An Indian or UAE exporter with buyers in Germany, a Dubai hotel with guests from France, a Bengaluru SaaS company with users in the Netherlands: each of these, once it starts sending WhatsApp campaigns to EU numbers, is handling personal data under GDPR. WappBlaster gives such teams the official WhatsApp Business Platform, but the legal groundwork (why you may message someone, what proof you keep, how long you hold chats) is a decision your business has to make and document. This article sets out that groundwork in plain terms. It is not legal advice, and a qualified adviser should review your final consent wording.
GDPR and Meta policy are separate tests for WhatsApp marketing
Teams often assume that because Meta requires opt-in for marketing templates, they are covered under data protection law. They are not the same check. Meta's rule protects the platform and recipients from spam; GDPR asks whether your organisation has a lawful reason to process this person's data at all, and whether you can prove it. You can satisfy Meta with a checkbox that says "Yes, send me updates on WhatsApp" and still fail GDPR if that checkbox was pre-ticked, bundled with accepting your terms, or did not say what the messages would be about.
Writing WhatsApp marketing consent that holds up under GDPR
For marketing, consent is the basis most businesses rely on, and it has to be freely given, specific, informed and unambiguous. In practice, on a web form, that means:
- A separate, unticked box just for WhatsApp, not shared with email or SMS.
- Wording that names the channel and the content: "Send me new collection previews and order updates on WhatsApp."
- Your business name, so the person knows who will message them.
- A line saying they can stop at any time by replying STOP.
- A link to your privacy notice explaining what you store and for how long.
Translate the wording properly for each market. A German buyer agreeing to English text they only half understood is a weak foundation.
What a GDPR consent record for WhatsApp should contain
| Field | Example | Why you need it |
|---|---|---|
| Timestamp | 2026-04-03 10:42 CET | Shows consent predates the first message |
| Source | Checkout form, de.example.com | Lets you reproduce what the person saw |
| Wording version | consent-de-v2 | Ties the record to the exact text shown |
| Purpose | Marketing and order updates | Consent is specific to a purpose |
| Withdrawal | Date of STOP reply, if any | Proves you honoured the objection |
In WappBlaster these can live as custom fields and tags on each contact, filled automatically when a website form triggers the opt-in. If a customer in Lyon asks how you obtained their number, you should be able to answer from one screen.
Handling STOP, objection and GDPR deletion requests on WhatsApp
The right to object to direct marketing is absolute: once someone says stop, marketing stops. Opt-out handling on keywords and buttons should remove the contact from marketing segments immediately, while still allowing genuinely transactional messages they need, such as a shipping notice for an order already placed. Deletion requests go further. Decide in advance which systems hold the number (your CRM, WappBlaster, any spreadsheet a salesperson exported) and who clears each one.
GDPR processors, agreements and how long WhatsApp chats are kept
Your messaging provider and Meta act on your instructions when they process contact data, which is why a data processing agreement belongs in your file before the first EU campaign. WappBlaster's position is set out on its data processing page. Retention is the part teams forget: conversation content is personal data too, so set a period that matches a real need (resolving disputes, warranty claims) rather than keeping every thread indefinitely. For a wider view of the automation side, see our note on GDPR-compliant WhatsApp automation.
WhatsApp marketing practices to drop before you message EU numbers
- Importing trade-fair business cards straight into a marketing segment.
- Treating an inbound support message as permission for future promotions.
- Copying an Indian consent form word for word into an EU checkout.
- Putting more personal data in template variables than the message needs.
Pricing differs by recipient country too: Meta charges per delivered message, by category and destination, and on WappBlaster that charge is billed at cost alongside the flat annual platform licence.