Compliance on WhatsApp is mostly common sense written down: ask before you message, say who you are, tell the truth, stop when asked and look after the data. The rules come from Meta’s policies and from Indian law, and the penalties range from a paused template to a restricted account. This guide lays out what a business should do.
Read alongside this guide: WhatsApp marketing software and Meta Business Verification guide.
Key takeaways
- Meta’s policies and Indian law both apply; DLT does not, but consent does.
- Explicit, recorded opt-in; separate marketing from transactional consent; honour opt-outs at once.
- Right template category, truthful content, your business name visible.
- Collect minimal data, protect it, never request credentials in chat, keep records.
Who sets the rules
Meta’s Business Messaging Policy and Commerce Policy govern what you may send and sell on the platform, and Meta enforces them through template review, quality ratings and account restrictions. Indian consumer-protection and data-protection law governs how you collect consent and handle personal data. The DLT system that regulates commercial SMS does not apply to WhatsApp, but the principle it enforces, consent, applies just the same.
Consent
Collect an explicit, affirmative opt-in that names WhatsApp and says what you will send. Record where and when it was given. Keep marketing consent separate from consent to transactional updates. Honour opt-out requests immediately through a keyword, a button or a reply, and keep a record of them as well.
Templates and content
Use the right template category: utility for transactional updates, marketing for promotions, authentication for one-time passwords. Content must be truthful, must not impersonate anyone, and must not promote goods or services that Meta’s Commerce Policy prohibits. Include your business name so recipients know who is writing, and avoid urgency you cannot justify.
Data care
Collect only what you need, control who on your team can see conversations, and delete data when a customer asks or when you no longer need it. Do not ask for passwords, one-time passwords, card numbers or similar in chat, and do not send sensitive personal or medical details in messages; send a notice and use a secure channel for the content.
Records to keep
If a question is ever asked, these answer it.
- Consent source, date and scope for each contact.
- Template versions and their approval status.
- An opt-out log with dates.
- Complaints received and how they were resolved.
- Who has access to the account and when it changed.
What goes wrong
Meta pauses templates that draw complaints, lowers messaging limits when quality ratings fall, and restricts accounts for repeated or serious policy breaches. Under Indian law, misleading messages and mishandled data carry their own consequences. Prevention is cheaper in every case: consent, honest templates, prompt opt-outs and tidy records.
Next steps
Conclusion
Treat compliance as part of the product rather than a hurdle. Consent, honest templates, prompt opt-outs and careful data handling are also what makes customers answer, which is the only reason to be on the channel.