The short answer is that it depends which WhatsApp you mean. The WhatsApp Business Platform — the official API that Meta sells to businesses — can be used in a GDPR-compliant way, and many European companies use it that way. The free WhatsApp Business app you download from the app store usually cannot, at least not for marketing, because of one specific thing it does as soon as you grant it access to your contacts.
The address book problem
When you install the WhatsApp Business app on a phone, it asks for access to your contacts. If you grant it, WhatsApp regularly matches your address book against its user base; numbers of people who are not on WhatsApp are stored as cryptographic hashes (WhatsApp Privacy Policy for the European Region, 2 July 2026). Either way you have disclosed numbers of people who never gave you permission to hand them to Meta. It includes your accountant, your suppliers, and the customer who once texted you about a delivery.
Under the GDPR, sending personal data to a third party is a processing operation that needs a legal basis. You do not have one for those people. There is a long-running German debate about whether private use is covered by the household exemption, but that exemption does not apply to a business at all. WhatsApp’s own Terms for the WhatsApp Business App (effective 23 September 2026) put the job on you: a business “must also secure all necessary rights, consents, and permissions (for example, opt-in) to share its customers’ contact and other personal data with WhatsApp”.
The WhatsApp Business Platform works differently. You send a message to a specific number through an API, and that number gets there because someone gave it to you. The uploaded-contacts problem simply does not exist.
If you are running marketing on the consumer app today, that is the first thing to change.
What the GDPR actually asks of you
Assume you are on the official platform. Five obligations do the heavy lifting.
A legal basis for messaging. For marketing, that means consent in nearly every case. Not because the GDPR names WhatsApp, but because direct electronic marketing falls under the ePrivacy Directive, which treats a marketing message on a messenger the way it treats one in an inbox. The directive allows a narrow exception for messaging existing customers about similar products (Article 13(2)), but national implementations differ, and it never covers a cold list.
Proof of that consent, per person. Article 7(1) puts the burden on you: you must be able to demonstrate that the person consented. A screenshot of your form is not proof for an individual. What you need is a record — this number, this wording, this timestamp, this source — that you can produce two years later.
Transparency. Your privacy notice has to say that you message customers on WhatsApp, on what basis, for how long you keep the conversation, and that Meta is involved. Article 13 wants this at the point of collection, which means the consent moment.
Processor agreements. Meta is processing personal data for you. So is whatever tool you use to send the messages. Both relationships need an Article 28 agreement. For the platform side you accept Meta’s terms; for the tool side you need a signed DPA from the vendor.
Exit. Every marketing message needs an easy way out, and opting out has to actually stop the messages. Meta’s Business Messaging Policy requires you to respect any opt-out request, on or off WhatsApp; there is no platform-level keyword. In practice tools implement keywords like STOP or UNSUBSCRIBE, and whichever you use has to fire without a human reading the message first.
There is a second exit you do not control. WhatsApp users can stop marketing messages from your business in the app’s “Offers and announcements” setting; Meta then refuses further marketing templates to them with error 131050 and reports the change through the user_preferences webhook (Meta developer documentation, retrieved 1 November 2026). The cautious reading is to carry that into your own opt-out record as well, because objections do not have to arrive through your preferred channel. On 9 October 2026 the EDPB published Italy’s €5,508,000 fine against BBVA for ignoring a marketing objection a customer had made in its app, noting that controllers “cannot disregard a valid request merely because it was not submitted through a preferred channel” (EDPB summary).
What this looks like in practice
The failure modes we see most often, and the fix for each:
| What goes wrong | Why it fails | What to do instead |
|---|---|---|
| Numbers imported from an old CRM export | No record of when or how consent was given | Re-permission the list by another channel, then start clean |
| Consent bundled with terms acceptance | Consent must be specific and separate (Art. 7(2)) | A separate, unticked checkbox with its own wording |
| ”You agree to receive updates via WhatsApp and partners” | Not specific — who are the partners? | Name the channel, name the sender, name the topic |
| Opt-outs handled by an employee reading the inbox | Not reliable, not documented | Automatic opt-out on keyword, recorded with a timestamp |
| No deletion path for chats | Article 17 request cannot be fulfilled | Deletion that reaches the conversation history, not just the CRM row |
Consent that survives scrutiny
The wording that works is boring and specific. Something like: “Yes, send me appointment reminders and offers from [company] on WhatsApp. I can reply STOP at any time to unsubscribe.” Separate checkbox, not pre-ticked, not bundled with anything else, and the number typed by the person themselves.
Then store what happened. The record should contain the number, the exact consent text as it was displayed, the timestamp, the source URL or form, and the IP address if you have it. If you ever get a complaint, that record is the entire defence. We wrote up the details in a separate piece on WhatsApp opt-in under the GDPR.
Retention that is actually a decision
Most WhatsApp chats accumulate forever, because nobody ever decided otherwise. Article 5(1)(e) says you keep personal data no longer than necessary. That does not mean you have to delete last week’s conversation; it means you have to be able to say why you keep it as long as you do. Pick a period — for example, two years after the last interaction for marketing contacts — write it into your retention policy, and make sure something enforces it.
Where the data goes
Message content is Signal-encrypted between the phone and the Cloud API, but with the Cloud API Meta holds the keys and decrypts the message to hand it to you — the end-to-end promise of the consumer app does not apply between Meta and your business. What passes through Meta’s systems is the delivery infrastructure and the metadata around it, plus whatever you put into the API — the phone number, the template you sent, the parameters you filled in.
Your contracting party in the EU is WhatsApp Ireland Limited under the WhatsApp Terms for WhatsApp Business Platform (effective 23 September 2026, when Meta split app and platform terms). Your processor is Meta Platforms Ireland Limited, under the Meta Terms for WhatsApp Business Platform and the Cloud API Terms (both last updated 23 September 2026), each incorporating the Meta Global Processor Terms; the Cloud API Terms list the sub-processors in Exhibit B, most of them US data-centre entities plus Denmark, Sweden and Ireland (and AWS in your own country if you switch on Cloud API Local Storage), and commit Meta to delete remaining personal data within 90 days of you leaving, or return it on request. The older Business Data Processing Terms (22 August 2025), which name WhatsApp as processor, now bind only users of the Business app. Do you need a DPA with Meta walks through the documents.
For onward transfers to Meta Platforms, Inc. and the US data centres, the Meta Global Processor Terms for the European Region say only that Meta Ireland “shall rely on appropriate GDPR-compliant transfer mechanisms” (section 4.1, retrieved 1 November 2026), without naming one. The EU-US Data Privacy Framework is available for that: Meta Platforms, Inc. is listed as a participant, and the framework, declared adequate by the European Commission in July 2023, is still in force as of 1 November 2026.
On 31 July 2026 the European Data Protection Board asked the Commission to “closely assess” whether the US Supreme Court’s Trump v. Slaughter ruling on the independence of the Federal Trade Commission affects the adequacy decision; no public response had followed by 1 November 2026. The first annulment action was dismissed by the General Court on 3 September 2025 (Latombe, T-553/23) and is under appeal at the Court of Justice (C-703/25 P, lodged 31 October 2025, no judgment yet), where Microsoft says it was admitted as an intervener in support of the Commission. Its two predecessors, Safe Harbour and the Privacy Shield, were both declared invalid by the Court of Justice, so do not treat the question as closed.
The practical consequence for your paperwork: WhatsApp belongs in your Article 30 record, with Meta named, the categories of data listed, and the transfer basis stated.
Where your tooling matters
Almost everything above is about the layer between you and Meta. That is where consent gets captured, where opt-outs get honoured, where retention gets enforced, and where the export for a data subject request comes from. Meta does not do any of that for you.
So the questions to ask a vendor are narrow and answerable:
- Where is the data hosted, and can you get that in writing?
- Will they sign a DPA in your company’s name, without you asking twice?
- Does an opt-out fire automatically on the keyword and on WhatsApp’s own stop setting, or does it depend on a person noticing?
- Can you export everything you hold about one contact, including the message history, in one action?
- Can you delete the same, completely, on request?
If a vendor cannot answer the fifth one, the first four do not help you.
What this means for you
If you are messaging European customers on WhatsApp, the compliance work is not exotic. Move off the consumer app, collect consent on a separate checkbox and store the proof, put the retention period in writing, make opt-out automatic, and keep a DPA on file for both Meta and your tool. None of it is expensive; all of it is much cheaper before a complaint than after one.
Nybero is hosted on Hetzner in Falkenstein, Germany, with these things as defaults rather than settings — consent recorded at capture, STOP handled automatically, per-contact deletion including the consent history in the interface, and a DPA available on request. One gap we name openly: deleting a contact detaches its message rows rather than erasing them — text, received media and form answers stay — so clearing them currently needs a request to support. If you want the longer version of the reasoning, our GDPR and WhatsApp overview goes through it channel by channel.
Updated 1 November 2026: added WhatsApp’s in-app stop setting for marketing messages and the BBVA objection fine, quoted the Business App Terms on sharing contacts, corrected the existing-customer exception (it is in the ePrivacy Directive itself, not only in some member states), dropped an unsourced “thousands of companies” figure and the phrase “built in Europe” (Nybero is operated by Prociro LLC and hosted in Germany), and stopped saying that Meta’s platform transfers “run on” the Data Privacy Framework (Meta’s processor terms do not name a mechanism), and re-checked all terms, the Data Privacy Framework and C-703/25 P as of 1 November 2026.
Updated 1 October 2026 for Meta’s terms restructuring of 23 September 2026, the Business Messaging Policy update of the same day and the EDPB’s review request. An earlier version named only Meta Platforms Ireland as the EU counterparty, described STOP as a WhatsApp platform rule, and credited Nybero with a per-contact export it does not have; all three have been corrected. Describes common practice under the GDPR and the ePrivacy Directive as of 1 November 2026. It is not legal advice; national rules differ, and your own case deserves a lawyer’s eye.
