. The Business Messaging Policy says Meta’s “systems may limit the amount of messages a business can send … based on this user feedback”, and its enforcement rules escalate from warnings to sending blocks of up to 30 days, an account lock and finally removal from the platform.
The damage is not contained to one number either. Since 8 October 2025 messaging limits are set per business portfolio and shared by all its numbers, and they only scale up while you send high-quality messages across all of them. And the burned number is the one printed on your website, your invoices and your shop window. You do not warm up a new one; you tell customers your business changed its phone number.
The asymmetry is stark. A bad email campaign costs you some open rate. A bad WhatsApp campaign can cost you the channel. The two channels are priced and policed differently all the way down — see WhatsApp vs email marketing.
What “technically possible” actually covers
To be precise about the technical part, because the confusion is real:
| Action | Possible? | Advisable? |
|---|---|---|
| Store phone numbers from your CRM in a WhatsApp platform tool | Yes | Yes, as a contact record |
| Check which of them are on WhatsApp | No — no Cloud API endpoint does this | — |
| Send a template to a number that never opted in | Yes | No — policy breach and quality risk |
| Send a template to a number that opted in on WhatsApp | Yes | Yes, that is the product |
The middle row deserves a note. There is no number-check endpoint on the Cloud API; the old On-Premises contacts endpoint died with that API, whose last version expired on 23 October 2025. The WhatsApp Business app can upload your phone’s address book (WhatsApp calls this contact upload in its EEA privacy policy), which is exactly why it is unsuitable for European business marketing. The official Business Platform does not, and that is a feature rather than a limitation.
What to do with the list instead
The list is not worthless. It is a channel you already have permission on, which makes it the best place to ask for permission on a second one.
1. Send one honest email. Not a “we’re excited to announce” email. Tell people what they would get on WhatsApp and how it differs from what they get by mail. Concrete beats enthusiastic: “Order updates and appointment reminders on WhatsApp, roughly two messages a month, reply STOP any time.”
2. Make the action one tap. Two options work.
A click-to-chat link — wa.me/<your number> with a prefilled message — means the person taps, WhatsApp opens, and they send you a message. That inbound message is the affirmative action, it comes from the device that owns the number, and it opens a 24-hour service window in which you can confirm what they signed up for. Store the message and its timestamp as the consent record.
Budget for that confirmation: since 1 October 2026 Meta charges per message for service replies and for utility templates sent inside the window. Each business number gets a free tier of 1,000 delivered service messages per month, no roll-over; beyond that a reply in Germany costs €0.0456, utility templates have no free tier, and without a payment method on file Meta stops delivering once the free tier is used (Meta, pricing and its EUR rate card effective 1 October 2026, retrieved 1 November 2026; no change for 1 January 2027 announced as of that date).
A web form with a separate, unticked consent checkbox works too, and gives you a cleaner record of the exact wording. Expect it to convert a little worse, since it adds a screen.
3. Store the record properly. Number, the consent wording as displayed, timestamp, source. The details are here, and they are the difference between a list you own and a list you hope nobody asks about.
4. Expect a small number, and be glad. Only a fraction of an email list will move, and that is the point rather than the problem. The people who take a deliberate action to add a second channel are the ones who wanted it. A thousand people who chose WhatsApp are worth more than forty thousand who were moved onto it — and unlike the forty thousand, they will not cost you the number.
Other places the same permission exists
The email list is the obvious one, but it is rarely the best-converting.
Checkout. A consent checkbox next to the phone field at checkout is usually a stronger moment than a standalone campaign, because the person is already handing over the number and there is an obvious benefit — delivery updates.
Existing conversations. Anyone who has ever messaged your business is in the strongest position of all. They chose the channel already. Ask them once, in the chat while their 24-hour window is open, whether they want offers too, and store the reply.
Physical touchpoints. A QR code at the till, on the packaging, on the invoice. Scanning and then sending the prefilled message is a deliberate act by the person holding the phone, which is precisely the evidence you want.
Click-to-WhatsApp ads. New audiences who start the conversation themselves. If they click from WhatsApp’s Android or iOS app and you reply within 24 hours, Meta opens a free entry point window of up to seven days, counted from your reply, in which marketing, utility, authentication and service messages are free; Meta Business Agent messages are still charged. Meta lists it as one of only two cases in which it does not charge since 1 October 2026, alongside the 1,000 free service messages per number per month (pricing page, retrieved 1 November 2026).
None of these need a list you already have. All of them produce a cleaner one.
The one edge case
Article 13(2) of the ePrivacy Directive contains a narrow existing-customer exception: if you obtained someone’s contact details in the context of a sale, you may market your own similar products to them, provided they were offered a free, easy opt-out at collection and in every message. Whether it stretches to a messenger channel is contested, national transpositions differ in detail, and the safe reading is that it does not stretch far. If you think your case fits, that is a conversation with a lawyer who knows your jurisdiction — not a decision to make from a blog post.
What this means for you
Leave the list where it is. Use it once, to ask. Build the WhatsApp audience from people who chose it, and accept that it will be smaller and better for years rather than large and fragile for a month.
Nybero is built for that path: opt-in capture on your forms, click-to-chat links and QR codes that record the inbound message as consent, and automatic STOP handling so the list stays clean once it exists. Our GDPR and WhatsApp overview covers the rest of the compliance picture.
Updated 1 November 2026: Meta no longer documents a quality-based cut of messaging limits (the Flagged and Restricted number statuses were discontinued on 7 October 2025), so the enforcement paragraph now follows the Business Messaging Policy and Meta’s enforcement rules; the free entry point window excludes Meta Business Agent messages; the existing-customer exception is stated as Article 13(2) of the Directive; prices re-checked against the rate card. Sources retrieved 1 November 2026.
Updated 1 October 2026 for the Business Messaging Policy wording of 23 September 2026, Meta’s October pricing change and the free entry point duration. Reflects the GDPR and the ePrivacy Directive, plus Meta’s Business Messaging Policy, all retrieved 1 October 2026. An earlier version quoted engagement figures without a source and described a checkout opt-in Nybero does not offer; both have been removed. Orientation, not legal advice.
