The short answer is that it depends which WhatsApp you mean. The WhatsApp Business Platform — the official API that Meta sells to businesses — can be used in a GDPR-compliant way, and thousands of European companies do exactly that. The free WhatsApp Business app you download from the app store usually cannot, at least not for marketing, because of one specific thing it does as soon as you grant it access to your contacts.
That distinction is the whole article, so let us start there.
The address book problem
When you install the WhatsApp Business app on a phone, it asks for access to your contacts. If you grant it, WhatsApp regularly matches your address book against its user base; numbers of people who are not on WhatsApp are stored as cryptographic hashes (WhatsApp Privacy Policy for the European Region, 2 July 2026). Either way you have disclosed numbers of people who never gave you permission to hand them to Meta. It includes your accountant, your suppliers, and the customer who once texted you about a delivery.
Under the GDPR, sending personal data to a third party is a processing operation that needs a legal basis. You do not have one for those people. There is a long-running German debate about whether private use is covered by the household exemption, but that exemption does not apply to a business at all.
The WhatsApp Business Platform works differently. There is no address book on a server somewhere to sync. You send a message to a specific number through an API, and that number gets there because someone gave it to you. The uploaded-contacts problem simply does not exist.
If you are running marketing on the consumer app today, that is the first thing to change — and it is a bigger deal than any cookie banner you have ever argued about.
What the GDPR actually asks of you
Assume you are on the official platform. Five obligations do the heavy lifting.
A legal basis for messaging. For marketing, that means consent in nearly every case. Not because the GDPR names WhatsApp, but because direct electronic marketing falls under the ePrivacy Directive, which treats a marketing message on a messenger the way it treats one in an inbox. Some member states allow a narrow exception for messaging existing customers about similar products, but it is narrow, it varies by country, and it never covers a cold list.
Proof of that consent, per person. Article 7(1) puts the burden on you: you must be able to demonstrate that the person consented. A screenshot of your form is not proof for an individual. What you need is a record — this number, this wording, this timestamp, this source — that you can produce two years later.
Transparency. Your privacy notice has to say that you message customers on WhatsApp, on what basis, for how long you keep the conversation, and that Meta is involved. Article 13 wants this at the point of collection, which means the consent moment, not buried three clicks deep.
Processor agreements. Meta is processing personal data for you. So is whatever tool you use to send the messages. Both relationships need an Article 28 agreement. For the platform side you accept Meta’s terms; for the tool side you need a signed DPA from the vendor.
Exit. Every marketing message needs an easy way out, and opting out has to actually stop the messages. Meta’s Business Messaging Policy requires you to respect any opt-out request, on or off WhatsApp; there is no platform-level keyword. In practice tools implement keywords like STOP or UNSUBSCRIBE, and whichever you use has to fire without a human reading the message first.
What this looks like in practice
Here is a table of the failure modes we see most often, and the fix for each.
| What goes wrong | Why it fails | What to do instead |
|---|---|---|
| Numbers imported from an old CRM export | No record of when or how consent was given | Re-permission the list by another channel, then start clean |
| Consent bundled with terms acceptance | Consent must be specific and separate (Art. 7(2)) | A separate, unticked checkbox with its own wording |
| ”You agree to receive updates via WhatsApp and partners” | Not specific — who are the partners? | Name the channel, name the sender, name the topic |
| Opt-outs handled by an employee reading the inbox | Not reliable, not documented | Automatic opt-out on keyword, recorded with a timestamp |
| No deletion path for chats | Article 17 request cannot be fulfilled | Deletion that reaches the conversation history, not just the CRM row |
Two of these are worth a closer look.
Consent that survives scrutiny
The wording that works is boring and specific. Something like: “Yes, send me appointment reminders and offers from [company] on WhatsApp. I can reply STOP at any time to unsubscribe.” Separate checkbox, not pre-ticked, not bundled with anything else, and the number typed by the person themselves.
Then store what happened. The record should contain the number, the exact consent text as it was displayed, the timestamp, the source URL or form, and the IP address if you have it. If you ever get a complaint, that record is the entire defence. We wrote up the details in a separate piece on WhatsApp opt-in under the GDPR.
Retention that is actually a decision
Most WhatsApp chats accumulate forever, because nobody ever decided otherwise. Article 5(1)(e) says you keep personal data no longer than necessary. That does not mean you have to delete last week’s conversation; it means you have to be able to say why you keep it as long as you do. Pick a period — two years after the last interaction is a common, defensible choice for marketing — write it into your retention policy, and make sure something enforces it.
Where the data goes
Message content on WhatsApp is end-to-end encrypted in transit. What passes through Meta’s systems is the delivery infrastructure and the metadata around it, plus whatever you put into the API — the phone number, the template you sent, the parameters you filled in.
Your counterparty in the EU is WhatsApp Ireland Limited — controller for the WhatsApp service itself and processor for your business messaging under the Business Data Processing Terms (22 August 2025). Meta Platforms Ireland Limited is the contracting entity under the Cloud API Terms (2 April 2026).
Transfers to the United States run on the EU-US Data Privacy Framework, which the European Commission declared adequate in July 2023 and which is still in force on 1 August 2026. The first annulment action was dismissed by the General Court on 3 September 2025 (Latombe, T-553/23) and is under appeal at the Court of Justice (C-703/25 P). Its two predecessors were both annulled, so the sensible posture is to keep your record of processing current enough that you could describe the transfer if you had to, rather than to assume the question is closed.
The practical consequence for your paperwork: WhatsApp belongs in your Article 30 record, with Meta named, the categories of data listed, and the transfer basis stated.
Where your tooling matters
Almost everything above is about the layer between you and Meta. That is where consent gets captured, where opt-outs get honoured, where retention gets enforced, and where the export for a data subject request comes from. Meta does not do any of that for you.
So the questions to ask a vendor are narrow and answerable:
- Where is the data hosted, and can you get that in writing?
- Will they sign a DPA in your company’s name, without you asking twice?
- Does an opt-out fire automatically on the keyword, or does it depend on a person noticing?
- Can you export everything you hold about one contact, including the message history, in one action?
- Can you delete the same, completely, on request?
If a vendor cannot answer the fifth one, the first four do not help you.
What this means for you
If you are messaging European customers on WhatsApp, the compliance work is not exotic. Move off the consumer app, collect consent on a separate checkbox and store the proof, put the retention period in writing, make opt-out automatic, and keep a DPA on file for both Meta and your tool. That is the list. None of it is expensive; all of it is much cheaper before a complaint than after one.
Nybero was built in Europe with these things as defaults rather than settings — consent recorded at capture, STOP handled automatically, per-contact deletion including the consent history in the interface, and a DPA that does not require a phone call. If you want the longer version of the reasoning, our GDPR and WhatsApp overview goes through it channel by channel.
Updated 1 August 2026. An earlier version named only Meta Platforms Ireland as the EU counterparty, described STOP as a WhatsApp platform rule, and credited Nybero with a per-contact export it does not have; all three have been corrected. Describes common practice under the GDPR and the ePrivacy Directive as of 1 August 2026. It is not legal advice; national rules differ, and your own case deserves a lawyer’s eye.
