Yes, WhatsApp automation can be GDPR compliant, provided you arrange three things: demonstrable opt-in before you message anyone, data minimization (only processing and keeping what you need), and a data processing agreement with your platform. Don't share sensitive personal data over WhatsApp — no medical records, no national ID numbers — and tell customers in your privacy statement that you use WhatsApp as a channel.
Opt-in: what counts and what doesn't
Opt-in means the customer has clearly agreed to contact over WhatsApp, and knows what it's about. Ask for it explicitly and separately, and record when and where it was given.
- Valid: a checked box at checkout that states what it covers
- Valid: the customer sends you a message themselves (for service, not for marketing)
- Valid: a QR code or click-to-WhatsApp link where it's clear what you'll use it for
- Not valid: a phone number from an old file with no consent attached
- Not valid: reusing an email opt-in for WhatsApp marketing
Marketing needs separate consent
Consent for service information doesn't cover offers. If you want to send marketing, ask for a separate checkbox for it and make sure opting out takes a single action. An unsubscribe button in your flow that actually records the opt-out is the clean way to do it.
Data minimization and retention periods
- Only ask for data you need for this flow
- Store answers in your own system, not indefinitely in the conversation
- Set a retention period and stick to it
- Don't put sensitive personal data in WhatsApp messages
Data processing agreement
As a platform, we process personal data on your behalf. That requires a data processing agreement, which we make available — see our data processing agreement. For the WhatsApp channel itself, Meta acts as its own processor, under its own terms that you agree to during onboarding.
Note: this is not legal advice
We're a software vendor, not lawyers. If you process sensitive data or work in a regulated sector, have your setup reviewed by a privacy lawyer or your data protection officer.
Frequently asked questions
Can I send a customer a WhatsApp message without opt-in?
No. Opt-in is required for messages you initiate. Replying to a message the customer sent you is fine — that's service, inside the 24-hour window.
Is the data stored in the EU?
That depends on the parties involved. Ask us for the current processing details and subprocessors; for Meta, the WhatsApp Business terms themselves apply.
Can I exchange medical or sensitive data over WhatsApp?
Don't. Keep it to logistics — appointments and reminders — and use a secure channel built for the purpose when it comes to clinical information.
How do I record opt-in so I can prove it?
Record when, where, and what someone gave consent for alongside the contact — for example as a field in your CRM that your flow passes along.